MINT_PASCAL_HOST_ORIGIN is unconditionally overwritten, breaking the Mint plugin on any non-loopback deployment

[oldgeezy]

Summary

packages/cli builds the editor child process environment with a hardcoded
MINT_PASCAL_HOST_ORIGIN, which clobbers any value the operator sets. The Mint
plugin therefore always sends a redirect_uri of
http://pascal.localhost:3000/api/plugins/mint/oauth/callback, which Mint's
authorization server rejects with "Mint requires HTTPS or loopback redirect
URIs" — it is neither HTTPS, nor is pascal.localhost an exact loopback host.

There is no configuration that can work around this.

Where

dist/editor-process.js (from @pascal-app/cli@0.1.5):

const state = {
    ...
    url: `http://pascal.localhost:${port}`,
};
const environment = {
    ...process.env,                        // operator value lands here...
    NODE_ENV: 'production',
    HOSTNAME: state.host,
    PORT: String(port),
    PASCAL_DATA_DIR: options.paths.data,
    PASCAL_INSTANCE_ID: instanceId,
    PASCAL_RUNTIME_VERSION: runtime.version,
    MINT_PASCAL_HOST_ORIGIN: state.url,     // ...and is overwritten here
};

The spread includes the operator's value and the explicit key then discards it.

This matters because apps/editor/app/api/plugins/mint/[...path]/route.ts is
written to be configurable:

handleMintPascalRequest(request, {
  origin: process.env.MINT_PASCAL_HOST_ORIGIN ?? BASE_URL,
})

The ?? never sees an operator value, because the CLI has already replaced it.

Reproduce

1. Run the CLI behind any reverse proxy on a real hostname.
2. Set MINT_PASCAL_HOST_ORIGIN=https://<your-host> in the container environment.
3. Confirm it is present: printenv | grep MINT shows the correct value.
4. curl -sSD - -o /dev/null https://<your-host>/api/plugins/mint/oauth/start | grep -i location

Observed redirect_uri:

http%3A%2F%2Fpascal.localhost%3A3000%2Fapi%2Fplugins%2Fmint%2Foauth%2Fcallback

Expected: the configured origin.

Suggested fix

Let the environment win when it is set:

MINT_PASCAL_HOST_ORIGIN: process.env.MINT_PASCAL_HOST_ORIGIN || state.url,

That preserves current behaviour for local use and unblocks proxied deployments.
I am running this as a build-time patch locally and it resolves the redirect.

Environment

• @pascal-app/cli 0.1.5, editor runtime 0.1.5, Next.js 16.3.0
• Docker (node:22-bookworm-slim), reverse proxy terminating TLS
• Browser origin is a normal HTTPS hostname