fix: read the default Honcho URL at runtime and release dashboard v1.2.3

.env.example

@@ -13,8 +13,9 @@
 # REQUIRED
 # =====================================================================
 
-# Upstream Honcho instance the dashboard talks to. Inlined into the
-# browser bundle at build time AND read by the server-side proxy at runtime.
+# Upstream Honcho instance the dashboard talks to, read at runtime. The proxy
+# uses it as its default and new browsers start on it. Use an address the
+# dashboard container can reach; other devices only need to reach the dashboard.
 # Example:
 #   HONCHO_BASE_URL=http://honcho.local:8000
 HONCHO_BASE_URL=http://localhost:8000

AGENTS.md

@@ -93,6 +93,12 @@ Auth is `Authorization: Bearer <token>` header — optional in local dev (`AUTH_
 
 API client lives in `src/lib/honcho/`. **Never hardcode the base URL or token in components** — read from the config store. Config is stored client-side in `localStorage` under `honcho-dashboard:instances` + `honcho-dashboard:activeId` (multi-instance).
 
+`next build` inlines `process.env.NEXT_PUBLIC_*` into server code too, so the published
+image cannot get runtime config that way. The default target comes from
+`src/lib/honcho/defaultTarget.ts`: the server reads it at request time and `app/layout.tsx`
+passes it to the browser in a meta tag. Keep that module's compatibility rules: the implicit
+allowlist only grows, and only the untouched `default`/`local` seed is ever rewritten.
+
 Use `@honcho-ai/sdk` 2.5.1+ for scopes, scope-aware search/context, peer scope
 recall, and workspace chat. The raw scope-list call is reserved for the
 side-effect-free compatibility probe; do not reintroduce raw 3.1 feature paths.

README.md

@@ -149,11 +149,13 @@ The template pulls the prebuilt image from GHCR — update later with
 `docker compose pull && docker compose up -d`. To build from source instead, uncomment
 the `build:` block in the Compose file and run `docker compose up --build`.
 
-On first run, open the dashboard and point it at your Honcho server under **CONFIG** —
-the prebuilt image ships with a `http://localhost:8000` default baked in (the active
-instance is chosen in-app and stored per browser). Set `HONCHO_PROXY_ALLOWED_BASES` to
-include that URL so the same-origin proxy will forward to it. Building from source with
-`HONCHO_BASE_URL` set instead bakes your instance in as the default.
+`HONCHO_BASE_URL` is read when the container starts, so the prebuilt image needs no
+rebuild: it becomes the proxy's default upstream and the instance any new browser starts
+on. Because the proxy makes the request, use the address the dashboard host can reach;
+phones and other devices only need to reach the dashboard. Browsers still on the untouched
+`local` → `http://localhost:8000` instance from an older image move to it automatically.
+Instances you created or edited under **CONFIG** are never changed. To use other Honcho
+servers, add them under **CONFIG** and list them in `HONCHO_PROXY_ALLOWED_BASES`.
 
 A `docker-compose-example.yml` template is included at the repo root. Copy it to
 `docker-compose.yml` (which is gitignored, so your local edits stay local). To wire the

docker-compose-example.yml

@@ -22,10 +22,9 @@ services:
 
     # ---- Prefer to build from source instead of pulling? Comment out the
     # `image:` line above and uncomment this block, then `docker compose up --build`.
-    # NEXT_PUBLIC_* values are inlined into the browser bundle at build time and
-    # cannot be changed at runtime, so they live here as build args. (The published
-    # image bakes a http://localhost:8000 fallback; either way the active instance
-    # is chosen in-app, so most users can simply pull.) ----
+    # The published image reads HONCHO_BASE_URL at runtime (see `environment:`),
+    # so most users can simply pull. Build args only change the fallback used
+    # when that runtime value is unset. ----
     # build:
     #   context: ./site
     #   dockerfile: Dockerfile
@@ -39,8 +38,8 @@ services:
 
     environment:
       # ---- Same-origin proxy (server-side, runtime) ----
-      # Default upstream when the browser doesn't pin a specific instance via
-      # X-Honcho-Base-Url. Must match (or be a subset of) the allowlist below.
+      # Default upstream, read at runtime: the proxy uses it when a request pins
+      # no instance, and new browsers start on it. It is implicitly allowlisted.
       NEXT_PUBLIC_HONCHO_BASE_URL: ${HONCHO_BASE_URL:-http://localhost:8000}
 
       # Comma-separated allowlist of upstream Honcho origins the proxy will

site/Dockerfile

@@ -12,11 +12,10 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
-# NEXT_PUBLIC_* vars are inlined into the browser bundle at build time, not
-# runtime. Pass --build-arg NEXT_PUBLIC_HONCHO_BASE_URL=... to docker build
-# (or use docker-compose `build.args`) so the dashboard ships pointed at your
-# Honcho instance. HONCHO_PROXY_BASE_URL / HONCHO_PROXY_ALLOWED_BASES stay
-# runtime-only and can be overridden via `-e` flags.
+# NEXT_PUBLIC_* vars are inlined at build time. The server also reads
+# NEXT_PUBLIC_HONCHO_BASE_URL (and HONCHO_PROXY_BASE_URL /
+# HONCHO_PROXY_ALLOWED_BASES) at runtime via `-e`, so the build arg below is
+# only the fallback when no runtime value is set.
 ARG NEXT_PUBLIC_HONCHO_BASE_URL=http://localhost:8000
 ARG NEXT_PUBLIC_HONCHO_TOKEN=
 ENV NEXT_PUBLIC_HONCHO_BASE_URL=$NEXT_PUBLIC_HONCHO_BASE_URL

site/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honcho-dashboard",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "private": true,
   "description": "Self-hosted Honcho dashboard — Next.js + Tailwind v4 + Framer Motion",
   "license": "GPL-3.0",