fix(api): resolve LANGFUSE_HOST lazily so .env.langfuse host is honored

[terry90918]

What

Replace the module-level export const baseUrl in src/lib/api.ts with a lazy getBaseUrl() function that reads process.env.LANGFUSE_HOST at call time. langfuseApi() now resolves the host per request; client.ts reuses getBaseUrl() (dropping its duplicated default-host literal).

Why

baseUrl was evaluated at module-load time. In ESM, static import declarations are hoisted, so api.ts (imported transitively by the tool modules) was fully evaluated before index.ts's module body ran the .env.langfuse loader. The result: a LANGFUSE_HOST set in .env.langfuse was silently ignored by the public API client — even though client.ts honored it (it read process.env lazily inside its singleton). This made the two clients inconsistent and broke the documented per-project override (feat(env): per-project .env.langfuse credential override, #17) for LANGFUSE_HOST.

The fix makes api.ts read the host lazily, restoring the documented priority (.env.langfuse > Plugin ${VAR} > ~/.zshenv) and aligning both clients.

Origin

Surfaced by a security review of the repo. Two candidates were raised:

• .env.langfuse unconditional credential override — intentionally not changed: it is the documented, deliberate behavior of feat(env): per-project .env.langfuse credential override #17; the security filter rated it a false positive (3/10, requires write access to the server's CWD, outside the threat model). Reversing it (= → ??=) would regress feat(env): per-project .env.langfuse credential override #17.
• LANGFUSE_HOST ignored by api.ts (this PR) — a real correctness bug, fixed here.

Reviewer notes

• No circular import: api.ts has zero imports; client.ts → api.ts is one-way.
• The removed export const baseUrl had no external consumers (no file imported { baseUrl }).
• client.ts's singleton timing is unchanged — first getLangfuseClient() call happens at request time (used as a default-param expression in traces.ts/observations.ts/sessions.ts), well after .env.langfuse loads.

Test plan

• bun test — 56 pass / 0 fail (3 new host-resolution regression tests, RED→GREEN verified)
• bun run typecheck — clean
• bun run lint — clean (--max-warnings=0)

[coderabbitai]

Warning

Review limit reached

@terry90918, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 57 minutes and 16 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cafb551-5fe5-4ccb-9155-a667a87dd0cf

📥 Commits

Reviewing files that changed from the base of the PR and between dade4ae and 16552bd.

📒 Files selected for processing (3)

• src/lib/api.test.ts
• src/lib/api.ts
• src/lib/client.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}