From 64c1b1951f4928cdfedd427c6ed5dcee1d92874c Mon Sep 17 00:00:00 2001
From: Sameh Khamis <sameh@halfpixel.ai>
Date: Fri, 2 Oct 2026 12:17:29 -0700
Subject: [PATCH] Answer panel origins only through the CORS plugin

---
 build/vite.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/build/vite.js b/build/vite.js
index 12915f72f..696c740de 100644
--- a/build/vite.js
+++ b/build/vite.js
@@ -84,10 +84,6 @@ export function createBrowserViteConfig({
       fs: {
         deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/ENVIRONMENT'],
       },
-      // Cross-origin reads: local pages, as Vite allows by default, plus the
-      // MCP Apps panels that load the app into a conversation (Claude's
-      // sandbox origins); see panelCorsPlugin. Development and preview only.
-      cors: { origin: PANEL_CORS_ORIGINS },
       // These headers protect the document containing Provider Settings.
       // Embed-mode documents are framable instead; see embed-framing.js.
       headers: {