diff --git a/README.md b/README.md
index 27dc940..583041c 100644
--- a/README.md
+++ b/README.md
@@ -280,7 +280,7 @@ bun run make:desktop
Desktop-specific environment:
- `ISLANDFLOW_DESKTOP_START_URL` is only used by the Electron shell and is restricted to trusted Islandflow app origins.
-- `NEXT_PUBLIC_API_URL` remains the web app API/WebSocket origin control and usually points at `https://flow.deltaisland.io` when developing local UI inside Electron.
+- `NEXT_PUBLIC_API_URL` remains the web app API/WebSocket origin control and usually points at `https://api.flow.deltaisland.io` when developing local UI inside Electron.
## Environment Configuration
@@ -406,7 +406,7 @@ Default `smart-money` policy rejects lower-information prints and keeps higher-c
| `LIVE_LIMIT_OPTIONS` | `1000` | Live cache depth for options channel unless overridden. |
| `LIVE_LIMIT_ALERTS` | `300` | Live cache depth for alerts channel unless overridden. |
| `LIVE_LIMIT_NEWS` | `100` | Live cache depth for news channel unless overridden. |
-| `NEXT_PUBLIC_API_URL` | auto-detected in browser, `http://127.0.0.1:4000` fallback | Explicit base URL for API/WS calls from the web app. |
+| `NEXT_PUBLIC_API_URL` | `https://api.flow.deltaisland.io` for local web dev, auto-detected in browser when unset by other runners | Explicit base URL for API/WS calls from the web app. |
| `NEXT_PUBLIC_LIVE_HOT_WINDOW` | `600` | Max hot-window items retained for non-options live streams in UI state. |
| `NEXT_PUBLIC_LIVE_HOT_WINDOW_OPTIONS` | `1200` | Dedicated max hot-window items retained for options prints. |
| `NEXT_PUBLIC_NBBO_MAX_AGE_MS` | `1000` | Frontend NBBO staleness threshold. |
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index d8166b8..70ba392 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -25,5 +25,5 @@ This workspace packages a thin Electron shell around the hosted Islandflow app.
## Development Notes
- `ISLANDFLOW_DESKTOP_START_URL` controls which trusted app URL Electron loads. Prefer `/options` for deep links; `/tape` remains supported and redirects in the web app for compatibility.
-- `NEXT_PUBLIC_API_URL` remains a web-app setting and should typically be `https://flow.deltaisland.io` when developing the local UI inside Electron.
+- `NEXT_PUBLIC_API_URL` remains a web-app setting and should typically be `https://api.flow.deltaisland.io` when developing the local UI inside Electron.
- `assets/` currently contains placeholders only; a real `.icns` icon is deferred.
diff --git a/apps/web/scripts/dev.ts b/apps/web/scripts/dev.ts
index 985f6e6..c9754d5 100644
--- a/apps/web/scripts/dev.ts
+++ b/apps/web/scripts/dev.ts
@@ -1,9 +1,16 @@
import { rm } from "node:fs/promises";
+const DEFAULT_REMOTE_API_URL = "https://api.flow.deltaisland.io";
+
const run = async () => {
const port = 3000;
const distDir = ".next-dev";
console.log(`[web] starting Next.js dev server on port ${port}`);
+ console.log(
+ `[web] API origin: ${Bun.env.NEXT_PUBLIC_API_URL ?? DEFAULT_REMOTE_API_URL}${
+ Bun.env.NEXT_PUBLIC_API_URL ? " (from NEXT_PUBLIC_API_URL)" : " (default)"
+ }`
+ );
const path = Bun.env.PATH ?? "";
const cwd = `${import.meta.dir}/..`;
@@ -21,6 +28,7 @@ const run = async () => {
env: {
...Bun.env,
PATH: `${cwd}/node_modules/.bin:${path}`,
+ NEXT_PUBLIC_API_URL: Bun.env.NEXT_PUBLIC_API_URL ?? DEFAULT_REMOTE_API_URL,
PORT: String(port)
}
});
diff --git a/docs/turns/2026-06-13-0338-configure-hosted-api-endpoint.html b/docs/turns/2026-06-13-0338-configure-hosted-api-endpoint.html
new file mode 100644
index 0000000..2af3bc2
--- /dev/null
+++ b/docs/turns/2026-06-13-0338-configure-hosted-api-endpoint.html
@@ -0,0 +1,493 @@
+
+
+
+
+
+ Configure Hosted API Endpoint
+
+
+
+
+
+ Turn Document ยท June 13, 2026
+ Configure Local Web and Desktop Development for the Hosted API
+
+
Branchlavender/configure-hosted-api-endpoint
+
Issueislandflow-7l2
+
API Hosthttps://api.flow.deltaisland.io
+
App Hosthttps://flow.deltaisland.io
+
+
+
+
+ Summary
+ Local web development and the desktop local-UI workflow now default API and WebSocket traffic to https://api.flow.deltaisland.io, while the hosted desktop window still opens the app at https://flow.deltaisland.io.
