dirsql 0.4.90 → 0.4.91

package/docs/reference/cli.md

@@ -247,6 +247,7 @@ Config flags are subcommand-local: pass them after `server`
 | `-c, --config <path>` | none | Path to a [config file](./config.md). **Repeatable** (`-c a -c b`): the configs load and merge in argv order — see [Composing multiple configs](./config.md#composing-multiple-configs). The index root is the **invocation directory** (the current working directory) and governs path-tables; a config's `[[table]]` globs anchor at **that config's own directory** (see [glob anchor](./config.md#glob-anchor)), so `--config /elsewhere/.dirsql.toml` indexes `/elsewhere`, from any working directory. With none given, **no named tables are defined** — query the filesystem with a [path-table](./path-tables.md) (`FROM './'`). A `./.dirsql.toml` on disk is **not** auto-loaded; pass it explicitly. A `-c` naming a file that does not exist is an [error](#degraded-mode). |
 | `--host <addr>` | `localhost` | Bind address. |
 | `--port <n>` | `7117` | TCP port to bind. |
+| `--cors-origin <origin>` | off | Let browser pages on `<origin>` (an exact origin such as `http://localhost:3202`, or `*` for any) call `/query` and open `/events`. See [Cross-origin requests](#cross-origin-requests). |
 | `--persist [<path>]` | off | Keep the SQLite index on disk between runs so a restart only re-parses files that actually changed. Bare `--persist` caches at `<root>/.dirsql/cache.db`; `--persist <path>` caches at `<path>`. Off by default (the index is ephemeral). Also available on [`dirsql query`](#dirsql-query). See [Keep the index across restarts](../howto/persist.md). |
 | `--no-ignore` | off | Scan files a `.gitignore` would hide. [Path-tables](./path-tables.md#skip-rules) respect `.gitignore` files by default; this flag restores the full walk. The built-in skips (`node_modules`/`.git`) and configured `ignore` patterns still apply. Also available on [`dirsql query`](#dirsql-query). |
 | `--extension <path>` | none | Load a SQLite extension by literal path, overriding the config's `[[dirsql.extension]]` entries. Repeatable. Format: `<path>` or `<path>::<entrypoint>`. Internal plumbing for the pip/npm launchers, which resolve package-name extensions and pass the resolved paths here — not intended for direct use. When any `--extension` is present, the config file's own extension entries are not loaded. |
@@ -262,6 +263,23 @@ Config flags are subcommand-local: pass them after `server`
   command in `timeout(1)` (see
   [Bounding a hook](./hooks.md#bounding-a-hook)).
 
+### Cross-origin requests
+
+By default the server sends no CORS headers, so a browser blocks a page on
+another origin from reading `/query` responses or opening `/events`. This is
+deliberate: any web page the browser visits can send requests to
+`localhost`, and permissive CORS would let it read the indexed files.
+
+`--cors-origin <origin>` opts in. Every response then carries
+`Access-Control-Allow-Origin: <origin>`, and the preflight a JSON
+`POST /query` triggers is answered (methods `GET`, `POST`; header
+`content-type`). The value is sent verbatim: an origin is
+`scheme://host[:port]` with no trailing slash, and `*` allows every origin.
+
+```bash
+dirsql server --cors-origin http://localhost:3202
+```
+
 ### Configless mode
 
 With no `-c/--config`, the server indexes the invocation directory but

package/docs/reference/http-api.md

@@ -1,7 +1,10 @@
 # HTTP API
 
 The [`dirsql` server](./cli.md#dirsql-server) (default `localhost:7117`)
-exposes two endpoints: `POST /query` and `GET /events`.
+exposes two endpoints: `POST /query` and `GET /events`. It sends no CORS
+headers unless started with
+[`--cors-origin`](./cli.md#cross-origin-requests), so a browser page on
+another origin can reach it only after that opt-in.
 
 ## `POST /query`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dirsql",
-  "version": "0.4.90",
+  "version": "0.4.91",
   "description": "Ephemeral SQL index over a local directory",
   "license": "MIT",
   "repository": "https://github.com/thekevinscott/dirsql",
@@ -221,10 +221,10 @@
     ]
   },
   "optionalDependencies": {
-    "@dirsql/lib-linux-x64-gnu": "0.4.90",
-    "@dirsql/lib-linux-arm64-gnu": "0.4.90",
-    "@dirsql/lib-darwin-x64": "0.4.90",
-    "@dirsql/lib-darwin-arm64": "0.4.90",
-    "@dirsql/lib-win32-x64-msvc": "0.4.90"
+    "@dirsql/lib-linux-x64-gnu": "0.4.91",
+    "@dirsql/lib-linux-arm64-gnu": "0.4.91",
+    "@dirsql/lib-darwin-x64": "0.4.91",
+    "@dirsql/lib-darwin-arm64": "0.4.91",
+    "@dirsql/lib-win32-x64-msvc": "0.4.91"
   }
 }