fix(managed): point default API base at app.syntheticsciences.ai

The managed/Atlas base defaulted to api.syntheticsciences.ai, which never
existed as a host — so managed mode failed with 'fetch failed' / DNS errors for
everyone. The real backend is app.syntheticsciences.ai (Vercel-fronted, /api/*
proxied to Fly). Repoint the default plus the hardcoded github/share/OIDC refs
(api.dev → app.dev for the preview path).

Author: ishaan1124

backend/cli/src/cli/cmd/github.ts

@@ -355,7 +355,7 @@ export const GithubInstallCommand = cmd({
 
             async function getInstallation() {
               return await fetch(
-                `https://api.syntheticsciences.ai/get_github_app_installation?owner=${app.owner}&repo=${app.repo}`,
+                `https://app.syntheticsciences.ai/get_github_app_installation?owner=${app.owner}&repo=${app.repo}`,
               )
                 .then((res) => res.json())
                 .then((data) => data.installation)
@@ -664,7 +664,7 @@ export const GithubRunCommand = cmd({
 
       function normalizeOidcBaseUrl(): string {
         const value = process.env["OIDC_BASE_URL"]
-        if (!value) return "https://api.syntheticsciences.ai"
+        if (!value) return "https://app.syntheticsciences.ai"
         return value.replace(/\/+$/, "")
       }
 

backend/cli/src/endpoints.ts

@@ -17,7 +17,7 @@
  */
 
 /** Neutral public default. Contains no internal codename. */
-export const DEFAULT_MANAGED_API_BASE = "https://api.syntheticsciences.ai"
+export const DEFAULT_MANAGED_API_BASE = "https://app.syntheticsciences.ai"
 
 function stripTrailingSlashes(url: string): string {
   return url.replace(/\/+$/, "")

backend/cli/src/provider/provider.ts

@@ -109,7 +109,7 @@ export namespace Provider {
    * Blocker (c) — the inverse of requireAtlasProxyForManagedKey.
    *
    * A prior managed sync may have injected an Atlas proxy `*_BASE_URL` (e.g.
-   * ANTHROPIC_BASE_URL → api.syntheticsciences.ai). If the resolved key is the
+   * ANTHROPIC_BASE_URL → app.syntheticsciences.ai). If the resolved key is the
    * user's OWN key (BYOK), that key must NEVER be sent to the Atlas proxy — it
    * would leak the credential and mis-bill. Pin the base URL back to the
    * provider's public endpoint and drop the managed routing.

backend/cli/src/share/share.ts

@@ -68,7 +68,7 @@ export namespace Share {
 
   export const URL =
     process.env["OPENSCIENCE_API"] ??
-    (Installation.isPreview() || Installation.isLocal() ? "https://api.dev.syntheticsciences.ai" : "https://api.syntheticsciences.ai")
+    (Installation.isPreview() || Installation.isLocal() ? "https://app.dev.syntheticsciences.ai" : "https://app.syntheticsciences.ai")
 
   const disabled = true