fix: restore --proxy for base_url (#9503)

## 📝 Summary

closes #9495 by restoring `-proxy` behavior to set `--base_path` if the
full path is provided.

Author: dmadisetti

marimo/_cli/cli.py

@@ -583,6 +583,8 @@ def edit(
         # Check for version updates after preflight checks pass.
         check_for_updates(print_latest_version)
 
+    base_url = validators.check_proxy_base_url(proxy, base_url)
+
     start(
         workspace=infer_workspace(name),
         development_mode=GLOBAL_SETTINGS.DEVELOPMENT_MODE,
@@ -790,6 +792,8 @@ def _cleanup() -> None:
     if workspace is None:
         workspace = EmptyWorkspace()
 
+    base_url = validators.check_proxy_base_url(proxy, base_url)
+
     start(
         workspace=workspace,
         development_mode=GLOBAL_SETTINGS.DEVELOPMENT_MODE,
@@ -1212,6 +1216,8 @@ def run(
 
     workspace = _create_run_workspace(validated_paths, watch=watch)
 
+    base_url = validators.check_proxy_base_url(proxy, base_url)
+
     start(
         workspace=workspace,
         development_mode=GLOBAL_SETTINGS.DEVELOPMENT_MODE,
@@ -1341,6 +1347,8 @@ def tutorial(
     temp_dir = tempfile.TemporaryDirectory()
     path = create_temp_tutorial_file(name, temp_dir)
 
+    base_url = validators.check_proxy_base_url(proxy, "")
+
     start(
         workspace=SingleFileWorkspace.from_path(path),
         development_mode=GLOBAL_SETTINGS.DEVELOPMENT_MODE,
@@ -1360,6 +1368,7 @@ def tutorial(
             token_password=token_password,
             token_password_file=token_password_file,
         ),
+        base_url=base_url,
         redirect_console_to_browser=False,
         ttl_seconds=None,
         startup_tip=choose_startup_tip(click.get_current_context()),

marimo/_cli/cli_validators.py

@@ -3,10 +3,36 @@
 
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlparse
 
 import click
 
 
+def check_proxy_base_url(proxy: str | None, base_url_value: str) -> str:
+    """Reconcile --proxy path with --base-url. Returns the effective
+    base_url: explicit --base-url if given, else the path component from
+    --proxy, else empty. Raises click.BadParameter when both are given
+    and disagree (after trailing-slash normalization).
+    """
+    if not proxy:
+        return base_url_value
+    parse_target = proxy if "://" in proxy else f"//{proxy}"
+    try:
+        proxy_path = urlparse(parse_target).path
+    except ValueError:
+        return base_url_value
+    proxy_path = proxy_path.rstrip("/")
+    if not proxy_path:
+        return base_url_value
+    if base_url_value and proxy_path != base_url_value.rstrip("/"):
+        raise click.BadParameter(
+            f"--proxy path {proxy_path!r} conflicts with --base-url "
+            f"{base_url_value!r}; use one or make them match.",
+            param_hint="--proxy",
+        )
+    return base_url_value or proxy_path
+
+
 def base_url(ctx: Any, param: Any, value: str | None) -> str:
     del ctx
     del param

tests/_server/test_startup_url.py

@@ -1,10 +1,14 @@
 # Copyright 2026 Marimo. All rights reserved.
 from __future__ import annotations
 
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
+from urllib.parse import urlparse
 
 import pytest
+from click.testing import CliRunner
 
+from marimo._cli.cli import main as cli_main
+from marimo._cli.cli_validators import check_proxy_base_url
 from marimo._server.api.lifespans import _startup_url
 from marimo._server.start import _resolve_proxy
 from marimo._server.tokens import AuthToken
@@ -85,10 +89,143 @@ def test_resolve_proxy(
     assert host == expected_host
 
