mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
FroRaut
cb837e10a5
_TRUSTED_LOCAL_ORIGIN_PORTS (9119, 5173, 5174, 4174) was trusted on every backend, including packaged Desktop backends on an ephemeral port. A Vite app on 5173, or on 5174 when 5173 is taken, could still read the session token from / and open /api/ws. _is_trusted_local_origin() now accepts only the bound port and the desktop dev renderer this backend was spawned for (HERMES_DESKTOP_DEV_SERVER). `hermes dashboard` keeps working on 9119 because that is its bound port. The dashboard's Vite dev server was the only client that relied on a fixed port: the browser's Origin on proxied /api upgrades is Vite's. The /api proxy now presents upgrades from Vite's own page (Origin host equals Host) with the backend's origin, and passes every other Origin through for the backend to refuse, so it does not launder foreign pages the way Vite's rewriteWsOrigin would. Vite's default CORS grants every localhost port and would hand another local page the token hermesDevToken() injects into index.html, so it is off. (cherry picked from commit 66de028a3ce39ec49a32205855dc269d30bf3942)