fix(next): proxy agent server same-origin to avoid App Router CORS block - #17
Merged
Conversation
The agent server is loopback-only with no Access-Control-* surface. The Next adapter injected the raw 127.0.0.1:<port> agent URL as the widget base URL, so the in-page widget fetched /v1/agent/* cross-origin from the dev page and the browser blocked it (no Access-Control-Allow-Origin). The widget mounted but could not reach its backend. withAgentDevtools now mirrors the Vite plugin's proxy: it injects a same-origin base path (/__agent_devtools) and installs a Next rewrites() rule forwarding /__agent_devtools/:path* to the agent server, composing ahead of any existing user rewrites. No baseUrl -> no rewrite (clean no-op). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The agent server is loopback-only with no
Access-Control-*surface (by design, same as the Vite path). The Next adapter injected the rawhttp://127.0.0.1:<port>agent URL as the widget base URL, so the in-page widget fetched/v1/agent/commands//v1/agent/streamcross-origin from the dev page (localhost:<port>). The browser blocked it (No 'Access-Control-Allow-Origin' header) — the widget mounted but could never talk to its backend.Verified on Next 16 + Turbopack against
wireweave/dashboard: widget host mounts, but DevTools shows the CORS error on/v1/agent/commands.Fix
withAgentDevtoolsnow mirrors the Vite plugin's proxy:/__agent_devtools) as the widget base URL instead of the raw agent URL.rewrites()rule forwarding/__agent_devtools/:path*→ the agent server, composed ahead of any existing user rewrites (beforeFiles).baseUrlsupplied → no rewrite, clean no-op.Browser requests stay same-origin (no CORS); the agent server keeps its loopback-only, no-CORS posture.
Tests
packages/nexttypecheck / build green; vitest 30 passed (added: proxy-path base URL injection, rewrite rule shape, composition ahead of user rewrites, no-baseUrl no-op).Changeset:
@agent-devtools/nextpatch.🤖 Generated with Claude Code