 
+def test_cli_errors_when_proxy_path_conflicts_with_base_url() -> None:
+    """Passing both `--proxy host/foo` and `--base-url /bar` is ambiguous."""
+    runner = CliRunner()
+    # Patch the symbol the edit command imported, so the test never
+    # actually launches a server even if validation fails to fire.
+    with patch("marimo._cli.cli.start") as mock_start:
+        result = runner.invoke(
+            cli_main,
+            [
+                "edit",
+                "--proxy",
+                "example.com/foo",
+                "--base-url",
+                "/bar",
+                "--no-token",
+                "--headless",
+                "--skip-update-check",
+            ],
+        )
+
+    assert result.exit_code != 0, result.output
+    assert mock_start.call_count == 0, (
+        "start() should not be invoked when --proxy and --base-url "
+        f"conflict; output was: {result.output!r}"
+    )
+
+
+def test_cli_accepts_proxy_path_matching_base_url() -> None:
+    runner = CliRunner()
+    with patch("marimo._cli.cli.start") as mock_start:
+        result = runner.invoke(
+            cli_main,
+            [
+                "edit",
+                "--proxy",
+                "example.com/foo",
+                "--base-url",
+                "/foo",
+                "--no-token",
+                "--headless",
+                "--skip-update-check",
+            ],
+        )
+
+    assert result.exit_code == 0, result.output
+    assert mock_start.call_count == 1, (
+        "start() should be invoked when --proxy path matches --base-url; "
+        f"output was: {result.output!r}"
+    )
+
+
+def test_cli_tutorial_routes_proxy_path_to_base_url() -> None:
+    """`tutorial` has no --base-url flag; the proxy path must still be
+    captured (regression caught by codex review).
+    """
+    runner = CliRunner()
+    with patch("marimo._cli.cli.start") as mock_start:
+        result = runner.invoke(
+            cli_main,
+            [
+                "tutorial",
+                "--proxy",
+                "example.com/foo",
+                "--no-token",
+                "--headless",
+                "intro",
+            ],
+        )
+
+    assert result.exit_code == 0, result.output
+    assert mock_start.call_count == 1
+    # Proxy path should have flowed into base_url
+    assert mock_start.call_args.kwargs["base_url"] == "/foo"
+
+
+def test_cli_accepts_proxy_without_path_and_explicit_base_url() -> None:
+    runner = CliRunner()
+    with patch("marimo._cli.cli.start") as mock_start:
+        result = runner.invoke(
+            cli_main,
+            [
+                "edit",
+                "--proxy",
+                "example.com:8080",
+                "--base-url",
+                "/foo",
+                "--no-token",
+                "--headless",
+                "--skip-update-check",
+            ],
+        )
+
+    assert result.exit_code == 0, result.output
+    assert mock_start.call_count == 1, (
+        "start() should be invoked when --proxy has no path; "
+        f"output was: {result.output!r}"
+    )
+
+
+def test_check_proxy_base_url_normalizes_trailing_slash() -> None:
+    """The validator strips the trailing / from the proxy path so the
+    resulting base_url matches the --base-url validator's own contract
+    (no trailing /).
+    """
+    assert check_proxy_base_url("example.com/proxy/2718/", "") == "/proxy/2718"
+
+
+def test_startup_url_proxy_path_equivalent_to_explicit_base_url() -> None:
+    """`--proxy host/foo` ≡ `--proxy host --base-url=/foo` in printed URL —
+    after the CLI validator merges the proxy path into base_url.
+    """
+    # Branch A: path embedded in --proxy, no separate --base-url
+    port_a, host_a = _resolve_proxy(
+        2718, "127.0.0.1", "example.com/proxy/2718"
+    )
+    effective_a = check_proxy_base_url("example.com/proxy/2718", "")
+    state_a = _make_state(host=host_a, port=port_a, base_url=effective_a)
+
+    # Branch B: same intent expressed as --proxy host + --base-url /path
+    port_b, host_b = _resolve_proxy(2718, "127.0.0.1", "example.com")
+    state_b = _make_state(host=host_b, port=port_b, base_url="/proxy/2718")
+
+    assert _startup_url(state_a) == _startup_url(state_b)
+
+
+def test_startup_url_proxy_with_non_default_port_preserves_path() -> None:
+    """Path lives in state.base_url (not state.host), so port + bracketing
+    compose cleanly.
+    """
+    port, host = _resolve_proxy(2718, "127.0.0.1", "example.com:8080/foo")
+    effective = check_proxy_base_url("example.com:8080/foo", "")
+    state = _make_state(host=host, port=port, base_url=effective)
+    assert _startup_url(state) == "http://example.com:8080/foo"
+
+
 def test_startup_url_getnameinfo_failure() -> None:
     """If getnameinfo raises (e.g. host not resolvable), URL is still valid."""
-    from unittest.mock import patch
-
     state = _make_state("fd00::dead")
     with patch("socket.getnameinfo", side_effect=OSError("unreachable")):
         url = _startup_url(state)
@@ -102,8 +239,6 @@ def test_startup_url_ipv6_with_token() -> None:
     url = _startup_url(state)
     assert url == "http://[fd00::cafe]:2718/?access_token=tok3n"
     # Verify it's parseable and components are correct
-    from urllib.parse import urlparse
-
     parsed = urlparse(url)
     assert parsed.hostname == "fd00::cafe"
     assert parsed.port == 2718