@kmugalkhod/lightcode 0.13.0 → 0.13.1

package/cli.js

@@ -124,7 +124,7 @@ var init_logger = __esm(() => {
 });
 
 // packages/shared/src/version.ts
-var lightcodeVersion = "0.13.0";
+var lightcodeVersion = "0.13.1";
 
 // packages/shared/src/index.ts
 var productName = "Lightcode";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kmugalkhod/lightcode",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Lightcode — a local AI coding agent with terminal and browser interfaces.",
   "type": "module",
   "license": "MIT",

package/server.js

@@ -515,6 +515,9 @@ function loadWebAuthStateFromEnvironment(env = Bun.env) {
 function isPublicWebPath(pathname) {
   return pathname === "/healthz" || pathname === "/app" || pathname === "/app/" || pathname.startsWith("/app/");
 }
+function isPublicWebAppPath(pathname) {
+  return pathname === "/app" || pathname === "/app/" || pathname.startsWith("/app/");
+}
 function looksLikeBrowserRequest(request) {
   const headers = request.headers;
   if (headers.get("x-lightcode-client")?.toLowerCase() === "web") {
@@ -577,8 +580,9 @@ function createWebSecurityMiddleware(options = {}) {
       return jsonSecurityError(c, 403, "web_origin_forbidden", "The browser origin is not allowed.");
     }
     const fetchSite = request.headers.get("sec-fetch-site");
+    const isBootstrapDocumentNavigation = isPublicWebAppPath(pathname) && (request.method === "GET" || request.method === "HEAD") && request.headers.get("sec-fetch-mode") === "navigate" && request.headers.get("sec-fetch-dest") === "document";
     const allowedFetchSites = publicPath ? new Set(["same-origin", "none"]) : new Set(["same-origin"]);
-    if (browserRequest && fetchSite !== null && !allowedFetchSites.has(fetchSite)) {
+    if (browserRequest && fetchSite !== null && !allowedFetchSites.has(fetchSite) && !(fetchSite === "cross-site" && isBootstrapDocumentNavigation)) {
       return jsonSecurityError(c, 403, "web_fetch_forbidden", "Cross-site browser requests are not allowed.");
     }
     if (!publicPath && browserRequest) {