remote-codex 0.11.19 → 0.11.20

package/apps/relay-server/dist/index.js

@@ -730,7 +730,26 @@ var updatePasswordSchema = z.object({
   currentPassword: z.string().min(1),
   newPassword: z.string().min(8)
 });
-function buildRelayServer(config2) {
+var DEFAULT_WEBVIEW_CORS_ORIGINS = /* @__PURE__ */ new Set([
+  "null",
+  "capacitor://localhost",
+  "ionic://localhost",
+  "http://localhost",
+  "https://localhost"
+]);
+var WEBVIEW_CORS_ALLOW_HEADERS = [
+  "authorization",
+  "content-type"
+].join(", ");
+var WEBVIEW_CORS_ALLOW_METHODS = [
+  "GET",
+  "POST",
+  "PATCH",
+  "PUT",
+  "DELETE",
+  "OPTIONS"
+].join(", ");
+function buildRelayServer(config2, options = {}) {
   const app2 = Fastify({ logger: false });
   app2.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => {
     done(null, body);
@@ -751,6 +770,20 @@ function buildRelayServer(config2) {
   const state = {
     supervisors: /* @__PURE__ */ new Map()
   };
+  const allowedWebViewCorsOrigins = webViewCorsOrigins(options.env ?? process.env);
+  app2.addHook("onRequest", async (request, reply) => {
+    if (!allowedWebViewCorsOrigins) {
+      return;
+    }
+    const origin = request.headers.origin;
+    if (typeof origin !== "string" || !allowedWebViewCorsOrigins.has(origin)) {
+      return;
+    }
+    applyWebViewCorsHeaders(reply, origin);
+    if (request.method === "OPTIONS") {
+      return reply.code(204).send();
+    }
+  });
   app2.get("/healthz", async () => {
     const primary = [...state.supervisors.values()][0] ?? null;
     return {
@@ -1092,6 +1125,20 @@ function buildRelayServer(config2) {
   });
   return app2;
 }
+function webViewCorsOrigins(env) {
+  if (env.REMOTE_CODEX_ENABLE_WEBVIEW_CORS !== "true") {
+    return null;
+  }
+  const configured = env.REMOTE_CODEX_WEBVIEW_CORS_ORIGINS?.split(",").map((origin) => origin.trim()).filter(Boolean);
+  return new Set(configured?.length ? configured : DEFAULT_WEBVIEW_CORS_ORIGINS);
+}
+function applyWebViewCorsHeaders(reply, origin) {
+  reply.header("access-control-allow-origin", origin);
+  reply.header("access-control-allow-methods", WEBVIEW_CORS_ALLOW_METHODS);
+  reply.header("access-control-allow-headers", WEBVIEW_CORS_ALLOW_HEADERS);
+  reply.header("access-control-max-age", "600");
+  reply.header("vary", "Origin");
+}
 async function forwardRelayHttp(input) {
   const threadId = threadIdFromPath(input.targetPath);
   if (!input.store.canAccessDevice(input.user.id, input.deviceId, threadId)) {