Sign-in by address fails on Playground and Studio with a misleading 'private network' message #335

Found in the #223 real-app pass, 2026-10-05.

What happened

On a WordPress Playground site with sign-in for apps on, claude mcp login (Claude Code 2.1.289) sends the owner to the authorize page with client_id=https://claude.ai/oauth/claude-code-client-metadata. Saddle stops with:

Could not read that app's identity document: That address resolves to a private or unreachable network.

Why

Saddle_HTTP::url_is_safe() resolves the host before fetching and fails closed when it gets no public address. PHP on WordPress Playground (WebAssembly) has no real DNS, so claude.ai never resolves to a public address there. Native PHP on the same machine resolves it (160.79.104.10). WordPress Studio runs on Playground too, so sign-in by address from Claude Code fails on Studio sites, and anywhere a host disables dns_get_record() and gethostbyname().

Keys work on these sites, and that is the path the connect wizard gives a local site, so nothing is blocked. With a test-only saddle_url_is_safe shim for claude.ai, the same flow reached the consent screen and Claude Code signed in.

What would help

• Say what happened: "Saddle could not look up claude.ai from this server", not "resolves to a private network". url_is_safe() already knows whether it got no addresses or a private one.
• On Playground and Studio, the connect drawer could say sign-in by address needs a host that can look up the app's address, and point to the key.

Failing closed stays. This is about the message, not the guard.

Refs #223