fix: honor SEARXNG_API_URL for external SearXNG setups

[stablegenius49]

Closes #954.

Summary

• prefer SEARXNG_API_URL when it is set, even if data/config.json already contains an older SearXNG URL
• keep the existing persisted config value when the env var is unset

Why

Containerized installs that switch from the bundled localhost SearXNG to an external instance can get stuck on the stale persisted URL, so restarts keep targeting 127.0.0.1:<port> instead of the address provided via env.

Verification

• reproduced the stale-config case with a temp data/config.json that contained http://127.0.0.1:8080; after the change, setting SEARXNG_API_URL=http://searxng.example:8080 correctly overrides it on startup
• confirmed the existing config is preserved when SEARXNG_API_URL is unset
• npx eslint src/lib/config/index.ts
• npx tsc --noEmit

---

Summary by cubic

Honor SEARXNG_API_URL on startup so external SearXNG instances override stale persisted URLs and containers stop targeting localhost after a switch. Ignore blank or invalid env values to avoid clobbering the config.

• Bug Fixes
  • Use a non-empty, valid (trimmed) SEARXNG_API_URL to override any persisted SearXNG URL.
  • If the env var is missing, blank, or invalid, keep the existing value or fall back to the default.

^{Written for commit 75c1cc8. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

[xkonjin]

Code Review - PR #1057

Summary

This PR fixes an issue where SEARXNG_API_URL environment variable wasn't being honored in the search configuration. The change refactors the config loading logic to prioritize environment variables over existing config values.

✅ Strengths

• Simple, focused fix for the reported issue
• Good separation of concerns with early returns
• Maintains backward compatibility (falls back to config/default if env not set)

⚠️ Issues Found

1. Behavior change may break existing deployments

Location: src/lib/config/index.ts:231-236

if (envValue) {
  this.currentConfig.search[f.key] = envValue;
  return;
}

Issue: This changes the precedence order. Previously, existing config values were preserved unless undefined. Now, any environment variable (even an empty string) will override the config file. This could break deployments where env vars are intentionally set to empty strings to disable features.

Example scenario:

• Config file has searxng.url = "https://my-searxng.example.com"
• Env var SEARXNG_API_URL="" (empty string to disable)
• Old behavior: Uses config value (enabled)
• New behavior: Uses empty string (disabled) - unexpected change

Suggestion: Only override if the env var is a non-empty truthy value:

if (envValue && envValue.trim() !== '') {
  this.currentConfig.search[f.key] = envValue;
  return;
}

2. Missing validation

There's no validation that the environment variable value is a valid URL before assigning it. Invalid URLs could cause runtime errors downstream.

3. Type safety

The code doesn't validate that envValue matches the expected type for f.key. If the config expects a boolean and env provides a string, this could cause type mismatches.

Test Coverage

No test changes included. Should add:

• Test case: env var overrides config value
• Test case: empty string env var doesn't override config
• Test case: missing env var falls back to config/default
• Test case: invalid URL env var is handled

Security Considerations

None directly, but URL validation would prevent potential SSRF if the URL is used to make external requests.

Recommendation

Request changes
The behavior change (issue #1) is a breaking change that could silently break existing deployments. Please either:

1. Only override when env var is a non-empty string, OR
2. Document this behavior change prominently in the PR description/release notes

Also consider adding URL validation for the SEARXNG_API_URL specifically.

[stablegenius49]

Pushed a small follow-up to tighten the env override path:

• only apply SEARXNG_API_URL when it is non-empty after trimming
• ignore invalid URL values instead of persisting a broken search URL
• otherwise keep the existing config value / default fallback behavior

Validation:

• npx eslint src/lib/config/index.ts
• npx tsc --noEmit

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/lib/config/index.ts">

<violation number="1" location="src/lib/config/index.ts:239">
P2: Invalid `SEARXNG_API_URL` is silently ignored, leaving stale persisted `search.searxngURL` active and re-saved.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Invalid SEARXNG_API_URL is silently ignored, leaving stale persisted search.searxngURL active and re-saved.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/config/index.ts, line 239:

<comment>Invalid `SEARXNG_API_URL` is silently ignored, leaving stale persisted `search.searxngURL` active and re-saved.</comment>

<file context>
@@ -230,8 +230,16 @@ class ConfigManager {
+          try {
+            new URL(envValue);
+          } catch {
+            return;
+          }
+        }
</file context>

Suggested change

	return;
	this.currentConfig.search[f.key] = f.default ?? '';
	return;