mirror of https://github.com/garrytan/gstack.git
e268718351
The Side Panel runs in a chrome-extension:// origin and fetches /health, /command, /refs, /activity/stream, and the terminal-agent's /claude-available with credentials:'include'. None of those responses set Access-Control-Allow-Origin or Access-Control-Allow-Credentials, so every fetch fails CORS and the panel never reaches the connected state — the bootstrap card stays stuck on "Browse server not ready" and the install-card shows "Claude Code not found" even when claude is on PATH. Repro: launch `browse connect`, open the Side Panel from a fresh extension load, watch DevTools console fire "Access to fetch at 'http://127.0.0.1:34567/health' from origin 'chrome-extension://...' has been blocked by CORS policy". Fix: * server.ts — add a `withCors` middleware (preflight OPTIONS 204 + response-header reflection) and wrap both makeFetchHandler call sites. Reflects the Origin header back ONLY when it starts with chrome-extension://, so arbitrary websites still get no CORS headers. Sets Access-Control-Allow-Credentials: true to satisfy credentials:'include' on the panel's fetches and EventSource(..., {withCredentials:true}). * terminal-agent.ts — add the same Origin + Credentials headers to the /claude-available response. WS upgrade keeps Sec-WebSocket-Protocol auth and doesn't need CORS; /internal/* stays loopback + bearer-auth. * server-auth.test.ts, terminal-agent.test.ts — source-pattern tests matching the existing /refs and /activity/history CORS-test style. Verify the middleware exists, gates on chrome-extension://, sets both headers, and is never wildcarded. Verification curl (post-patch): $ curl -H "Origin: chrome-extension://abc" -D - http://127.0.0.1:34567/health HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-extension://abc Access-Control-Allow-Credentials: true $ curl -H "Origin: https://evil.com" -D - http://127.0.0.1:34567/health HTTP/1.1 200 OK (no Access-Control-* headers — non-extension origins still blocked) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||