@wenrwa/marketplace-cli 0.4.1 → 0.4.2

package/dist/__tests__/bridge-server.test.js

@@ -125,6 +125,21 @@ describe('bridge WebSocket server', () => {
         expect(bad.status).toBe(403);
         expect(bad.headers.get('access-control-allow-origin')).toBeNull();
     });
+    it('answers the Chrome Private-Network-Access preflight for the arena origin', async () => {
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: ORIGIN, 'Access-Control-Request-Private-Network': 'true' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(ORIGIN);
+        expect(res.headers.get('access-control-allow-private-network')).toBe('true');
+        expect(res.headers.get('access-control-allow-methods')).toContain('GET');
+        const bad = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: 'https://evil.example' },
+        });
+        expect(bad.status).toBe(403);
+    });
     it('unauthenticated frames are rejected', async () => {
         const ws = connect(handle.port);
         await new Promise((r) => ws.on('open', r));

package/dist/bridge/server.js

@@ -63,6 +63,23 @@ function startBridgeServer(opts) {
     // read it. (Same-machine cross-user curl with a forged Origin remains
     // possible; documented as out of scope for v1 in PROTOCOL.md.)
     const httpServer = http.createServer((req, res) => {
+        // Chrome Private-Network-Access: a public origin (app.hiveop.io) calling a
+        // local address sends an OPTIONS preflight that MUST be answered with
+        // Access-Control-Allow-Private-Network, or the browser blocks discovery.
+        if (req.method === 'OPTIONS' && req.url === '/discovery') {
+            if (req.headers.origin !== opts.allowedOrigin) {
+                res.writeHead(403).end();
+                return;
+            }
+            res.writeHead(204, {
+                'access-control-allow-origin': opts.allowedOrigin,
+                'access-control-allow-private-network': 'true',
+                'access-control-allow-methods': 'GET, OPTIONS',
+                'access-control-max-age': '600',
+            });
+            res.end();
+            return;
+        }
         if (req.method === 'GET' && req.url === '/discovery') {
             if (req.headers.origin !== opts.allowedOrigin) {
                 res.writeHead(403).end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",