feat(amplify): branch previews sign in on dev as remoteit_portal, deployed only from repo branches

[JamieRuderman]

Problem

Amplify builds a preview at https://pr-<N>.d20k671nqqv4kl.amplifyapp.com for every PR into main/release, and none of them can sign in:

1. Wrong client and server. A preview gets only the app-level environment, which is the legacy production config, so it signs in as remoteit_desktop on login.remote.it.
2. Callback not registered. /authorize answers 400 invalid_request "redirect_uri not registered".

Amplify's PR previews also build PRs from forks. #1179 (from eastagiletracker/desktop) was deployed to pr-1179.d20k671nqqv4kl.amplifyapp.com. So while PR previews are on, no callback covering the preview domain is safe to register.

Approach

The first version registered each open same-repo PR's exact callbacks from a GitHub workflow that held a dev clients.write key (remoteit/authentication#58). After review, this replaces it:

• Amplify pull request previews go off. Amplify instead autodetects feat/** and fix/** branches pushed to this repo, deploys each to its own *.d20k671nqqv4kl.amplifyapp.com address, and drops it when the branch is deleted. Only someone who can push to this repo gets a deploy. Forks can't.
• With that in place, dev's remoteit_portal can carry a wildcard: https://*.d20k671nqqv4kl.amplifyapp.com/authCallback and /signoutCallback. There's no key in GitHub and no per-PR registration.

Changes

• amplify.yml is the console build spec, now in the repo, with one addition. When AMPLIFY_PREVIEW=true, it sources scripts/amplify-preview-env.sh. Only autodetected branches have that variable, from the app's auto-branch config. The script:

  • unsets the app-level stage pins (VITE_GRAPHQL_API, VITE_WEBSOCKET_URL, the VITE_OAUTH_* resources);
  • sets VITE_OAUTH_ISSUER=https://login.dev.remote.it and VITE_OAUTH_CLIENT_ID=remoteit_portal;
  • sets VITE_AGENT_URL, because a pinned build otherwise calls /agent, which only the vite dev server proxies.

  STAGES.dev in constants.ts supplies the rest. Every other branch builds exactly as it does today.

• Removed the Preview callbacks workflow and its script.

• readme: how previews build and sign in, and why PR previews must stay off. RELEASE.md: the build spec now lives in the repo.

Verified

• Merged current main.
• Ran the build line with a stub npm and the legacy app-level variables set:
  • AMPLIFY_PREVIEW=true gives remoteit_portal and login.dev.remote.it, with the GraphQL pin removed.
  • Without it, the legacy values pass through unchanged. That includes a PR build with AWS_PULL_REQUEST_ID set.
• Only the comment in scripts/amplify-preview-env.sh changed. The earlier check of what it resolves to through Vite still applies: STAGE=dev, the cloud.dev GraphQL and websocket URLs, the dev agent and MCP.
• Prettier is clean on the changed lines. The readme has older issues elsewhere, the same as on main.

Not verified: a deployed preview signing in end to end. That needs the rollout.

Rollout

1. Amplify (app d20k671nqqv4kl, us-west-1). Turn PR previews off on every branch that has them (aws amplify list-branches shows which), then turn on branch autodetection:

   aws amplify update-branch --app-id d20k671nqqv4kl --region us-west-1 --branch-name main --no-enable-pull-request-preview
   aws amplify update-branch --app-id d20k671nqqv4kl --region us-west-1 --branch-name release --no-enable-pull-request-preview
   aws amplify update-app --app-id d20k671nqqv4kl --region us-west-1 \
     --enable-auto-branch-creation \
     --auto-branch-creation-patterns 'feat/**' 'fix/**' \
     --enable-branch-auto-deletion \
     --auto-branch-creation-config '{"stage":"DEVELOPMENT","enableAutoBuild":true,"enablePullRequestPreview":false,"environmentVariables":{"AMPLIFY_PREVIEW":"true"}}'

   Then delete any leftover pr-N branches in the app.
2. Optional, as a second layer: GitHub → Settings → General → Features → Pull requests → Collaborators only.
3. Merge this PR.
4. Register the two wildcard callbacks on dev remoteit_portal. This needs Permitteer to accept a wildcard. Close remoteit/authentication#58.
5. Test: push a feat/ branch created from the new main, check that it deploys and signs in on dev.

Step 1 must come before step 4. Merging before step 1 is harmless.

Notes:

• A branch picks up amplify.yml only once it contains it. After that, Amplify ignores console build-setting edits for that branch.
• The auto-branch variable applies only to branches autodetected after the config is set.

---

Generated by Claude Code

[JamieRuderman]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T22:07:29.945875Z	2a98704	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: da85906c1e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[aws-amplify-us-west-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-1283.d20k671nqqv4kl.amplifyapp.com

[JamieRuderman]

@codex review

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 2a987042aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".