Seven operations references re-verified against main for 0.6.6. Text only.
- browser-access: the web UI works over http on the daemon port at any accepted address, including the Tailscale name; OPENRIG_ALLOWED_ORIGINS is needed only for a UI served another way, such as https through your own domain.
- slack-app-setup: invite the bot before rig slack verify, and register a human with rig gateway human add before rig slack enable, which refuses without one; verify warns on missing feature scopes.
- health-diagnosis, host-resources, inventory-request-diagnostics, stream-classifier-worker, telemetry: fields, bounds and stop conditions corrected to match the code.
Commands and flags checked against the help inventory of a clean build of a350c59b.
* fix(restore): retain inconclusive legacy Claude launches (#346)
Co-authored-by: v-openrig-build <[email protected]>
(cherry picked from commit eef01465a3)
* fix(daemon): check target name and browser origin once on /api (#358)
The daemon now checks every /api request once, before any route or cross-host read-through runs, including WebSocket upgrades.
- Target names: localhost, IP literals, this machine's own names and its own MagicDNS name are accepted without setup; other names are refused with a remedy (OPENRIG_ALLOWED_HOSTS, or a configured bearer token, which waives only the name check).
- Browser origins: when present, an Origin must be the built-in UI's own origin (with the web UI enabled) or listed in OPENRIG_ALLOWED_ORIGINS; a token never overrides an origin refusal.
- Host and Origin are read from the raw request headers, so duplicate or empty values are refused rather than collapsed.
- Refusals are a 403 with a one-sentence remedy and code; rig ps and the TUI now show it. Refusal logging is sanitized, bounded and deduplicated.
- Route-level authorization is unchanged.
Adapted for main: the existing /api Origin guard (apiOriginProtection) and the
terminal WebSocket Origin check stay in place. The boundary is mounted before the
Origin guard, so its refusal codes and remedies are what callers see; the terminal
route and its tests are unchanged from main.
(cherry picked from commit 7d77d73b9c)
* docs: add browser access reference (#372)
Adds docs/reference/browser-access.md (which addresses and browser pages the
daemon accepts, the two allowances, refusal remedies and limits) and links it
from the help guide's daemon-access section.
Co-authored-by: dev50-planner <[email protected]>
(cherry picked from commit a3cc6c8a10)
* test(daemon): expect the browser boundary's refusal from the real app
On the real daemon app the /api browser boundary now runs before the Origin
guard, so a cross-origin browser request is refused with the boundary's code
(browser_origin_refused) and remedy. The status stays 403; the middleware-level
cases of the Origin guard are unchanged.
* docs(reference): name the allowed origin the web UI needs at other names
On main the terminal WebSocket check and the /api Origin guard stay in place
alongside the browser boundary, so the web UI opened at a non-loopback name or
address needs that page's exact origin in OPENRIG_ALLOWED_ORIGINS.
---------
Co-authored-by: v-openrig-build <[email protected]>
Co-authored-by: dev50-planner <[email protected]>
Mike Schwarz