程序员阿江(Relakkes) 9238481e86 fix(desktop): trust loopback web dev access ...

Allow local browser origins such as 127.0.0.1, localhost, and ::1 to use the desktop server without H5 token flow, while keeping LAN and public origins behind H5 access rules. Also make Vite SPA healthcheck fallback to the default loopback backend and document scoped verification expectations.

Tested: bun test src/server/__tests__/h5-access-policy.test.ts
Tested: bun test src/server/__tests__/h5-access-auth.test.ts
Tested: bun test src/server/middleware/cors.test.ts
Tested: cd desktop && bun run test -- src/lib/desktopRuntime.test.ts --run
Tested: git diff --check
Not-tested: bun run verify and coverage were intentionally skipped for this scoped local-dev fix.
Scope-risk: moderate

2026-06-12 12:29:15 +08:00

..

auth.ts

Enforce H5 opt-in before exposing LAN capabilities

2026-05-12 16:25:54 +08:00

cors.test.ts

fix(desktop): trust loopback web dev access

2026-06-12 12:29:15 +08:00

cors.ts

fix(desktop): trust loopback web dev access

2026-06-12 12:29:15 +08:00

errorHandler.ts

Improve desktop failure diagnosis with exportable logs

2026-05-02 12:41:31 +08:00