@co0ontty/wand 1.43.3 → 1.43.4

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "928999824e2776170b08b37eac1884673b0c8b2d",
-  "builtAt": "2026-05-31T06:10:02.658Z",
-  "version": "1.43.3",
+  "commit": "304e8031c34e30a7e87403616636c0f056622442",
+  "builtAt": "2026-05-31T06:46:18.755Z",
+  "version": "1.43.4",
   "channel": "stable"
 }

package/dist/server.js

@@ -533,6 +533,29 @@ function getPublicRequestHost(req, config) {
         ?? req.headers.host
         ?? `${config.host}:${config.port}`);
 }
+function firstQueryStringValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value))
+        return firstQueryStringValue(value[0]);
+    return undefined;
+}
+function normalizePublicOrigin(value) {
+    const raw = value?.trim();
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return undefined;
+        if (!parsed.hostname || parsed.username || parsed.password)
+            return undefined;
+        return parsed.origin;
+    }
+    catch {
+        return undefined;
+    }
+}
 function decodeConnectCode(code) {
     try {
         const decoded = Buffer.from(code, "base64").toString("utf8");
@@ -1388,7 +1411,8 @@ export async function startServer(config, configPath) {
         const effectivePassword = dbPassword ?? config.password;
         const protocol = getPublicRequestProtocol(req, useHttps ? "https" : "http");
         const host = getPublicRequestHost(req, config);
-        const serverUrl = `${protocol}://${host}`;
+        const browserOrigin = normalizePublicOrigin(firstQueryStringValue(req.query.origin));
+        const serverUrl = browserOrigin ?? `${protocol}://${host}`;
         const appSecret = config.appSecret ?? "";
         const token = generateAppToken(effectivePassword, appSecret);
         const code = encodeConnectCode(serverUrl, token);

package/dist/web-ui/content/scripts.js

@@ -10987,7 +10987,11 @@
               connectCodeEl.textContent = "加载中...";
               if (connectQrEmpty) connectQrEmpty.textContent = "生成中…";
               if (connectQrCanvas) connectQrCanvas.style.visibility = "hidden";
-              fetch("/api/app-connect-code").then(function(r) { return r.json(); }).then(function(d) {
+              var connectCodeUrl = "/api/app-connect-code";
+              if (window.location && window.location.origin) {
+                connectCodeUrl += "?origin=" + encodeURIComponent(window.location.origin);
+              }
+              fetch(connectCodeUrl, { credentials: "same-origin" }).then(function(r) { return r.json(); }).then(function(d) {
                 if (d.code) {
                   connectCodeEl.textContent = d.code;
                   state.androidConnectCode = d.code;

package/dist/web-ui/embedded-assets.d.ts

@@ -1,4 +1,4 @@
-export declare const EMBEDDED_WEB_ASSET_VERSION = "88a2b1bfc9fa";
+export declare const EMBEDDED_WEB_ASSET_VERSION = "7169ddf94a7a";
 export declare const EMBEDDED_WEB_ASSETS: {
     readonly scriptsJs: string;
     readonly stylesCss: string;