opencode-dashboard-server 0.2.0__tar.gz → 0.4.0__tar.gz

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-dashboard-server
-Version: 0.2.0
+Version: 0.4.0
 Summary: FastAPI aggregator over opencode's SQLite storage
 Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Repository, https://github.com/GCS-ZHN/opencode-dashboard
@@ -9,6 +9,8 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: fastapi<1,>=0.115
 Requires-Dist: uvicorn<1,>=0.30
+Requires-Dist: platformdirs<5,>=4
+Requires-Dist: PyYAML<7,>=6
 
 # opencode-dashboard-server
 
@@ -20,6 +22,8 @@ API for the dashboard front end.
 
 ```bash
 pip install opencode-dashboard-server
+# or with uv:
+uv tool install opencode-dashboard-server
 ```
 
 Requires:
@@ -30,14 +34,29 @@ Requires:
 
 ## Quick start
 
+Configure once (interactive; writes `~/.config/opencode-dashboard/server.yaml`), then serve:
+
+```bash
+opencode-dashboard-server configure
+opencode-dashboard-server serve
+```
+
+`configure` walks you through `port` (default `8791`), `host` (default `0.0.0.0`),
+`cors_origins` (comma-separated; empty = built-in loopback whitelist), `poll_seconds`
+(default `5`), and `opencode_bin` (default `opencode`). Empty input keeps the default.
+
+`serve` accepts overrides: `--port N`, `--host H`, `--config PATH` (instead of the XDG file).
+Precedence for port/host: CLI flag > env `PORT`/`HOST` > config file > default.
+
 Run one aggregator per opencode host:
 
 ```bash
 uvicorn app:app --port 8791
 ```
 
-Run on more hosts with different ports (`8792`, `8793`, …) and list each in the front end's
-`dashboard.yaml`. Environment switches:
+or directly with uvicorn (still works — reads env/defaults only). Run on more hosts with
+different ports (`8792`, `8793`, …) and list each in the front end's config (`opencode-dashboard configure`).
+Environment switches (used when no config file value is set):
 
 - `DASHBOARD_CORS_ORIGINS` — comma-separated CORS allow-list (defaults to the loopback dev origins `localhost/127.0.0.1:5173` and `:4173`; tighten or widen for your deployment).
 - `DASHBOARD_POLL_SECONDS` — SSE poll interval in seconds (default `5`).

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/README.md

@@ -8,6 +8,8 @@ API for the dashboard front end.
 
 ```bash
 pip install opencode-dashboard-server
+# or with uv:
+uv tool install opencode-dashboard-server
 ```
 
 Requires:
@@ -18,14 +20,29 @@ Requires:
 
 ## Quick start
 
+Configure once (interactive; writes `~/.config/opencode-dashboard/server.yaml`), then serve:
+
+```bash
+opencode-dashboard-server configure
+opencode-dashboard-server serve
+```
+
+`configure` walks you through `port` (default `8791`), `host` (default `0.0.0.0`),
+`cors_origins` (comma-separated; empty = built-in loopback whitelist), `poll_seconds`
+(default `5`), and `opencode_bin` (default `opencode`). Empty input keeps the default.
+
+`serve` accepts overrides: `--port N`, `--host H`, `--config PATH` (instead of the XDG file).
+Precedence for port/host: CLI flag > env `PORT`/`HOST` > config file > default.
+
 Run one aggregator per opencode host:
 
 ```bash
 uvicorn app:app --port 8791
 ```
 
-Run on more hosts with different ports (`8792`, `8793`, …) and list each in the front end's
-`dashboard.yaml`. Environment switches:
+or directly with uvicorn (still works — reads env/defaults only). Run on more hosts with
+different ports (`8792`, `8793`, …) and list each in the front end's config (`opencode-dashboard configure`).
+Environment switches (used when no config file value is set):
 
 - `DASHBOARD_CORS_ORIGINS` — comma-separated CORS allow-list (defaults to the loopback dev origins `localhost/127.0.0.1:5173` and `:4173`; tighten or widen for your deployment).
 - `DASHBOARD_POLL_SECONDS` — SSE poll interval in seconds (default `5`).

