fix(workspace, apps, shell): resolve the workspace WS endpoint from PUBLIC_WS_URL in one place, not sixteen literals

Org Workbench rendered its chrome and nothing else on augment.didi.sh: no
roster, no organizations, a red `closed` pill in the corner. The cause was a
single line repeated across the app tree — every remote declared
`const WS_URL = 'ws://localhost:3001/ws'` and never read the environment, so a
deployed surface opened its data socket against the *visitor's* laptop. It could
not have worked in production for two independent reasons: the host is wrong,
and `ws://` from an `https://` origin is blocked as mixed content. Local dev hid
it perfectly, because the operator's machine really is running
workspace-service on :3001. Three of the sixteen affected remotes are deployed,
which took down the whole Augment-from-DB flow rather than one surface.

The endpoint now has exactly one home. `packages/workspace/src/ws-url.ts`
exports `resolveWsUrl()` and `resolveHttpBase()`, and `TransportConfig.url`
becomes optional — omit it and the transport resolves from PUBLIC_WS_URL on
every connect attempt. That is the part that makes the bug structurally
unavailable: the failure mode was never a logic error, it was copy-paste into a
new remote, and the copy-pasteable thing no longer exists. Every call site was
converted, including the two that had quietly got it right (chat, and
corpora-curator's real client in curation.svelte.ts) so there is no second
pattern to imitate, and the WorkspaceSwitcher tooltip stops telling operators
that localhost is unreachable when the endpoint is somewhere else entirely.

Verified by building org-workbench with PUBLIC_WS_URL set and reading the
emitted bundle: the resolver compiles to the prod endpoint with localhost left
only as the dead fallback branch. A new guard in the workspace suite sweeps
apps/, shell/, and packages/ for the literal and fails with the offending
filenames; planting the old line back into org-workbench makes it fail, so it
is not vacuous. svelte-check is clean across all 17 surfaces.

Deploy note: PUBLIC_* is baked at build time, so the three deployed remotes need
a rebuild, not a restart, once their variables are set.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017HuzSPdPK4QEhs7eztHgoC

Author: mpstaton

apps/affiliation-rating-resolver/src/App.svelte

@@ -8,7 +8,7 @@
   // context-v/specs/Augment-From-Affiliations.md.
 
   import { onMount } from 'svelte';
-  import { workspace, type RecordSet, type Row } from '@augment-it/workspace';
+  import { workspace, type RecordSet, type Row, resolveWsUrl } from '@augment-it/workspace';
   import ColumnMapper from './components/ColumnMapper.svelte';
   import { normalizeRatingRecord, guessMapping, MAPPING_NONE } from './lib/normalize';
   import {
@@ -23,7 +23,7 @@
   import type { RatingFieldMapping, RatingNormRecord, AffiliationDetail, Link, CorpusEntry } from './lib/types';
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
   const ACTIVE_RECORD_SET_KEY = 'augment-it:active-record-set';
   const MAPPING_KEY_PREFIX = 'augment-it:affiliation-rating-resolver:mapping:';
 

apps/chat/src/App.svelte

@@ -6,7 +6,7 @@
   // is established independently (no shared workspace singleton).
 
   import { onMount } from 'svelte';
-  import { workspace } from '@augment-it/workspace';
+  import { workspace, resolveWsUrl } from '@augment-it/workspace';
   import CharacterCastRow from './CharacterCastRow.svelte';
   import ChatSurface from './ChatSurface.svelte';
 
@@ -15,9 +15,7 @@
   // even when mounted inside the shell, so it needs the same env-configured
   // WS_URL the shell and corpora-curator each read (rsbuild inlines
   // PUBLIC_-prefixed vars into import.meta.env at build time).
-  const WS_URL =
-    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ||
-    'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
 
   let connectionStatus = $state<'connecting' | 'open' | 'closed' | 'error' | 'auth_required'>('connecting');
 

apps/corpora-curator/src/App.svelte

@@ -1,12 +1,12 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import { workspace } from '@augment-it/workspace';
+  import { workspace, resolveWsUrl } from '@augment-it/workspace';
   import { curation } from './curation.svelte';
   import CorpusPicker from './CorpusPicker.svelte';
   import SourceList from './SourceList.svelte';
   import SourceDetail from './SourceDetail.svelte';
 
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
 
   onMount(() => {
     curation.init();

apps/corpora-curator/src/curation.svelte.ts

@@ -8,7 +8,7 @@
 // $state is assigned in the constructor (not as a class-field initializer) to
 // match the workspace package's placement-invariant note about field lowering.
 
