The Side Panel runs in a chrome-extension:// origin and fetches /health,
/command, /refs, /activity/stream, and the terminal-agent's /claude-available
with credentials:'include'. None of those responses set
Access-Control-Allow-Origin or Access-Control-Allow-Credentials, so every
fetch fails CORS and the panel never reaches the connected state — the
bootstrap card stays stuck on "Browse server not ready" and the install-card
shows "Claude Code not found" even when claude is on PATH.
Repro: launch `browse connect`, open the Side Panel from a fresh extension
load, watch DevTools console fire "Access to fetch at 'http://127.0.0.1:34567/health'
from origin 'chrome-extension://...' has been blocked by CORS policy".
Fix:
* server.ts — add a `withCors` middleware (preflight OPTIONS 204 +
response-header reflection) and wrap both makeFetchHandler call sites.
Reflects the Origin header back ONLY when it starts with
chrome-extension://, so arbitrary websites still get no CORS headers.
Sets Access-Control-Allow-Credentials: true to satisfy
credentials:'include' on the panel's fetches and EventSource(...,
{withCredentials:true}).
* terminal-agent.ts — add the same Origin + Credentials headers to the
/claude-available response. WS upgrade keeps Sec-WebSocket-Protocol
auth and doesn't need CORS; /internal/* stays loopback + bearer-auth.
* server-auth.test.ts, terminal-agent.test.ts — source-pattern tests
matching the existing /refs and /activity/history CORS-test style.
Verify the middleware exists, gates on chrome-extension://, sets both
headers, and is never wildcarded.
Verification curl (post-patch):
$ curl -H "Origin: chrome-extension://abc" -D - http://127.0.0.1:34567/health
HTTP/1.1 200 OK
Access-Control-Allow-Origin: chrome-extension://abc
Access-Control-Allow-Credentials: true
$ curl -H "Origin: https://evil.com" -D - http://127.0.0.1:34567/health
HTTP/1.1 200 OK
(no Access-Control-* headers — non-extension origins still blocked)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
e268718351