fix(core): derive widget domain from registrable host

packages/core/package.json

@@ -74,6 +74,7 @@
     "open": "^11.0.0",
     "posthog-node": "^5.45.2",
     "superjson": "^2.2.6",
+    "tldts": "^7.0.19",
     "yaml": "^2.9.0",
     "zustand": "^5.0.14"
   },

packages/core/src/server/requestOrigin.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest";
+
+import { resolveWidgetDomain } from "./requestOrigin.js";
+
+describe("resolveWidgetDomain", () => {
+  it("returns the registrable domain for an ordinary subdomain", () => {
+    expect(resolveWidgetDomain("https://capitals.skybridge.tech")).toBe(
+      "skybridge.tech",
+    );
+  });
+
+  it("keeps tenants isolated on private suffixes", () => {
+    expect(resolveWidgetDomain("https://alice.github.io")).toBe(
+      "alice.github.io",
+    );
+    expect(resolveWidgetDomain("https://bob.github.io")).toBe("bob.github.io");
+  });
+
+  it("keeps the origin fallback for non-registrable hosts", () => {
+    expect(resolveWidgetDomain("http://localhost:3000")).toBe(
+      "http://localhost:3000",
+    );
+  });
+});

packages/core/src/server/requestOrigin.ts

@@ -1,3 +1,5 @@
+import { getDomain } from "tldts";
+
 /**
  * Resolves this server's public origin from request headers, in precedence
  * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
@@ -24,3 +26,9 @@ export function resolveServerOrigin(
   }
   return `http://localhost:${process.env.__PORT || "3000"}`;
 }
+
+/** Resolve the registrable host used as the default widget security domain. */
+export function resolveWidgetDomain(serverOrigin: string): string {
+  const hostname = new URL(serverOrigin).hostname;
+  return getDomain(hostname, { allowPrivateDomains: true }) ?? serverOrigin;
+}

packages/core/src/server/server.ts

@@ -48,7 +48,7 @@ import type {
   McpWildcard,
 } from "./middleware.js";
 import { buildMiddlewareChain, getHandlerMaps } from "./middleware.js";
-import { resolveServerOrigin } from "./requestOrigin.js";
+import { resolveServerOrigin, resolveWidgetDomain } from "./requestOrigin.js";
 import {
   discoverSkills,
   registerSkills,
@@ -1127,7 +1127,7 @@ export class McpServer<
         {
           resourceDomains: [serverUrl],
           connectDomains,
-          domain: serverUrl,
+          domain: resolveWidgetDomain(serverUrl),
           baseUriDomains: [serverUrl],
         },
         contentMetaOverrides,

packages/core/src/test/view.test.ts

@@ -182,7 +182,7 @@ describe("McpServer.registerTool (unified API)", () => {
     }>;
     expect(appsSdkResourceCallback).toBeDefined();
 
-    const host = "myapp.com";
+    const host = "capitals.skybridge.tech";
     const serverUrl = `https://${host}`;
     const mockExtra = createMockExtra(host) as unknown as RequestHandlerExtra<
       ServerRequest,
@@ -207,7 +207,7 @@ describe("McpServer.registerTool (unified API)", () => {
                 connectDomains: [serverUrl],
                 baseUriDomains: [serverUrl],
               },
-              domain: serverUrl,
+              domain: "skybridge.tech",
               description: "Test view",
             },
             "openai/widgetDescription": "Test view",