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/aggregate.py

@@ -205,6 +205,17 @@ def project_detail(runner, project_id) -> tuple[dict, list[dict]] | None:
     return _project(rows[0]), [_session(r) for r in sessions]
 
 
+def _model_entry(d: dict) -> dict:
+    return {
+        "model": normalize_model(d["model_id"]),
+        "provider": d["provider"],
+        "mode": d["mode"],
+        "messageCount": int(d["message_count"] or 0),
+        "tokens": tokens(d),
+        "cost": round(float(d["cost"] or 0), 6),
+    }
+
+
 def session_detail(runner, session_id) -> tuple[dict, list[dict]] | None:
     rows = runner.query(SESSIONS_SQL + " WHERE id = ?", (session_id,))
     if not rows:
@@ -213,16 +224,36 @@ def session_detail(runner, session_id) -> tuple[dict, list[dict]] | None:
         MESSAGES_SQL + " AND session_id = ? GROUP BY model_id, provider, mode",
         (session_id,),
     )
-    models = []
-    for row in msg_rows:
-        d = dict(zip(_MSG_KEYS, row))
-        models.append({
-            "model": normalize_model(d["model_id"]),
-            "provider": d["provider"],
-            "mode": d["mode"],
-            "messageCount": int(d["message_count"] or 0),
-            "tokens": tokens(d),
-            "cost": round(float(d["cost"] or 0), 6),
-        })
+    models = [_model_entry(dict(zip(_MSG_KEYS, row))) for row in msg_rows]
     models.sort(key=lambda m: (-m["cost"], m["model"] or ""))
     return _session(rows[0]), models
+
+
+def models(runner) -> list[dict]:
+    """Whole-host per-model rollup from message.data (same shape as the
+    per-session model breakdown, but aggregated across all sessions).
+
+    Rows are grouped by (model_id, provider, mode) so provider/mode labels are
+    accurate, then merged by display name so prefixed/unprefixed ids (e.g.
+    deepseek/deepseek-v4-flash vs deepseek-v4-flash) don't create duplicate
+    slices. On merge, the higher-cost row keeps its provider/mode label.
+    """
+    msg_rows = runner.query_tsv(MESSAGES_SQL + " GROUP BY model_id, provider, mode")
+    merged: dict[str, dict] = {}
+    for row in msg_rows:
+        e = _model_entry(dict(zip(_MSG_KEYS, row)))
+        key = e["model"] or ""
+        cur = merged.get(key)
+        if cur is None:
+            merged[key] = e
+        else:
+            if e["cost"] > cur["cost"]:
+                cur["provider"] = e["provider"]
+                cur["mode"] = e["mode"]
+            cur["messageCount"] += e["messageCount"]
+            for k in ("input", "output", "reasoning", "cacheRead", "cacheWrite", "total"):
+                cur["tokens"][k] += e["tokens"][k]
+            cur["cost"] = round(cur["cost"] + e["cost"], 6)
+    ms = list(merged.values())
+    ms.sort(key=lambda m: (-m["cost"], m["model"] or ""))
+    return ms

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/app.py

@@ -22,7 +22,7 @@ logger = logging.getLogger("dashboard")
 
 # Comma-separated CORS allow-list; defaults to the loopback dev origins. Tight
 # by default so a random webpage can't exfiltrate local project/session data.
-def cors_origins() -> list[str]:
+def default_cors_origins() -> list[str]:
     env = os.environ.get("DASHBOARD_CORS_ORIGINS", "").strip()
     if env:
         return [o.strip() for o in env.split(",") if o.strip()]
@@ -32,27 +32,32 @@ def cors_origins() -> list[str]:
     ]
 
