open-agents-ai 0.187.339 → 0.187.340

package/dist/index.js

@@ -325580,9 +325580,24 @@ function textResponse(res, status, body, contentType = "text/plain") {
 }
 function isOriginAllowed(origin) {
   if (!origin) return true;
-  if (_corsOrigins.includes("*")) return true;
-  if (_corsLocalOnly) return /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
-  return _corsOrigins.some((p2) => origin === p2 || p2.includes("*") && new RegExp("^" + p2.replace(/\*/g, ".*") + "$").test(origin));
+  const accessMode = (process.env["OA_ACCESS"] || "").toLowerCase().trim();
+  if (accessMode === "any") return true;
+  if (accessMode === "lan") {
+    try {
+      const u = new URL(origin);
+      const host = u.hostname;
+      if (/^(localhost|127\.\d+\.\d+\.\d+|::1|\[::1\])$/.test(host)) return true;
+      if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/.test(host)) return true;
+      if (/^f[cd][0-9a-f]{2}:/i.test(host) || /^fe[89ab][0-9a-f]:/i.test(host)) return true;
+    } catch {
+    }
+  }
+  const corsOrigins = (process.env["OA_CORS_ORIGINS"] || "").split(",").filter(Boolean);
+  if (corsOrigins.includes("*")) return true;
+  if (corsOrigins.length > 0) {
+    return corsOrigins.some((p2) => origin === p2 || p2.includes("*") && new RegExp("^" + p2.replace(/\*/g, ".*") + "$").test(origin));
+  }
+  return /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
 }
 function corsHeaders(req2, res) {
   const origin = req2.headers["origin"];
@@ -330436,7 +330451,7 @@ function setTimerEnabled(name11, enabled2) {
     return false;
   }
 }
-var endpointRegistry, modelRouteMap, endpointUsage, metrics, startedAt, _corsOrigins, _corsLocalOnly, runningProcesses, perKeyUsage, CRON_MARKER2;
+var endpointRegistry, modelRouteMap, endpointUsage, metrics, startedAt, runningProcesses, perKeyUsage, CRON_MARKER2;
 var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
@@ -330469,8 +330484,6 @@ var init_serve = __esm({
       totalErrors: 0
     };
     startedAt = Date.now();
-    _corsOrigins = (process.env["OA_CORS_ORIGINS"] || "").split(",").filter(Boolean);
-    _corsLocalOnly = _corsOrigins.length === 0;
     runningProcesses = /* @__PURE__ */ new Map();
     perKeyUsage = /* @__PURE__ */ new Map();
     CRON_MARKER2 = "# OPEN-AGENTS-SCHEDULED:";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.187.339",
+  "version": "0.187.340",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",