fix: use same-origin API for all Vercel deployments and extract getVercelOrigins helper

Change VITE_SERVER_URL from hardcoded 'https://play.objectstack.ai' to ''
(empty string / same-origin) so each Vercel deployment — including previews —
calls its own serverless function instead of the production API cross-origin.

Extract getVercelOrigins() helper to deduplicate Vercel env-var origin
collection between the CORS middleware and better-auth trustedOrigins.

Agent-Logs-Url: https://github.com/objectstack-ai/framework/sessions/bffd519d-cf16-402d-a1de-3bdaadfdd5d2

Co-authored-by: xuyushun441-sys <255036401+xuyushun441-sys@users.noreply.github.com>

Author: Copilot

CHANGELOG.md

@@ -15,13 +15,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   functions.  Removed the `functions` block (the in-code `export const config`
   in `server/index.ts` already configures memory/maxDuration without pre-build
   file-pattern validation errors).
-- **Studio CORS error on Vercel temporary/preview domains** — Added Hono CORS
-  middleware to `apps/studio/server/index.ts` so the serverless function returns
-  correct `Access-Control-Allow-Origin` headers for cross-origin requests.
-  Dynamically allows all `*.vercel.app` subdomains, explicitly listed Vercel
-  deployment URLs (`VERCEL_URL`, `VERCEL_BRANCH_URL`,
-  `VERCEL_PROJECT_PRODUCTION_URL`), and localhost for development.  Preflight
-  (OPTIONS) requests are answered immediately without waiting for kernel boot.
+- **Studio CORS error on Vercel temporary/preview domains** — Changed
+  `VITE_SERVER_URL` from hardcoded `https://play.objectstack.ai` to `""`
+  (empty string / same-origin) in `vercel.json` so each deployment — including
+  previews — calls its own serverless function instead of the production API
+  cross-origin.  Also added Hono CORS middleware to `apps/studio/server/index.ts`
+  as a safety net for any remaining cross-origin scenarios; dynamically allows
+  all `*.vercel.app` subdomains, explicitly listed Vercel deployment URLs, and
+  localhost.  Extracted `getVercelOrigins()` helper to keep CORS and
+  better-auth `trustedOrigins` allowlists in sync.
 - **Client test aligned with removed `ai.chat` method** — Updated
   `@objectstack/client` test suite to match the current API surface where
   `ai.chat()` was removed in favour of the Vercel AI SDK `useChat()` hook.

apps/studio/server/index.ts

@@ -40,6 +40,33 @@ import { cors } from 'hono/cors';
 import { createBrokerShim } from '../src/lib/create-broker-shim.js';
 import studioConfig from '../objectstack.config.js';
 
+// ---------------------------------------------------------------------------
+// Vercel origin helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Collect all Vercel deployment origins from environment variables.
+ *
+ * Reused for both:
+ * - better-auth `trustedOrigins` (CSRF)
+ * - Hono CORS middleware `origin` allowlist
+ *
+ * Centralised to avoid drift between the two allowlists.
+ */
+function getVercelOrigins(): string[] {
+    const origins: string[] = [];
+    if (process.env.VERCEL_URL) {
+        origins.push(`https://${process.env.VERCEL_URL}`);
+    }
+    if (process.env.VERCEL_BRANCH_URL) {
+        origins.push(`https://${process.env.VERCEL_BRANCH_URL}`);
+    }
+    if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {
+        origins.push(`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`);
+    }
+    return origins;
+}
+
 // ---------------------------------------------------------------------------
 // Singleton state — persists across warm Vercel invocations
 // ---------------------------------------------------------------------------
@@ -86,17 +113,8 @@ async function ensureKernel(): Promise<ObjectKernel> {
                     ? `https://${process.env.VERCEL_URL}`
                     : 'http://localhost:3000';
 
-            // Collect all Vercel URL variants so better-auth trusts each one
-            const trustedOrigins: string[] = [];
-            if (process.env.VERCEL_URL) {
-                trustedOrigins.push(`https://${process.env.VERCEL_URL}`);
-            }
-            if (process.env.VERCEL_BRANCH_URL) {
-                trustedOrigins.push(`https://${process.env.VERCEL_BRANCH_URL}`);
-            }
-            if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {
-                trustedOrigins.push(`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`);
-            }
+            // Reuse the shared helper so CORS and CSRF allowlists stay in sync
+            const trustedOrigins = getVercelOrigins();
 
             await kernel.use(new AuthPlugin({
                 secret: process.env.AUTH_SECRET || 'dev-secret-please-change-in-production-min-32-chars',
@@ -233,16 +251,7 @@ const app = new Hono();
 //   3. localhost (local development)
 // ---------------------------------------------------------------------------
 
-const vercelOrigins: string[] = [];
-if (process.env.VERCEL_URL) {
-    vercelOrigins.push(`https://${process.env.VERCEL_URL}`);
-}
-if (process.env.VERCEL_BRANCH_URL) {
-    vercelOrigins.push(`https://${process.env.VERCEL_BRANCH_URL}`);
-}
-if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {
-    vercelOrigins.push(`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`);
-}
+const vercelOrigins = getVercelOrigins();
 
 app.use('*', cors({
     origin: (origin) => {

apps/studio/vercel.json

@@ -7,7 +7,7 @@
   "build": {
     "env": {
       "VITE_RUNTIME_MODE": "server",
-      "VITE_SERVER_URL": "https://play.objectstack.ai"
+      "VITE_SERVER_URL": ""
     }
   },
   "headers": [