@ai-sdk/devtools 0.0.18 → 0.0.20

package/dist/viewer/server.js

@@ -2,7 +2,6 @@
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 import { streamSSE } from "hono/streaming";
 import path2 from "path";
 import fs2 from "fs";
@@ -120,8 +119,32 @@ var devEnv = process.env.AI_SDK_DEVTOOLS_DEV;
 var isDevMode = devEnv !== void 0 && devEnv !== "false" && devEnv !== "0";
 var projectRoot = path2.resolve(__dirname, "../..");
 var clientDir = path2.join(projectRoot, "dist/client");
+var viewerPort = 4983;
 var app = new Hono();
-app.use("/*", cors());
+var getAllowedHosts = () => /* @__PURE__ */ new Set([
+  `localhost:${viewerPort}`,
+  `127.0.0.1:${viewerPort}`,
+  `[::1]:${viewerPort}`
+]);
+var getAllowedOrigins = () => /* @__PURE__ */ new Set([
+  `http://localhost:${viewerPort}`,
+  `http://127.0.0.1:${viewerPort}`,
+  `http://[::1]:${viewerPort}`,
+  "http://localhost:5173",
+  "http://127.0.0.1:5173",
+  "http://[::1]:5173"
+]);
+app.use("/api/*", async (c, next) => {
+  const host = c.req.header("host");
+  if (!host || !getAllowedHosts().has(host)) {
+    return c.text("Forbidden", 403);
+  }
+  const origin = c.req.header("origin");
+  if (origin && !getAllowedOrigins().has(origin)) {
+    return c.text("Forbidden", 403);
+  }
+  await next();
+});
 app.get("/api/runs", async (c) => {
   const runs = await getRuns();
   const runsWithMeta = await Promise.all(
@@ -269,10 +292,12 @@ app.get("*", async (c) => {
   }
 });
 var startViewer = (port = 4983) => {
+  viewerPort = port;
   const server = serve(
     {
       fetch: app.fetch,
-      port
+      port,
+      hostname: "localhost"
     },
     () => {
       if (isDevMode) {
@@ -309,5 +334,6 @@ if (isDirectRun) {
   startViewer(port);
 }
 export {
+  app,
   startViewer
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/devtools",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -26,7 +26,7 @@
   ],
   "dependencies": {
     "@hono/node-server": "^1.13.7",
-    "hono": "^4.6.14",
+    "hono": "^4.12.25",
     "@ai-sdk/provider": "3.0.10"
   },
   "devDependencies": {
@@ -55,7 +55,7 @@
     "vaul": "^1.1.2",
     "vite": "^6.0.3",
     "zod": "3.25.76",
-    "ai": "6.0.182"
+    "ai": "6.0.207"
   },
   "homepage": "https://ai-sdk.dev/docs",
   "repository": {

package/src/viewer/server.ts

@@ -1,7 +1,6 @@
 import { serve } from '@hono/node-server';
 import { serveStatic } from '@hono/node-server/serve-static';
 import { Hono } from 'hono';
-import { cors } from 'hono/cors';
 import { streamSSE } from 'hono/streaming';
 import path from 'path';
 import fs from 'fs';
@@ -53,10 +52,40 @@ const projectRoot = path.resolve(__dirname, '../..');
 // Client directory: dist/client in both cases
 const clientDir = path.join(projectRoot, 'dist/client');
 
-const app = new Hono();
+let viewerPort = 4983;
 
-// Enable CORS for development
-app.use('/*', cors());
+export const app = new Hono();
+
+const getAllowedHosts = () =>
+  new Set([
+    `localhost:${viewerPort}`,
+    `127.0.0.1:${viewerPort}`,
+    `[::1]:${viewerPort}`,
+  ]);
+
+const getAllowedOrigins = () =>
+  new Set([
+    `http://localhost:${viewerPort}`,
+    `http://127.0.0.1:${viewerPort}`,
+    `http://[::1]:${viewerPort}`,
+    'http://localhost:5173',
+    'http://127.0.0.1:5173',
+    'http://[::1]:5173',
+  ]);
+
+app.use('/api/*', async (c, next) => {
+  const host = c.req.header('host');
+  if (!host || !getAllowedHosts().has(host)) {
+    return c.text('Forbidden', 403);
+  }
+
+  const origin = c.req.header('origin');
+  if (origin && !getAllowedOrigins().has(origin)) {
+    return c.text('Forbidden', 403);
+  }
+
+  await next();
+});
 
 // API Routes
 app.get('/api/runs', async c => {
@@ -244,10 +273,13 @@ app.get('*', async c => {
 });
 
 export const startViewer = (port = 4983) => {
+  viewerPort = port;
+
   const server = serve(
     {
       fetch: app.fetch,
       port,
+      hostname: 'localhost',
     },
     () => {
       if (isDevMode) {