@agent-native/dispatch 0.31.14 → 0.31.16

package/dist/server/lib/app-creation-store.js

@@ -305,6 +305,13 @@ function workspaceAppUrl(appPath) {
         return null;
     }
 }
+function isLocalWorkspaceGateway(url) {
+    const hostname = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "0.0.0.0" ||
+        hostname === "::1");
+}
 function workspaceAppLink(appPath, explicitUrl) {
     const urlValue = typeof explicitUrl === "string" ? explicitUrl.trim() : "";
     if (!urlValue)
@@ -1145,17 +1152,31 @@ async function readWorkspaceAppsFromGateway() {
         ...authHeaders,
     };
     try {
-        const localResponse = await fetch(gatewayUrl(WORKSPACE_APPS_GATEWAY_PATH), {
-            headers,
-            signal: controller.signal,
-        });
-        if (localResponse.ok) {
-            return parseWorkspaceAppsManifest(
-            // coercion-ok: malformed gateway JSON is an unavailable registry and
-            // must fall through to the local manifest sources.
-            await localResponse.json().catch(() => null));
+        if (isLocalWorkspaceGateway(baseUrl)) {
+            const localResponse = await fetch(gatewayUrl(WORKSPACE_APPS_GATEWAY_PATH), {
+                headers,
+                signal: controller.signal,
+            });
+            if (localResponse.ok) {
+                return parseWorkspaceAppsManifest(
+                // coercion-ok: malformed gateway JSON is an unavailable registry and
+                // must fall through to the local manifest sources.
+                await localResponse.json().catch(() => null));
+            }
         }
-        if (!authHeaders.Authorization)
+        const requestOrigin = requestContext?.requestOrigin;
+        const isSameOriginGateway = requestOrigin
+            ? (() => {
+                try {
+                    return new URL(requestOrigin).origin === baseUrl.origin;
+                }
+                catch {
+                    // coercion-ok: an invalid request origin cannot prove a self-fetch.
+                    return false;
+                }
+            })()
+            : false;
+        if (isSameOriginGateway || !authHeaders.Authorization)
             return null;
         const actionUrl = gatewayUrl(WORKSPACE_APPS_ACTION_PATH);
         actionUrl.searchParams.set("includeAgentCards", "false");