decisioning: SubdomainTenantMiddleware allowlist should auto-synthesize :* host variants

[bokelley]

From the salesagent v3.12 → 4.x migration (SDK_FEEDBACK.md, item #13).

SubdomainTenantMiddleware and the FastMCP allowed_hosts allowlist treat host registration asymmetrically:

• Registering acme.localhost once in InMemorySubdomainTenantRouter covers both acme.localhost and acme.localhost:3001 at lookup time (per _normalize_host).
• The FastMCP allowed_hosts allowlist needs both acme.localhost and acme.localhost:* registered explicitly to cover the same surface.

Adopter worked around it in core/main.py's _allowed_hosts() helper by synthesizing the :* variant.

Ask

Make SubdomainTenantMiddleware (or serve()) accept a single host list and synthesize the :* variants for the allowlist automatically. The existing port-stripping at lookup time is great; the allowlist surface should be symmetric.

Acceptance

A single hosts=["acme.localhost", "beta.localhost"] configuration reaches both lookup and allowlist paths without adopter-side string juggling.

[bokelley]

Triage

Classification: Feature request (DX improvement)
Bucket(s): middleware
Status: drafting-pr
Milestone: (omitted — no target version specified)

What the experts said:

• code-reviewer: approved — no blockers; flagged issubclass vs identity check, warning for custom routers missing hosts(), and A2A comment gap; all addressed in fixup
• security-reviewer: approved — :* synthesis does not expand attack surface (FastMCP uses anchored prefix match; evil.acme.localhost:3001 ≠ acme.localhost:*); startup-time snapshot documented; SQL-backed router failure mode addressed via UserWarning

My take: Straightforward non-breaking additive fix — InMemorySubdomainTenantRouter.hosts() gives serve() the host list it needs to auto-synthesize both bare and :* allowlist entries. Removes the _allowed_hosts() boilerplate that multi_platform_seller was carrying as SDK_FEEDBACK.md item #13.

Drafting PR: Add InMemorySubdomainTenantRouter.hosts() + _synthesize_allowed_hosts() in serve.py; startup warning when custom router lacks hosts(); example simplified.

Draft PR: #527

---

Triaged by Claude Code. Session: https://claude.ai/code/session_0198Bk2S7eJCQtvUALXrQXHj

---

Generated by Claude Code