 
-POLL_SECONDS = float(os.environ.get("DASHBOARD_POLL_SECONDS", "5"))
-
-
-@lru_cache(maxsize=1)
-def opencode_version() -> str:
+@lru_cache(maxsize=8)
+def opencode_version(executable: str = "opencode") -> str:
     try:
         return subprocess.run(
-            ["opencode", "--version"], capture_output=True, text=True, check=True
+            [executable, "--version"], capture_output=True, text=True, check=True
         ).stdout.strip()
     except (OSError, subprocess.CalledProcessError):
         return "unknown"  # e.g. CI without the opencode CLI; don't fail the request
 
 
-def create_app(runner=None) -> FastAPI:
-    runner = runner or CliRunner()
+def create_app(runner=None, cors_origins=None, poll_seconds=None, opencode_bin=None) -> FastAPI:
+    bin = opencode_bin or os.environ.get("OPENCODE_BIN") or "opencode"
+    if runner is None:
+        runner = CliRunner(executable=bin)
+    origins = cors_origins if cors_origins is not None else default_cors_origins()
+    if poll_seconds is None:
+        try:
+            poll_seconds = float(os.environ.get("DASHBOARD_POLL_SECONDS", "5"))
+        except ValueError:
+            poll_seconds = 5.0
     app = FastAPI(title="opencode token dashboard")
     # Loopback-only API; restrict origins so a random webpage can't exfiltrate
     # local project/session data from the browser (the client runs from Vite).
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=cors_origins(),
+        allow_origins=origins,
         allow_methods=["*"],
         allow_headers=["*"],
     )
@@ -68,14 +73,14 @@ def create_app(runner=None) -> FastAPI:
 
     @app.get("/health")
     def health():
-        return {"status": "ok", "version": opencode_version()}
+        return {"status": "ok", "version": opencode_version(bin)}
 
     @app.get("/overview")
     def overview():
         def run():
             data = aggregate.overview(runner)
             data["host"] = socket.gethostname()
-            data["opencodeVersion"] = opencode_version()
+            data["opencodeVersion"] = opencode_version(bin)
             return data
 
         return handle(run)
@@ -84,6 +89,10 @@ def create_app(runner=None) -> FastAPI:
     def projects():
         return handle(lambda: aggregate.projects(runner))
 
+    @app.get("/models")
+    def models():
+        return handle(lambda: aggregate.models(runner))
+
     @app.get("/projects/{project_id}")
     def project(project_id: str):
         def run():
@@ -128,7 +137,7 @@ def create_app(runner=None) -> FastAPI:
                 except Exception:
                     logger.exception("stream poll failed")
                 try:
-                    await asyncio.wait_for(stop.wait(), POLL_SECONDS)
+                    await asyncio.wait_for(stop.wait(), poll_seconds)
                 except asyncio.TimeoutError:
                     pass
 

