groove-dev 0.12.3 → 0.12.4

package/node_modules/@groove-dev/daemon/src/api.js

@@ -14,16 +14,19 @@ export function createApi(app, daemon) {
   // CORS — restrict to localhost + bound interface origins
   app.use((req, res, next) => {
     const origin = req.headers.origin;
-    const allowed = [
-      `http://localhost:${daemon.port}`,
-      `http://127.0.0.1:${daemon.port}`,
-      'http://localhost:3142', // Vite dev server
-    ];
-    // Allow the bound interface (for Tailscale/LAN access)
-    if (daemon.host && daemon.host !== '127.0.0.1') {
-      allowed.push(`http://${daemon.host}:${daemon.port}`);
+    let allowed = false;
+    if (!origin) {
+      allowed = true;
+    } else {
+      try {
+        const url = new URL(origin);
+        // Allow any localhost origin (any port — tunnels change the port)
+        if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') allowed = true;
+        // Allow the bound interface (for Tailscale/LAN access)
+        if (daemon.host && daemon.host !== '127.0.0.1' && url.hostname === daemon.host) allowed = true;
+      } catch { /* invalid origin */ }
     }
-    if (!origin || allowed.includes(origin)) {
+    if (allowed) {
       res.header('Access-Control-Allow-Origin', origin || '*');
     }
     res.header('Access-Control-Allow-Headers', 'Content-Type');

package/node_modules/@groove-dev/daemon/src/index.js

@@ -123,18 +123,16 @@ export class Daemon {
       maxPayload: 1024 * 1024, // 1MB max message
       verifyClient: ({ req }) => {
         const origin = req.headers.origin;
-        // Allow: no origin (CLI/native clients), localhost origins, bound host
+        // Allow: no origin (CLI/native clients)
         if (!origin) return true;
-        const allowed = [
-          `http://localhost:${this.port}`,
-          `http://127.0.0.1:${this.port}`,
-          'http://localhost:3142',
-        ];
-        // Allow the bound interface (for Tailscale/LAN access)
-        if (this.host !== DEFAULT_HOST) {
-          allowed.push(`http://${this.host}:${this.port}`);
-        }
-        return allowed.includes(origin);
+        try {
+          const url = new URL(origin);
+          // Allow any localhost origin (any port — tunnels change the port)
+          if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') return true;
+          // Allow the bound interface (for Tailscale/LAN access)
+          if (this.host !== DEFAULT_HOST && url.hostname === this.host) return true;
+        } catch { /* invalid origin */ }
+        return false;
       },
     });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.12.3",
+  "version": "0.12.4",
   "description": "Open-source agent orchestration layer for AI coding tools. GUI dashboard, multi-agent coordination, zero cold-start (Journalist), infinite sessions (adaptive context rotation), AI Project Manager, Quick Launch. Works with Claude Code, Codex, Gemini CLI, Ollama.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/daemon/src/api.js

@@ -14,16 +14,19 @@ export function createApi(app, daemon) {
   // CORS — restrict to localhost + bound interface origins
   app.use((req, res, next) => {
     const origin = req.headers.origin;
-    const allowed = [
-      `http://localhost:${daemon.port}`,
-      `http://127.0.0.1:${daemon.port}`,
-      'http://localhost:3142', // Vite dev server
-    ];
-    // Allow the bound interface (for Tailscale/LAN access)
-    if (daemon.host && daemon.host !== '127.0.0.1') {
-      allowed.push(`http://${daemon.host}:${daemon.port}`);
+    let allowed = false;
+    if (!origin) {
+      allowed = true;
+    } else {
+      try {
+        const url = new URL(origin);
+        // Allow any localhost origin (any port — tunnels change the port)
+        if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') allowed = true;
+        // Allow the bound interface (for Tailscale/LAN access)
+        if (daemon.host && daemon.host !== '127.0.0.1' && url.hostname === daemon.host) allowed = true;
+      } catch { /* invalid origin */ }
     }
-    if (!origin || allowed.includes(origin)) {
+    if (allowed) {
       res.header('Access-Control-Allow-Origin', origin || '*');
     }
     res.header('Access-Control-Allow-Headers', 'Content-Type');

package/packages/daemon/src/index.js

@@ -123,18 +123,16 @@ export class Daemon {
       maxPayload: 1024 * 1024, // 1MB max message
       verifyClient: ({ req }) => {
         const origin = req.headers.origin;
-        // Allow: no origin (CLI/native clients), localhost origins, bound host
+        // Allow: no origin (CLI/native clients)
         if (!origin) return true;
-        const allowed = [
-          `http://localhost:${this.port}`,
-          `http://127.0.0.1:${this.port}`,
-          'http://localhost:3142',
-        ];
-        // Allow the bound interface (for Tailscale/LAN access)
-        if (this.host !== DEFAULT_HOST) {
-          allowed.push(`http://${this.host}:${this.port}`);
-        }
-        return allowed.includes(origin);
+        try {
+          const url = new URL(origin);
+          // Allow any localhost origin (any port — tunnels change the port)
+          if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') return true;
+          // Allow the bound interface (for Tailscale/LAN access)
+          if (this.host !== DEFAULT_HOST && url.hostname === this.host) return true;
+        } catch { /* invalid origin */ }
+        return false;
       },
     });