|
| 1 | +--- |
| 2 | +'@objectstack/cli': minor |
| 3 | +'@objectstack/plugin-hono-server': minor |
| 4 | +--- |
| 5 | + |
| 6 | +feat(cli): `objectstack dev --cert <path> --key <path>` terminates TLS in the dev process, and the canonical origin follows the listener (#16804) |
| 7 | + |
| 8 | +An interactive MCP client refuses to start an OAuth sign-in against a non-TLS |
| 9 | +URL, so the self-serve identity path the product advertises — "interactive |
| 10 | +clients just open a browser login" — could not be exercised against a local dev |
| 11 | +server at all. The only way round it was a hand-built https reverse proxy plus |
| 12 | +`OS_AUTH_URL`, a page of setup that every developer, demo and video recording |
| 13 | +repeated off-camera. |
| 14 | + |
| 15 | +**Bring your own certificate.** Nothing here generates one, and nothing here — |
| 16 | +not the code, not `--help`, not any doc page — says anything about installing a |
| 17 | +certificate into a system trust store. 「⛔ 不生成自签 CA；⛔ 不打印、不文档化任何 |
| 18 | +「把 CA 装进系统信任库」的指引——信任库是开发者自己的事」. The trust store is the |
| 19 | +developer's own business; this feature's whole job is to *use* the certificate |
| 20 | +they already have. |
| 21 | + |
| 22 | +```bash |
| 23 | +objectstack dev --cert ./localhost.pem --key ./localhost-key.pem |
| 24 | +``` |
| 25 | + |
| 26 | +Both flags are required together — half a pair is refused by name — and an |
| 27 | +unreadable file is refused rather than degraded to a plain-http listener. |
| 28 | + |
| 29 | +**What follows the listener.** With both flags given, everything this boot |
| 30 | +advertises is `https://localhost:<port>`: the two `/.well-known/*` discovery |
| 31 | +documents, the CSRF allow-list, the ready banner's `API:` / `MCP:` rows, the |
| 32 | +`🤖 MCP server` connect hint, and the runtime state file the `os dev` parent and |
| 33 | +external supervisors dial. Only the built-in default at the end of the base-URL |
| 34 | +chain moves — `OS_AUTH_URL`, `BETTER_AUTH_URL` and `OS_BASE_URL` keep winning, |
| 35 | +an `http://` value included, because they name where a deployment is *reached* |
| 36 | +rather than what this process *bound*. |
| 37 | + |
| 38 | +**Without the flags nothing changes**, byte for byte — pinned by ablation legs |
| 39 | +rather than asserted. |
| 40 | + |
| 41 | +`@objectstack/plugin-hono-server` gains the option this is built on: |
| 42 | +`HonoPluginOptions.tls` (`{ cert, key }` PEM bytes) makes the adapter bind a TLS |
| 43 | +listener with the same fetch handler, the same route table and the same graceful |
| 44 | +drain. Absent, the listener is plain http exactly as before. |
0 commit comments