opencode_dashboard_server-0.4.0/cli.py

@@ -0,0 +1,126 @@
+"""opencode-dashboard-server CLI: interactive configure + serve.
+
+Run:  uv tool install opencode-dashboard-server
+      opencode-dashboard-server configure
+      opencode-dashboard-server serve [--port N] [--host H] [--config PATH]
+"""
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+import yaml
+from platformdirs import user_config_path
+
+from app import create_app
+
+
+def config_path() -> Path:
+    # Force XDG semantics so the backend shares ~/.config/opencode-dashboard
+    # with the front end; platformdirs would otherwise use ~/Library/Application
+    # Support on macOS. setdefault keeps a user-set XDG_CONFIG_HOME intact.
+    os.environ.setdefault("XDG_CONFIG_HOME", str(Path.home() / ".config"))
+    return user_config_path("opencode-dashboard") / "server.yaml"
+
+
+def load_config(path: Path) -> dict:
+    if not path.exists():
+        return {}
+    return yaml.safe_load(path.read_text()) or {}
+
+
+def _prompt(label: str, current, default) -> str:
+    hint = current if current != "" else default
+    try:
+        value = input(f"{label} [{hint}]: ").strip()
+    except EOFError:
+        return hint
+    return value if value else hint
+
+
+def _prompt_num(label: str, current, default, conv):
+    while True:
+        try:
+            return conv(_prompt(label, current, default))
+        except ValueError:
+            print(f"Invalid {label}; enter a number.")
+
+
+def cmd_configure(args) -> None:
+    path = config_path()
+    existing = load_config(path)
+    cur = {
+        "port": existing.get("port", 8791),
+        "host": existing.get("host", "0.0.0.0"),
+        "cors_origins": existing.get("cors_origins", ""),
+        "poll_seconds": existing.get("poll_seconds", 5),
+        "opencode_bin": existing.get("opencode_bin", "opencode"),
+    }
+    if existing:
+        print(f"Current config at {path}:")
+        print(yaml.safe_dump(cur, sort_keys=False).rstrip())
+        print()
+    cur["port"] = _prompt_num("port", cur["port"], 8791, int)
+    cur["host"] = _prompt("host", cur["host"], "0.0.0.0")
+    cur["cors_origins"] = _prompt(
+        "cors_origins (comma-separated; empty = built-in loopback whitelist)",
+        cur["cors_origins"], "",
+    )
+    cur["poll_seconds"] = _prompt_num("poll_seconds", cur["poll_seconds"], 5, float)
+    cur["opencode_bin"] = _prompt("opencode_bin", cur["opencode_bin"], "opencode")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(yaml.safe_dump(cur, sort_keys=False))
+    print(f"Wrote {path}")
+
+
+def cmd_serve(args) -> None:
+    path = args.config or config_path()
+    cfg = load_config(path)
+    try:
+        port = args.port or int(os.environ.get("PORT") or cfg.get("port") or 8791)
+    except ValueError:
+        print(f"invalid port: {os.environ.get('PORT') or cfg.get('port')!r}")
+        sys.exit(2)
+    host = args.host or os.environ.get("HOST") or cfg.get("host") or "0.0.0.0"
+
+    import uvicorn
+
+    # cors_origins is stored comma-separated; create_app expects a list.
+    cors = [o.strip() for o in str(cfg.get("cors_origins", "")).split(",") if o.strip()]
+
+    uvicorn.run(
+        create_app(
+            cors_origins=cors or None,
+            poll_seconds=cfg.get("poll_seconds"),
+            opencode_bin=cfg.get("opencode_bin") or None,
+        ),
+        host=host,
+        port=port,
+    )
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="opencode-dashboard-server",
+        description="opencode token dashboard aggregation backend",
+    )
+    sub = parser.add_subparsers(dest="cmd")
+    sub.add_parser("configure", help="interactively write the XDG config file")
+    serve = sub.add_parser("serve", help="run the server (FastAPI + uvicorn)")
+    serve.add_argument("--config", metavar="PATH", help="config file (default: XDG server.yaml)")
+    serve.add_argument("--port", type=int, help="listen port")
+    serve.add_argument("--host", help="bind host")
+    args = parser.parse_args(argv)
+    if args.cmd == "configure":
+        cmd_configure(args)
+    elif args.cmd == "serve":
+        cmd_serve(args)
+    else:
+        parser.print_usage()
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/opencode_dashboard_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-dashboard-server
-Version: 0.2.0
+Version: 0.4.0
 Summary: FastAPI aggregator over opencode's SQLite storage
 Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Repository, https://github.com/GCS-ZHN/opencode-dashboard
@@ -9,6 +9,8 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: fastapi<1,>=0.115
 Requires-Dist: uvicorn<1,>=0.30
+Requires-Dist: platformdirs<5,>=4
+Requires-Dist: PyYAML<7,>=6
 
 # opencode-dashboard-server
 
@@ -20,6 +22,8 @@ API for the dashboard front end.
 
 ```bash
 pip install opencode-dashboard-server
+# or with uv:
+uv tool install opencode-dashboard-server
 ```
 
 Requires:
@@ -30,14 +34,29 @@ Requires:
 