-import { workspace, WORKSPACE_CHANGED_EVENT, type WorkspaceSummary } from '@augment-it/workspace';
+import { workspace, WORKSPACE_CHANGED_EVENT, type WorkspaceSummary, resolveWsUrl } from '@augment-it/workspace';
 import type { ExtractKind, Source, Strategy } from './types';
 
 const TOKEN_KEY = 'augment-it:session-token';
@@ -18,9 +18,7 @@ const TOKEN_KEY = 'augment-it:session-token';
 // shell and chat each read (rsbuild inlines PUBLIC_-prefixed vars into
 // import.meta.env at build time — applies to plain .ts modules too, not
 // just .svelte files).
-const WS_URL =
-  ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ||
-  'ws://localhost:3001/ws';
+const WS_URL = resolveWsUrl();
 // Stores "<type>:<slug>" since gh #88 — uniqueness is (type, slug), so a bare
 // slug can restore the wrong corpus once a workspace holds both. Bare slugs
 // from before #88 still resolve; see loadStrategies().

apps/enhanced-records-list/src/App.svelte

@@ -28,7 +28,6 @@
   onMount(() => {
     const TOKEN_KEY = 'augment_it_session_token';
     workspace.connect({
-      url: 'ws://localhost:3001/ws',
       getToken: () => localStorage.getItem(TOKEN_KEY),
       saveToken: (t) => localStorage.setItem(TOKEN_KEY, t),
       onStatus: (s) => {

apps/org-workbench/src/App.svelte

@@ -7,7 +7,7 @@
   // from person-db-resolver. See context-v/specs/Augment-From-DB-Flow.md.
 
   import { onMount } from 'svelte';
-  import { workspace } from '@augment-it/workspace';
+  import { workspace, resolveWsUrl } from '@augment-it/workspace';
   import OrgSearch from './OrgSearch.svelte';
   import OrgCard from './OrgCard.svelte';
   import OrgCreateInline from './OrgCreateInline.svelte';
@@ -17,7 +17,7 @@
   import type { OrgDetail, OrgSuggestion } from './lib/types';
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
   // Restore the last-worked org on remount (HMR, flow switch, tab reopen).
   const ACTIVE_ORG_KEY = 'augment-it:org-workbench:active-org';
   // Cross-remote focused-entity broadcast — the chat rail includes it in

apps/pack-runner/src/App.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import { workspace, type RecordSet, type Row } from '@augment-it/workspace';
+  import { workspace, type RecordSet, type Row, resolveWsUrl } from '@augment-it/workspace';
   import {
     BUNDLES, getBundle, packDisplayName, inferEntityNameField,
     PACK_PALETTE_META,
@@ -23,7 +23,7 @@
   let rowPackFired = $state<Record<string, Set<string>>>({});
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
 
   // Remember the user's last record-set + column picks so re-entry doesn't
   // require re-selecting everything. Keys keep the augment-it prefix per

apps/person-db-resolver/src/App.svelte

@@ -7,7 +7,7 @@
   // context-v/plans/Person-Aware-Canonical-Resolver-Extension.md.
 
   import { onMount } from 'svelte';
-  import { workspace, type RecordSet, type Row } from '@augment-it/workspace';
+  import { workspace, type RecordSet, type Row, resolveWsUrl } from '@augment-it/workspace';
   import RecordCard from './components/RecordCard.svelte';
   import ColumnMapper from './components/ColumnMapper.svelte';
   import PersonCandidateList from './components/PersonCandidateList.svelte';
@@ -35,7 +35,7 @@
   } from './lib/types';
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
   const ACTIVE_RECORD_SET_KEY = 'augment-it:active-record-set';
   const MAPPING_KEY_PREFIX = 'augment-it:person-db-resolver:mapping:';
   // Per-record-set "where I left off" — restored on every selectRecordSet()

apps/prompt-template-manager/src/App.svelte

@@ -1,9 +1,9 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import { workspace, type PromptTemplate, type PromptTool } from '@augment-it/workspace';
+  import { workspace, type PromptTemplate, type PromptTool, resolveWsUrl } from '@augment-it/workspace';
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
   const TOKEN_RE = /\{\{\s*([^{}]+?)\s*\}\}/g;
 
   let status = $state<'connecting' | 'open' | 'closed' | 'error' | 'auth_required'>('connecting');

apps/record-collector/src/App.svelte

@@ -1,11 +1,11 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import { workspace, type RecordSet, type Row } from '@augment-it/workspace';
+  import { workspace, type RecordSet, type Row, resolveWsUrl } from '@augment-it/workspace';
   import RecordSetsList from './components/RecordSetsList.svelte';
   import { formatFieldValue } from './logic/format';
 
   const TOKEN_KEY = 'augment-it:session-token';
-  const WS_URL = 'ws://localhost:3001/ws';
+  const WS_URL = resolveWsUrl();
 
   let status = $state<'connecting' | 'open' | 'closed' | 'error' | 'auth_required'>('connecting');
   let selectedId = $state<string | null>(null);