Use the hosted local CIMD document only on loopback origins

.changeset/local-cimd-loopback-only.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Use the hosted loopback OAuth client metadata document only when Executor is opened on a loopback origin. A local Executor reached through a public reverse proxy now publishes its own client metadata document, so providers that support Client ID Metadata Documents no longer reject its callback as an invalid redirect URI.

packages/react/src/plugins/oauth-sign-in.test.ts

@@ -50,6 +50,26 @@ describe("oauthClientIdMetadataDocumentUrl", () => {
       }),
     ).toBe("https://executor.sh/api/oauth/client-id-metadata/local.json");
   });
+
+  it("uses the hosted local document on an IPv6 loopback origin", () => {
+    setLocation("http://[::1]:4788/integrations/posthog");
+
+    expect(
+      oauthClientIdMetadataDocumentUrl({
+        hostedBaseUrl: "https://executor.sh",
+      }),
+    ).toBe("https://executor.sh/api/oauth/client-id-metadata/local.json");
+  });
+
+  it("uses the current origin behind a public reverse proxy", () => {
+    setLocation("https://executor-mcp.example.com/integrations/posthog");
+
+    expect(
+      oauthClientIdMetadataDocumentUrl({
+        hostedBaseUrl: "https://executor.sh",
+      }),
+    ).toBe("https://executor-mcp.example.com/api/oauth/client-id-metadata/default.json");
+  });
 });
 
 describe("oauthCallbackUrl", () => {

packages/react/src/plugins/oauth-sign-in.tsx

@@ -147,12 +147,21 @@ const configuredClientIdMetadataBaseUrl = (): string | undefined => {
   return value ? value : undefined;
 };
 
+// The hosted local document only lists loopback callbacks, so a local
+// Executor reached through a public origin (a reverse proxy) must publish its
+// own document instead.
+const isLoopbackHostname = (hostname: string): boolean =>
+  hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+
 export function oauthClientIdMetadataDocumentUrl(options?: {
   readonly hostedBaseUrl?: string | null;
   readonly path?: string;
 }): string {
   const hostedBaseUrl = options?.hostedBaseUrl ?? configuredClientIdMetadataBaseUrl();
-  if (hostedBaseUrl) {
+  if (
+    hostedBaseUrl &&
+    (typeof window === "undefined" || isLoopbackHostname(window.location.hostname))
+  ) {
     return new URL(OAUTH_CLIENT_ID_METADATA_DOCUMENT_LOCAL_PATH, hostedBaseUrl).toString();
   }