@byoky/openclaw-plugin 0.3.0 → 0.4.1

package/dist/index.js

@@ -293,17 +293,7 @@ async function startCallbackServer(ctx, requestProviderId) {
   return new Promise((resolve) => {
     let resolved = false;
     const server = createServer((req, res) => {
-      const reqOrigin = req.headers.origin || "";
-      let isLocalhost = false;
-      try {
-        const parsed = new URL(reqOrigin);
-        isLocalhost = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost";
-      } catch {
-      }
-      res.setHeader(
-        "Access-Control-Allow-Origin",
-        isLocalhost ? reqOrigin : "http://127.0.0.1"
-      );
+      res.setHeader("Access-Control-Allow-Origin", "http://127.0.0.1");
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type");
       if (req.method === "OPTIONS") {
@@ -312,11 +302,22 @@ async function startCallbackServer(ctx, requestProviderId) {
         return;
       }
       if (req.method === "POST" && req.url === "/callback") {
+        const MAX_BODY_SIZE = 1048576;
         let body = "";
+        let oversized = false;
         req.on("data", (chunk) => {
           body += chunk.toString();
+          if (body.length > MAX_BODY_SIZE) {
+            oversized = true;
+            req.destroy();
+          }
         });
         req.on("end", () => {
+          if (oversized) {
+            res.writeHead(413);
+            res.end("Request body too large");
+            return;
+          }
           try {
             const data = JSON.parse(body);
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -324,8 +325,8 @@ async function startCallbackServer(ctx, requestProviderId) {
             if (!resolved) {
               resolved = true;
               resolve({
-                providers: data.providers || [],
-                port: data.bridgePort || DEFAULT_BRIDGE_PORT,
+                providers: Array.isArray(data.providers) ? data.providers : [],
+                port: typeof data.bridgePort === "number" ? data.bridgePort : DEFAULT_BRIDGE_PORT,
                 server
               });
             }
@@ -429,7 +430,7 @@ function buildAuthPage(requestProviderId) {
           id: requestId,
           requestId,
           payload: { providers: ${providerFilter} },
-        }, '*');
+        }, window.location.origin);
 
         const response = await new Promise((resolve, reject) => {
           function handler(event) {
@@ -461,7 +462,7 @@ function buildAuthPage(requestProviderId) {
           requestId: bridgeRequestId,
           action: 'startBridgeProxy',
           payload: { sessionKey: response.sessionKey, port: ${DEFAULT_BRIDGE_PORT} },
-        }, '*');
+        }, window.location.origin);
 
         const bridgeResult = await new Promise((resolve, reject) => {
           function handler(event) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byoky/openclaw-plugin",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Byoky wallet provider plugin for OpenClaw — manage AI API keys from your browser wallet",
   "type": "module",
   "main": "dist/index.js",