3 people 7aa9bbd3be fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP ...

The cost-bearing endpoints (/api/realtime/token, /api/openai/hud-summary,
/api/google/nearby-places) and the voice debug log refuse cross-site browser
requests: a foreign or opaque Origin, a Sec-Fetch-Site other than
same-origin/none, or proxy forwarding headers. Loopback tools without an
Origin and the LAN opt-in keep working. The dev and preview servers send one
shared Content-Security-Policy, and embed-mode framing rewrites only the
frame-ancestors directive of it.

Salvaged from #242 onto current main.

Co-authored-by: Sameh Khamis <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-02 19:56:42 -07:00

..

mcp

fix(mcp): bound panel requests, request bodies and cancelled calls

2026-10-02 19:47:37 -07:00

providers

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

standalone

feat: choose per tool whether MCP, voice or both offer it

2026-10-01 14:36:12 -07:00