aws-runtime-bridge 1.9.5 → 1.9.6

package/dist/index.js

@@ -254,24 +254,32 @@ const app = express();
 // 中间件配置
 app.use(cors({
     origin(origin, callback) {
-        if (!origin || allowedCorsOrigins.includes(origin)) {
+        // 允许无来源请求（非浏览器客户端、curl 等）
+        if (!origin) {
+            callback(null, true);
+            return;
+        }
+        // AWS_RUNTIME_CORS_ORIGINS=* 时放行所有来源
+        if (allowedCorsOrigins.includes("*")) {
+            callback(null, true);
+            return;
+        }
+        if (allowedCorsOrigins.includes(origin)) {
             callback(null, true);
             return;
         }
         // 允许 bridge 自身端口的来源（dashboard/登录页面同源请求）
-        if (origin) {
-            try {
-                const url = new URL(origin);
-                if ((url.hostname === "localhost" || url.hostname === "127.0.0.1") &&
-                    url.port === String(port)) {
-                    callback(null, true);
-                    return;
-                }
-            }
-            catch {
-                // URL 解析失败，继续拒绝
+        try {
+            const url = new URL(origin);
+            if ((url.hostname === "localhost" || url.hostname === "127.0.0.1") &&
+                url.port === String(port)) {
+                callback(null, true);
+                return;
             }
         }
+        catch {
+            // URL 解析失败，继续拒绝
+        }
         callback(new Error(`[runtime-bridge] CORS origin is not allowed: ${origin}`));
     },
 }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-runtime-bridge",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "description": "AgentsWorkStudio runtime bridge service for machine-level agent runtime integration",
   "type": "module",
   "main": "dist/index.js",