 ## Quick start
 
+Configure once (interactive; writes `~/.config/opencode-dashboard/server.yaml`), then serve:
+
+```bash
+opencode-dashboard-server configure
+opencode-dashboard-server serve
+```
+
+`configure` walks you through `port` (default `8791`), `host` (default `0.0.0.0`),
+`cors_origins` (comma-separated; empty = built-in loopback whitelist), `poll_seconds`
+(default `5`), and `opencode_bin` (default `opencode`). Empty input keeps the default.
+
+`serve` accepts overrides: `--port N`, `--host H`, `--config PATH` (instead of the XDG file).
+Precedence for port/host: CLI flag > env `PORT`/`HOST` > config file > default.
+
 Run one aggregator per opencode host:
 
 ```bash
 uvicorn app:app --port 8791
 ```
 
-Run on more hosts with different ports (`8792`, `8793`, …) and list each in the front end's
-`dashboard.yaml`. Environment switches:
+or directly with uvicorn (still works — reads env/defaults only). Run on more hosts with
+different ports (`8792`, `8793`, …) and list each in the front end's config (`opencode-dashboard configure`).
+Environment switches (used when no config file value is set):
 
 - `DASHBOARD_CORS_ORIGINS` — comma-separated CORS allow-list (defaults to the loopback dev origins `localhost/127.0.0.1:5173` and `:4173`; tighten or widen for your deployment).
 - `DASHBOARD_POLL_SECONDS` — SSE poll interval in seconds (default `5`).

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/opencode_dashboard_server.egg-info/SOURCES.txt

@@ -1,11 +1,13 @@
 README.md
 aggregate.py
 app.py
+cli.py
 db.py
 pyproject.toml
 opencode_dashboard_server.egg-info/PKG-INFO
 opencode_dashboard_server.egg-info/SOURCES.txt
 opencode_dashboard_server.egg-info/dependency_links.txt
+opencode_dashboard_server.egg-info/entry_points.txt
 opencode_dashboard_server.egg-info/requires.txt
 opencode_dashboard_server.egg-info/top_level.txt
 tests/test_aggregate.py

opencode_dashboard_server-0.4.0/opencode_dashboard_server.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+opencode-dashboard-server = cli:main

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/opencode_dashboard_server.egg-info/requires.txt

@@ -1,2 +1,4 @@
 fastapi<1,>=0.115
 uvicorn<1,>=0.30
+platformdirs<5,>=4
+PyYAML<7,>=6

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/opencode_dashboard_server.egg-info/top_level.txt

@@ -1,3 +1,4 @@
 aggregate
 app
+cli
 db

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/pyproject.toml

@@ -4,13 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "opencode-dashboard-server"
-version = "0.2.0"
+version = "0.4.0"
 description = "FastAPI aggregator over opencode's SQLite storage"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "fastapi>=0.115,<1",
     "uvicorn>=0.30,<1",
+    "platformdirs>=4,<5",
+    "PyYAML>=6,<7",
 ]
 
 [project.urls]
@@ -18,8 +20,11 @@ Homepage = "https://github.com/GCS-ZHN/opencode-dashboard"
 Repository = "https://github.com/GCS-ZHN/opencode-dashboard"
 Issues = "https://github.com/GCS-ZHN/opencode-dashboard/issues"
 
+[project.scripts]
+opencode-dashboard-server = "cli:main"
+
 [tool.setuptools]
-py-modules = ["app", "aggregate", "db"]
+py-modules = ["app", "aggregate", "db", "cli"]
 
 [dependency-groups]
 dev = [

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/tests/test_aggregate.py

@@ -1,6 +1,7 @@
 """Assert-based tests for the aggregation logic, driven via SqliteRunner."""
 