+
+
+
+ Changes Made
+
+ - Added a local web development default API origin in
apps/web/scripts/dev.ts.
+ - Changed
scripts/dev-desktop.ts so its spawned local web UI uses the API subdomain by default.
+ - Updated README guidance for web and desktop development to distinguish the hosted app origin from the hosted API origin.
+ - Updated the ignored local file
apps/web/.env.local on this machine to point at the API subdomain. That local file is not committed.
+
+
+
+
+ Context
+ The VPS check over ssh di confirmed https://api.flow.deltaisland.io/health returns 200, while https://flow.deltaisland.io/health returns 404. The app origin remains the hosted UI, and the API subdomain is the correct base for local dev API and WebSocket calls.
+
+
+
+ Important Implementation Details
+
+ bun run dev:web now passes NEXT_PUBLIC_API_URL into Next.js when the variable is not already set.
+ bun run dev:desktop still launches Electron at http://127.0.0.1:3000, but the local web child receives the hosted API origin.
+ bun run dev:desktop:remote still loads https://flow.deltaisland.io directly and does not start the local web child.
+
+
+
+
+ Relevant Diff Snippets
+ Rendered with @pierre/diffs/ssr from the focused endpoint patch and contained in an offline iframe.
+
+
+
+
+ Expected Impact for End-Users
+ Running local web or desktop development should reach the live Delta Island API without manually remembering the current API hostname. Hosted desktop behavior stays pointed at the public app.
+
+
+
+ Validation
+
+ ssh di plus curl confirmed api.flow.deltaisland.io/health responds with 200.
+ bun run scripts/check-public-api-routes.ts https://api.flow.deltaisland.io passed for REST and WebSocket probes.
+ bun test apps/web/app/terminal.test.ts apps/web/app/api/admin/synthetic/routes.test.ts apps/desktop/src/security.test.ts passed.
+ bun --cwd=apps/web run build passed.
+ - A brief
bun run dev:web smoke confirmed the API origin is https://api.flow.deltaisland.io, but port 3000 was already occupied by an existing node listener.
+
+
+
+
+ Issues, Limitations, and Mitigations
+
+ - The smoke run could not bind port
3000 because another local process was already listening there. The startup log still confirmed the corrected API origin.
+ - The local ignored
apps/web/.env.local change fixes this machine only. Tracked script defaults cover missing local env files for future worktrees.
+ - Unrelated dashboard route edits were present in the worktree before this endpoint fix and were not included in this task's intended patch.
+
+
+
+
+ Follow-up Work
+ No endpoint follow-up is required. The existing port 3000 listener can be stopped separately if the user wants a clean local dev server restart.
+
+
+
+
diff --git a/scripts/dev-desktop.ts b/scripts/dev-desktop.ts
index fbf5a66..062e932 100644
--- a/scripts/dev-desktop.ts
+++ b/scripts/dev-desktop.ts
@@ -3,6 +3,7 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
import path from "node:path";
const DESKTOP_REMOTE_URL = "https://flow.deltaisland.io";
+const DESKTOP_REMOTE_API_URL = "https://api.flow.deltaisland.io";
const DESKTOP_LOCAL_URL = "http://127.0.0.1:3000";
const WEB_PORT = 3000;
@@ -268,7 +269,7 @@ if (!remoteMode) {
cmd: ["bun", "run", "dev"],
cwd: "apps/web",
env: {
- NEXT_PUBLIC_API_URL: Bun.env.NEXT_PUBLIC_API_URL ?? DESKTOP_REMOTE_URL
+ NEXT_PUBLIC_API_URL: Bun.env.NEXT_PUBLIC_API_URL ?? DESKTOP_REMOTE_API_URL
}
});
await waitForWebPort();