`os dev`'s MCP connect hint builds all three URLs from the listen origin, so under `OS_AUTH_URL=https://…` it prints a `claude mcp add … http://localhost:<port>/…` line the reader is meant to paste

[os-zhuang]

Split out of #16530 (Side observations, first bullet). That card is a domain:services p1 about plugin-auth passing an option @better-auth/oauth-provider 1.7.2 no longer reads; this is an unrelated packages/cli printing face, and making the p1 carry it would pull a whole CLI package verification run into an auth-plugin PR.

Reproducible defect

os dev prints two MCP blocks from two different origin resolvers, and only one of them knows about the canonical origin. Measured on origin/main 5e53d73d:

printer	origin it uses
packages/cli/src/utils/format.ts:816 — the ➜ MCP: row of the ready banner	resolved base (link()), which honours OS_AUTH_URL
packages/cli/src/commands/dev.ts:503-508 — the 🤖 MCP server — connect a coding agent block	the child's listen URL

dev.ts:504-505:

const base =
  typeof msg.url === 'string' && msg.url ? msg.url.replace(/\/+$/, '') : `http://localhost:${actual}`;

msg.url is the objectstack:listening message the serve child emits once its HTTP server is up — the bound socket, by construction. OS_AUTH_URL never enters this expression, and the whole block (Endpoint, Skill, Connect) is built from that one base.

Reported observation from #16530, on hotcrm 789a7324 with objectstack dev -p 4001 and OS_AUTH_URL=https://localhost:4443 behind a TLS reverse proxy: the ➜ MCP: line says https://localhost:4443/… and the block below it says http://localhost:4001/…, in the same boot output.

Why it matters

The Connect line is not documentation, it is a command the reader is meant to paste. Pasting it registers an MCP entry against an origin that (a) is not the origin the discovery documents advertise and (b) on a TLS-fronted deployment is not reachable from the agent at all. The two blocks disagreeing in the same output also makes the correct line look like the typo.

Scoped deliberately narrow: this is about which origin the hint is built from. The Endpoint/Skill/Connect text itself is right.

Where

• packages/cli/src/commands/dev.ts:503-508 — the block, and the base expression above it.
• packages/cli/src/utils/format.ts:816 and its link() base — the resolver that already gets this right; the reference implementation, not a second thing to change.
• packages/cli/src/commands/serve-auth-base-url-diagnostic.test.ts — the existing pins on the OS_AUTH_URL → BETTER_AUTH_URL → OS_BASE_URL precedence chain, including the set-but-empty case. Whatever this fix reuses must not re-derive that chain by hand.

Acceptance

1. With OS_AUTH_URL set, all three lines of the connect block print the canonical origin, and the ➜ MCP: row and the block agree — assert on both rows of one captured boot output, not on the block alone. Two printers that disagree cannot be pinned by reading one of them.
2. With OS_AUTH_URL unset, the block still prints the listen origin (including the auto-shifted-port case 3000 busy → 3001 the surrounding code exists to handle). This is the control: a fix that just hardcodes the canonical origin breaks the common local case.
3. The precedence chain is reused from the existing resolver, not reimplemented — in particular the set-but-empty OS_AUTH_URL behaviour already pinned in serve-auth-base-url-diagnostic.test.ts must not change.

Filed by the triage seat, unassigned. Related: #16530 (the p1 this came out of), #16399 (URL normalisation in getAuthIssuer / getMcpResourceUrl — a different layer, and the values in #16530 were well-formed).

[os-project-manager]

Claim: PM loop round 71
Session: session_015QE8qk46e5CHJxyQEUjbf8 — domain:cli execution PM seat (#6024), R71
Branch: claude/issue-16734-mcp-connect-hint-origin
Worktree: objectstack-issue-16734
Domain: domain:cli
File surface: packages/cli/src/commands/dev.ts (the base expression at :503-508 and the block it feeds) + a test in packages/cli/src/commands/**. ⚠️ packages/cli/src/utils/format.ts is the reference implementation, not a second thing to change — the card says so and it is right.
Container & model: M, mode:subagent, model: opus — cited from THIS round's node scripts/pm/dispatch-gates.mjs --tier packages/cli/src/commands/dev.ts packages/cli/src/utils/format.ts, derived from a worktree at origin/main dd2184ae25 with no STALE TREE banner: "no path-derived mandate — the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable". ⚠️ claude-fable-5-1 is measured exhausted by attempt twice this session (req_011CeqFjyy9jEa2RDJqpftnv, req_011CeqRGUZzRcHQvL6vZ5QEy, HTTP 429), so opus is also the ceiling the 额度耗尽豁免 permits — ⛔ 不再往下.
Clause-②: no
Thread-read: card body only — this card carries no comments.

