Repository navigation
os serve has no way to register trustedAppSchemes, so the mobile hand-off refuses every app #29972
Description
Category: ① product defect with a named location and a reproduction.
Business reason: a deployment that wants Google sign-in in the mobile app has to register the app's scheme, and os serve, the documented way to run a server, has no setting for it. #29766 says the plugin "only mounts when trustedAppSchemes is configured", and nothing a deployment can set reaches that key, so the hand-off in 18.3.0 refuses every app.
Reader: domain:server, one PR on packages/cli/src/commands/serve.ts. objectstack-ai/mobile#148 waits on it.
Duplicate search: repo:objectstack-ai/objectstack trustedAppSchemes (5 hits, all closed, the spec and server halves; none wires the CLI) and OS_TRUSTED_APP_SCHEMES (0 hits).
reach: measured on @objectstack/cli@18.3.0, 2026-11-03.
Reproduction
grep -c trustedAppSchemes node_modules/@objectstack/cli/dist/commands/serve.jsAnswers 0. serve.ts:4351 builds new AuthPlugin({...}) and passes trustedOrigins but no trustedAppSchemes, and no environment variable reads into it. On that build, GET /api/v1/auth/one-time-token/handoff?redirect_uri=ai.objectos.mobile%3A%2F%2Fauth%2Fcallback&code_challenge=<43 chars> answers 400 ... is not a registered app scheme, whatever the operator sets. The same request answers 401 once the key is patched in by hand, which is what proves the key is the only thing missing. A stack can supply its own AuthPlugin, but it then gives up everything serve.ts wires.
Ask
Give os serve a way to set the list, in the shape OS_TRUSTED_ORIGINS already has: an OS_TRUSTED_APP_SCHEMES comma-separated variable passed as trustedAppSchemes, listed in content/docs/deployment/environment-variables.mdx. A bad entry keeps failing loudly at construction (assertTrustedAppSchemes).
Unset stays unset: the hand-off is opt-in per deployment, and this card does not change that.
Acceptance notes
- A contract test in the style of
serve-auth-*.contract.test.tsthat the value reachesnew AuthPlugin(. - Boot check: with the variable set the request above answers
401, and with it unset400.
Out of scope, and the cloud lane's: the hosted runtime builds its own AuthPlugin (cloud: packages/objectos-runtime/src/artifact-kernel-factory.ts:1097), so hosted environments need their own wiring. That is tracked from objectstack-ai/mobile#148, not here.
Blocks: objectstack-ai/mobile#148
Activity
objectstack-fleet commentedon Nov 3, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 ·
domain:server·pm:queue· 2026-11-03T19:55Z⛔ Not a claim.
os servehas no setting that reachestrustedAppSchemes, so the mobile hand-off plugin never mounts and refuses every app. The CLI wiring of an already-declared key, so p2, as the server half of plugin-auth: enable better-auth's one-time-token plugin so the mobile shell can hand a system-browser sign-in back to its WebView #29714's chain.Generated by Claude Code
objectstack-fleet commentedon Nov 3, 2026
domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5
Claim: PM loop round 4
Session:
session_01WGufzipyHVcQ1pbgpD5zqV(dev: os-dev card thread; seatsession_01WGufzibcN9oHa8kDbTTnL5)Account:
os-support-aiBranch:
claude/project-thread-p09liv(harness-pinned thread branch; platform exception toclaude/issue-<n>-<slug>)Worktree: the dev thread's own container checkout
Domain:
domain:serverSeat:
domain:server#6File surface:
packages/cli/src/commands/serve.ts(thenew AuthPlugin({...})wiring), any other CLI door that builds the plugin, aserve-auth-*contract test,content/docs/deployment/environment-variables.mdx, one changeset (stop on breach; explain in the report)Container & model:
S,mode:thread,model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
the platform's ownos serve(no setting reachestrustedAppSchemes, so the mobile hand-off refuses every app) | none: the spec and server halves shipped, the CLI was never wired | every self-hosted deployment that wants mobile sign-in; objectstack-ai/mobile#148Thread-read: 6614052196
Premise: holds (measured on
@objectstack/cli@18.3.0by the filer; triage 6614052196; the dev re-measures on main)Serial constraints cleared: none (no in-flight claim of this seat on
packages/cliserve wiring; the dev re-checks open PRs at PR time)Stamp: 2026-11-03T23:45Z
/mnt/project-files/server-orders/29972.md(project files). Human floor (triage, auth boundary): the maintainer reviews the PR, as on plugin-auth: enable better-auth's one-time-token plugin so the mobile shell can hand a system-browser sign-in back to its WebView #29714.objectstack-fleet commentedon Nov 4, 2026
domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5
Landed · 2026-11-04T10:51Z · PR #30004 merged through the queue as
d9895a17. ACCEPT 6620583065, and review PASS 6620576677. This is an auth boundary: the maintainer approved it in the project chat at 2026-11-04T10:11Z.pm:dispatchedis removed with the close.os servenow readsOS_TRUSTED_APP_SCHEMES, so a deployment can register its mobile app schemes for the sign-in hand-off. Unset leaves it off, and a malformed entry fails the boot.