 from aggregate import (
+    models,
     normalize_model,
     overview,
     project_detail,
@@ -74,7 +75,10 @@ def test_project_detail_flat_sessions(runner):
 def test_session_detail_model_breakdown(runner):
     sess, models = session_detail(runner, "s4")
     assert sess["cost"] == 0.9
-    assert [m["model"] for m in models] == ["deepseek-v4-flash", "claude-sonnet-4.5"]
+    # per-session breakdown keeps (model, provider, mode) granularity, so the
+    # deepseek/build + openrouter/plan pair for the same model id stays split
+    assert [m["model"] for m in models] == ["deepseek-v4-flash", "claude-sonnet-4.5", "deepseek-v4-flash"]
+    assert [m["provider"] for m in models] == ["deepseek", "opencode", "openrouter"]
     flash = models[0]
     assert flash["provider"] == "deepseek"
     assert flash["mode"] == "build"
@@ -87,6 +91,13 @@ def test_session_detail_model_breakdown(runner):
     assert claude["tokens"] == {"input": 200, "output": 100, "reasoning": 50,
                                 "cacheRead": 0, "cacheWrite": 0, "total": 350}
     assert claude["cost"] == 0.3
+    flash2 = models[2]
+    assert flash2["provider"] == "openrouter"
+    assert flash2["mode"] == "plan"
+    assert flash2["messageCount"] == 1
+    assert flash2["tokens"] == {"input": 50, "output": 20, "reasoning": 10,
+                                "cacheRead": 5, "cacheWrite": 2, "total": 87}
+    assert flash2["cost"] == 0.1
 
 
 def test_zero_token_session_is_zeros_not_null(runner):
@@ -114,3 +125,27 @@ def test_normalize_model():
 def test_unknown_ids_return_none(runner):
     assert project_detail(runner, "nope") is None
     assert session_detail(runner, "nope") is None
+
+
+def test_models_hostwide_rollup(runner):
+    ms = models(runner)
+    # ordered by cost desc (tie by model name); user message in m5 excluded
+    assert [m["model"] for m in ms] == ["deepseek-v4-flash", "claude-sonnet-4.5", "kimi-k3"]
+    flash = ms[0]
+    # m1+m2 (deepseek/build) and m6 (openrouter/plan) share a model id; the
+    # host-wide rollup merges them into one entry, keeping the higher-cost label
+    assert flash["provider"] == "deepseek"
+    assert flash["mode"] == "build"
+    assert flash["messageCount"] == 3  # m1 + m2 + m6, not the m5 user message
+    assert flash["tokens"] == {"input": 250, "output": 120, "reasoning": 60,
+                               "cacheRead": 25, "cacheWrite": 12, "total": 467}
+    assert flash["cost"] == 0.7
+    claude = ms[1]
+    assert claude["provider"] == "opencode"
+    assert claude["messageCount"] == 1
+    assert claude["tokens"]["total"] == 350
+    assert claude["cost"] == 0.3
+    kimi = ms[2]
+    assert kimi["messageCount"] == 1  # only m4; the m5 user message is excluded
+    assert kimi["tokens"] == ZERO_TOKENS
+    assert kimi["cost"] == 0.0

{opencode_dashboard_server-0.2.0 → opencode_dashboard_server-0.4.0}/tests/test_app.py

@@ -39,6 +39,16 @@ def test_overview_keys():
             "tokens", "cost", "updatedAt"} <= set(r.json())
 
 
+def test_models_keys():
+    c, _ = make_client()
+    r = c.get("/models")
+    assert r.status_code == 200
+    rows = r.json()
+    assert rows  # fixture seeds assistant token-bearing messages
+    assert {"model", "provider", "mode", "messageCount", "tokens", "cost"} <= set(rows[0])
+    assert rows == sorted(rows, key=lambda m: (-m["cost"], m["model"] or ""))
+
+
 def test_foreign_origin_not_allowed_by_cors():
     c, _ = make_client()
     r = c.options("/projects", headers={
@@ -46,3 +56,15 @@ def test_foreign_origin_not_allowed_by_cors():
         "Access-Control-Request-Method": "GET",
     })
     assert "access-control-allow-origin" not in r.headers
+
+
+def test_cors_origins_injection():
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    app = appmod.create_app(SqliteRunner(conn), cors_origins=["http://a.com"])
+    c = TestClient(app)
+    ok = c.options("/projects", headers={"Origin": "http://a.com", "Access-Control-Request-Method": "GET"})
+    assert ok.headers.get("access-control-allow-origin") == "http://a.com"
+    nope = c.options("/projects", headers={"Origin": "http://a.co", "Access-Control-Request-Method": "GET"})
+    assert "access-control-allow-origin" not in nope.headers