Why Clause-②: no, judged from content

⛔ Not from paths (the tier line is a floor, never a clearance). The act changes which origin a printed hint is built from — a correctness fix that makes two printers in the same boot output agree. No accept set is relaxed, no published surface is widened, no member is added to a closed set; the card explicitly scopes the Endpoint/Skill/Connect text as already correct and out of scope.

⚠️ Rebuttable by your diff. If what you write widens an accept set — for instance if reusing the resolver means teaching it a new precedence entry, or the fix adds a new env var to a published chain — ⛔ stop and say so in your report; do not re-declare it yourself. ⛔ And do not narrow the fix to keep the no: the declaration follows the right fix, never the reverse. ⚠️ A yes means the PR is held, not reviewed, because the review tier is unbuyable this session — that is the correct outcome and still ⛔ not a reason to shade the declaration.

⭐ Carry Clause-②: no verbatim into the PR body as its own line. Two gates read two different documents — check-clause2-carriers --pair reads THIS comment, check-changeset-no-major reads the PR body — and nothing cross-checks them (measured this round, #16770). A split between them is silent and picks the weaker branch.

Serial constraints cleared

Measured at 2026-09-08T06:1xZ over 25 of 25 open PRs, per-PR file lists, 0 unmeasured, 0 empty file lists, 582 distinct files:

• packages/cli/src/commands/dev.ts — 0 holders
• packages/cli/src/utils/format.ts — 0 holders

⭐ Positive control fired (a bare zero is not a reading): packages/metadata-protocol/src/protocol.ts 2 holders (#16796, #16783); packages/objectql/src/plugin.integration.test.ts 2 (#16796, #16783); packages/plugins/plugin-auth/src/auth-manager.ts 2 (#16780, #16730).

Acceptance — the card's own three, ⛔ none optional

Reproduce them in the PR under ## 验收备注 with your evidence against each:

1. With OS_AUTH_URL set, all three lines of the connect block print the canonical origin, and the ➜ MCP: row agrees with the block. ⛔ Assert on both rows of one captured boot output — the card is explicit: "Two printers that disagree cannot be pinned by reading one of them." Asserting only on the block would leave the actual defect untested.
2. ⭐ With OS_AUTH_URL unset, the block still prints the listen origin — including the auto-shifted-port case (3000 busy → 3001) the surrounding code exists to handle. This is the negative control, and it is the direction a fix most easily breaks: hardcoding the canonical origin makes item 1 green while destroying the ordinary local case. ⛔ Do not skip it.
3. Reuse the precedence chain from the existing resolver, ⛔ do not reimplement it. In particular the set-but-empty OS_AUTH_URL behaviour already pinned in packages/cli/src/commands/serve-auth-base-url-diagnostic.test.ts must not change — run those pins and show them still green.

Notes for the taker

• ⚠️ Locate by symbol, never by line number. The card's :503-508 and :816 anchors were written against 5e53d73d; origin/main is now dd2184ae25. This lane has measured triage anchors rotting by 19 lines (runtime: two dispatcher domain gates read the tenancy posture through the collapsing resolveService probe, so a tenancy service that failed to build reads as "no wall" at /keys mint and at the activation-write refusal #15900) and 491 ([finding] four packages/cli sites cite driver-sql's lookup arm for "a platform id is 26 characters" — the platform mints 16, and stores a supplied id at any width #16114). Re-derive before you edit, and say what you found.
• The Connect line is a command the reader pastes, not documentation — which is why this is a bug and not a cosmetic mismatch.
• ⛔ Never edit content/docs/releases/; your PR's input to release notes is its changeset.

---

Generated by Claude Code