fix(web): derive MCP URLs for any Supabase URL, not only *.supabase.co

[mthines]

What

resolveMcpUrls() (packages/web/src/lib/mcp-url.ts) now derives the MCP URL as <base>/functions/v1/mcp from any Supabase base URL — https://<ref>.supabase.co, a self-hosted custom domain (https://db.example.com), or local http://127.0.0.1:54321 — instead of string-stripping https:// and .supabase.co.

Why

A self-hoster on a custom domain got a broken snippet in the dashboard (e.g. https://db.example.com.supabase.co/functions/v1/mcp), and local http:// URLs produced https://http://…. The same URL feeds the GitHub installation-sync call in github-installations.ts, so that broke too.

How

Read the base through supabaseUrl() (lib/supabase/config.ts), the dashboard's one Supabase resolver. So serve-local (NEXT_PUBLIC_USE_LOCAL_SUPABASE) now gives the local MCP URL instead of production, and installations/sync no longer sends a local session token to the production endpoint. Parse with new URL, keep origin + pathname (trailing slashes trimmed, so a reverse-proxy base path survives). Anything not an absolute http(s) URL — empty, whitespace, a bare word, ftp:// — falls back to the hosted endpoint, exactly as empty/unset did before. Output for *.supabase.co and the fallback is byte-identical; the return type is unchanged, so the three callers (API keys settings, onboarding, GitHub installations) need no change.

Behaviour note: a bare non-URL value like myref used to be treated as a project ref; it now falls back to the hosted URL (supabase-js can't use such a value anyway).

Tests

• mcp-url.spec.ts: 13 cases — supabase.co, the serve-local flag, trailing slash, custom domain (+ webhook), local http with port, base path, unset/empty/whitespace/bare word/non-http fallback
• pnpm nx test web and pnpm nx typecheck web pass

Docs

No user-facing doc change: the dashboard now shows the correct URL; no docs claimed otherwise (self-host.mdx and docs/install.md Step 8 make no claim about the dashboard snippet on custom domains).

[github-actions]

The dashboard preview for this PR — redeployed on each push that changes the web app.

Project	Deployment	Actions	Updated
lorekit	Ready	Preview	Oct 17, 2026 11:43am UTC

_{Preview always points at this PR's latest commit; Deployment is the immutable build of 4a07877. · Comment /web-preview to force a redeploy. · Workflow logs}

[mthines]

⚠️ No findings — 1 gate needs attention

The delta routes resolveMcpUrls through supabaseUrl(), so NEXT_PUBLIC_USE_LOCAL_SUPABASE now reaches the MCP and webhook URLs, with a test pinning it. No new findings; the prior thread is resolved.

Warnings: Description omits the switch to supabaseUrl(), which now honours NEXT_PUBLIC_USE_LOCAL_SUPABASE

Checked: 2 of 2 changed files read · 1 possible issue → 0 confirmed → 0 posted

What this change reaches — 1 changed file imported by 4 files

flowchart LR
  subgraph pr["Changed in this PR"]
    m1["packages/web/src/lib/mcp-url.ts<br/>file changed"]:::changed
  end
  m1i1["packages/web/src/lib/ · 3 files<br/>import this file"]:::imports
  m1i2["packages/web/src/app/(dashboard)/settings/api-keys/page.tsx<br/>imports this file"]:::imports
  m1 -.-> m1i1
  m1 -.-> m1i2
  classDef changed fill:#eef2ff,stroke:#6366f1,color:#1e1b4b
  classDef ok fill:#e7f6ec,stroke:#16a34a,color:#14532d
  classDef partial fill:#fef9c3,stroke:#ca8a04,color:#713f12
  classDef unknown fill:#f3f4f6,stroke:#9ca3af,stroke-dasharray:4 3,color:#374151
  classDef bad fill:#fde8e8,stroke:#dc2626,color:#7f1d1d
  classDef warn fill:#fff4e5,stroke:#d97706,color:#78350f
  classDef imports fill:#f8fafc,stroke:#64748b,stroke-dasharray:4 3,color:#1e293b

Loading

• packages/web/src/lib/mcp-url.ts — changed file · imported by 4 files, not traced

Review details

Needs attention

Gate	Status	Details
Description vs. code	⚠️	Description omits the switch to supabaseUrl(), which now honours NEXT_PUBLIC_USE_LOCAL_SUPABASE
Prior review feedback	✅	Earlier review comments are resolved.
Documentation	✅	JSDoc on resolveMcpUrls names the local-flag behaviour; spec covers it
Self-review signals	✅	No debug logs, leftover TODOs, or unreviewed stubs.
Code review	✅	The multi-lens review found no blocking issues.

Found

Quality — produced 1 → posted inline 0 · cleared 0 · carried forward 0 · deferred 0 · below-bar 0
Standards — ran — 2 delta files checked against root CLAUDE.md; 0 findings
Measurability — ran — quiet: delta adds no new observable behaviour or failure mode

Run

incremental · 17 lines in delta · tier standard · depth checkout
Integrations — not activated — no manifest or lockfile in the diff
CI — still pending: Detect changes · 1 passed
Memories — no relevance rules or lessons consulted

^{Nothing to report — optimality (skipped), severity, 0 files skipped.}

^{pr-reviewer · commit 4a07877 · incremental review, delta since aaa1f03 · how these findings are produced · updated Oct 17, 2026 11:42am UTC}