@@ -93,6 +93,7 @@ export function createHttpServer(deps: HttpServerDeps) {
9393 } )
9494
9595 const allowedDevOrigins = new Set ( [ "http://localhost:3000" , "http://127.0.0.1:3000" ] )
96+ const isLoopbackHost = ( host : string ) => host === "127.0.0.1" || host === "::1" || host . startsWith ( "127." )
9697
9798 app . register ( cors , {
9899 origin : ( origin , cb ) => {
@@ -113,10 +114,17 @@ export function createHttpServer(deps: HttpServerDeps) {
113114 return
114115 }
115116
116- if ( allowedDevOrigins . has ( origin ) ) {
117- cb ( null , true )
118- return
119- }
117+ if ( allowedDevOrigins . has ( origin ) ) {
118+ cb ( null , true )
119+ return
120+ }
121+
122+ // When we bind to a non-loopback host (e.g., 0.0.0.0 or LAN IP), allow cross-origin UI access.
123+ if ( deps . host === "0.0.0.0" || ! isLoopbackHost ( deps . host ) ) {
124+ cb ( null , true )
125+ return
126+ }
127+
120128
121129 cb ( null , false )
122130 } ,
@@ -275,13 +283,13 @@ export function createHttpServer(deps: HttpServerDeps) {
275283 }
276284 }
277285
278- const displayHost = deps . host === "0.0.0.0" ? "127.0.0.1" : deps . host === " 127.0.0.1" ? "localhost" : deps . host
286+ const displayHost = deps . host === "127.0.0.1" ? "localhost" : deps . host
279287 const serverUrl = `http://${ displayHost } :${ actualPort } `
280288
281289 deps . serverMeta . httpBaseUrl = serverUrl
282290 deps . serverMeta . host = deps . host
283291 deps . serverMeta . port = actualPort
284- deps . serverMeta . listeningMode = deps . host === "0.0.0.0" ? "all" : "local"
292+ deps . serverMeta . listeningMode = deps . host === "0.0.0.0" || ! isLoopbackHost ( deps . host ) ? "all" : "local"
285293 deps . logger . info ( { port : actualPort , host : deps . host } , "HTTP server listening" )
286294 console . log ( `CodeNomad Server is ready at ${ serverUrl } ` )
287295
0 commit comments