feat(dev): add portless URLs for all apps

[mezotv]

Description

Give a short summary of what this PR does and why it's needed.

Screenshot/Recording (if applicable)

Attach a screenshot or recording of the change. This is optional, but can help reviewers understand the change. You can use Loom to record a video.

Checklist

• I ran a self-review before opening this PR
• I ran formatting/linting/type checks locally
• I updated docs when behavior or setup changed
• I only added comments where the logic is not obvious
• I have used conventional commits for the PR title and commit messages
• I did not use AI to write the code in this PR or have disclosed that I did

---

Summary by cubic

Add portless to all apps to provide stable, HTTPS, portless local URLs in development. Updates callbacks, auth, ORPC, and emails to prefer PORTLESS_URL only in dev; production behavior is unchanged.

• New Features

  • Dev servers now run via portless with URLs: https://app.notra.localhost, https://notra.localhost, https://api.notra.localhost, https://docs.notra.localhost, https://email.notra.localhost.
  • Added portless config and dev:app scripts in apps/api, apps/dashboard, apps/web, apps/docs, and packages/email; turbo.json now passes PORT, PORTLESS, PORTLESS_* and includes PORTLESS_URL.
  • Base URL resolution uses getPortlessUrl() to prefer PORTLESS_URL only in development across dashboard integrations (GitHub, Linear, Twitter), workflow and notification emails, auth (baseURL, invite links, trusted origins), ORPC client, email links, and packages/ai URL utils.

• Migration

  • First run: approve Portless’s local certificate.
  • No config changes; run dev as usual. Portless is dev-only. Set PORTLESS=0 to bypass the proxy and use fallback ports.

^{Written for commit f03e4fd. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
notra	Ready	Preview, Comment	Jul 10, 2026 11:43am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
notra-web	Skipped		Jul 10, 2026 11:43am

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[capy-ai]

Capy auto-review is paused for this organization because the usage-cycle auto-review limit has been reached. Increase the limit or turn it off in billing settings to resume automatic reviews.

[github-actions]

React Doctor found 1 issue in 1 file · 1 error · score 49 / 100 (Critical) · vs main

Errors

• ❌ package.json:71 low-supply-chain-score

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit f03e4fd. See inline comments for fixes.}

[cubic-dev-ai]

1 issue found across 20 files

Confidence score: 4/5

• In apps/dashboard/src/lib/auth/server.ts, strict Turborepo tasks like build may not expose PORTLESS_URL, causing auth to silently fall back to BETTER_AUTH_URL even when a portless URL is intended; this can lead to environment-specific auth endpoint drift after deploy. Add PORTLESS_URL to the relevant task/env passthrough before merging (or fail fast when it’s missing) to remove the ambiguity.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/dashboard/src/lib/auth/server.ts">

<violation number="1" location="apps/dashboard/src/lib/auth/server.ts:146">
P2: `PORTLESS_URL` will be unavailable for strict Turborepo tasks such as `build`, so this auth config can silently fall back to `BETTER_AUTH_URL` even when a portless URL is configured. Consider adding `PORTLESS_URL` to `turbo.json` `globalEnv` alongside the other auth/app URL variables.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: PORTLESS_URL will be unavailable for strict Turborepo tasks such as build, so this auth config can silently fall back to BETTER_AUTH_URL even when a portless URL is configured. Consider adding PORTLESS_URL to turbo.json globalEnv alongside the other auth/app URL variables.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/dashboard/src/lib/auth/server.ts, line 146:

<comment>`PORTLESS_URL` will be unavailable for strict Turborepo tasks such as `build`, so this auth config can silently fall back to `BETTER_AUTH_URL` even when a portless URL is configured. Consider adding `PORTLESS_URL` to `turbo.json` `globalEnv` alongside the other auth/app URL variables.</comment>

<file context>
@@ -143,6 +143,7 @@ function getTrustedOrigins() {
       [
         "http://localhost:3000",
         "https://app.usenotra.com",
+        process.env.PORTLESS_URL,
         process.env.BETTER_AUTH_URL,
         process.env.NEXT_PUBLIC_APP_URL,
</file context>

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.