flowviant 0.13.0 → 0.14.0

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const VERSION = '0.13.0';
+export const VERSION = '0.14.0';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.

package/bin/lib/preview.mjs

@@ -274,10 +274,16 @@ export async function startPreview({ worktree, kind, cmd, port, log, timeoutMs =
       tunnelStarted = true;
       clearTimeout(bindTimer);
       log?.(`preview: dev server on :${p} — opening the tunnel…`);
-      tunnel = spawn(cf, ['tunnel', '--url', `http://localhost:${p}`], {
-        detached: true,
-        stdio: ['ignore', 'pipe', 'pipe'],
-      });
+      // --http-host-header localhost: send the origin the Host it expects. Vite
+      // (5+) rejects any Host it doesn't recognize (server.allowedHosts), and the
+      // tunnel's public hostname isn't in that list → "Blocked request". Rewriting
+      // the Host to localhost — what a local browser sends anyway — passes the
+      // check with zero repo config, and is harmless to servers that don't check.
+      tunnel = spawn(
+        cf,
+        ['tunnel', '--url', `http://localhost:${p}`, '--http-host-header', 'localhost'],
+        { detached: true, stdio: ['ignore', 'pipe', 'pipe'] },
+      );
       const onTunnel = (d) => {
         const m = TUNNEL_RE.exec(d.toString());
         if (m) finish({ url: m[0], kind, stop });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {