@avocadostudio-ai/orchestrator-core 0.11.2 → 0.11.4

package/dist/handler/create-orchestrator.js

@@ -21,7 +21,7 @@ import { mkdir, writeFile, readFile } from "node:fs/promises";
 import { resolve, basename } from "node:path";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
-import { operationSchema, blockManifestSchema, siteConfigSchema, declareBlockCatalogue, undeclaredBlockTypes, EDITOR_PROTOCOL_VERSION } from "@avocadostudio-ai/shared";
+import { operationSchema, blockManifestSchema, siteConfigSchema, declareBlockCatalogue, undeclaredBlockTypes, EDITOR_PROTOCOL_VERSION, withLoopbackSpellings } from "@avocadostudio-ai/shared";
 import { chatRequestBodySchema } from "../nlp/intent-detection.js";
 import { applyOpsAtomically, pickFocusBlockId, pickUpdatedSlug, toErrorDetail, classifyGuardrailError } from "../ops/ops-engine.js";
 import { runChatStream, formatSseFrame } from "../http/chat-stream.js";
@@ -230,7 +230,22 @@ function corsHeadersFor(request, config) {
          */
         return isProductionEnv() ? {} : { "access-control-allow-origin": origin, "vary": "Origin" };
     }
-    return config.corsOrigins.includes(origin)
+    /*
+     * `localhost` and `127.0.0.1` are the same machine, so an allowlist naming
+     * one grants the other.
+     *
+     * A caller writes one spelling — the scaffold's `.env.local` writes
+     * `localhost`, our own CLI's banner prints `127.0.0.1` on its first line —
+     * and a browser at the other one had every request answered `200` with no
+     * `access-control-allow-origin` and discarded before any code could see it.
+     * The site's `frame-ancestors` list has expanded both spellings since it was
+     * written; this one did not, so the preview frame was permitted and every
+     * call inside it was dropped.
+     *
+     * Only these two names, and only when the configured origin already uses
+     * one. Every other widening of an allowlist stays an explicit decision.
+     */
+    return withLoopbackSpellings(config.corsOrigins).includes(origin)
         ? { "access-control-allow-origin": origin, "vary": "Origin" }
         : {};
 }
@@ -1571,6 +1586,23 @@ export function createOrchestrator(config = {}) {
                     {
                         id: effectiveSiteId ?? normalizeSiteId(query.siteId),
                         mode: "library",
+                        /*
+                         * The configured name, which this route had never carried.
+                         *
+                         * `/status/planner` reports it and `/sites` did not, so the
+                         * editor's site registry — which is fed from here — had nothing
+                         * to show but the id, and fell back to title-casing it. A
+                         * project in `demo-a/` configured as "The Avocado Hub" was
+                         * greeted as "Demo A" in the header and in the first sentence of
+                         * the welcome message.
+                         *
+                         * `demoContent` for the same reason: it decides which first-screen
+                         * suggestions the editor offers, and depending on a single
+                         * endpoint for it is what made those suggestions lose a race in
+                         * production.
+                         */
+                        ...(config.siteName ? { name: config.siteName } : {}),
+                        demoContent: config.demoContent === true,
                         ...(config.previewUrl ? { previewUrl: config.previewUrl } : {}),
                         ...(config.draftPath ? { draftPath: config.draftPath } : {}),
                         // A registration is more specific than a build-time default, so

package/dist/http/publish-actions.js

@@ -17,6 +17,7 @@
  */
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
+import { withLoopbackSpellings } from "@avocadostudio-ai/shared";
 import { normalizeSession, scopedSessionKey, getSessionPages, getSiteConfig, publishedPages, publishStatusBySession, listPublishLog, findPublishLogForStatusUpdate, updatePublishLogStatusById } from "../state/session-state.js";
 import { computePublishDiff } from "../publish/diff-engine.js";
 import { refreshPublishStatusFromVercel } from "../publish/publish-helpers.js";
@@ -165,7 +166,15 @@ export function isSafeOrigin(raw) {
     if (isPrivate) {
         if (process.env.NODE_ENV !== "production")
             return true;
-        const corsOrigins = (process.env.ORCHESTRATOR_CORS_ORIGINS ?? "").split(",").map((s) => s.trim().replace(/\/+$/, ""));
+        /*
+         * Both loopback spellings, for the same reason CORS grants both: the
+         * declaration and the request are written by different hands. The scaffold
+         * writes `ORCHESTRATOR_CORS_ORIGINS=http://localhost:3000`; a site opened
+         * at `127.0.0.1` sends the other one, and `publish/diff` answered
+         * `400 siteOrigin is not an allowed URL` for an origin the deployment had
+         * in fact declared trusted.
+         */
+        const corsOrigins = withLoopbackSpellings((process.env.ORCHESTRATOR_CORS_ORIGINS ?? "").split(",").map((s) => s.trim().replace(/\/+$/, "")));
         const normalized = parsed.origin;
         if (corsOrigins.some((o) => o === normalized))
             return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/orchestrator-core",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",
@@ -22,8 +22,8 @@
     "openai": "^4.87.1",
     "sharp": "^0.35.4",
     "zod": "^4.3.6",
-    "@avocadostudio-ai/shared": "^0.11.2",
-    "@avocadostudio-ai/migration-sdk": "^0.11.2"
+    "@avocadostudio-ai/shared": "^0.11.4",
+    "@avocadostudio-ai/migration-sdk": "^0.11.4"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.220",