A page on http://localhost:3000 asking /v1/models got a 404 to its
preflight and no Access-Control-Allow-Origin, so the browser hid every
answer. Settings › Network › Web pages now takes origins (cleaned to
scheme://host[:port]; "*" and anything that isn't an origin are refused,
said in the page's language). For a listed origin corsGuard answers the
preflight (204, the asked header names, Private Network Access) and adds
Access-Control-Allow-Origin; every other request from it needs an enabled
gateway key, even from loopback, or gets a readable 401. Default: none
listed, and a request with any other Origin or none (every agent's) is
unchanged. A save of the rest of the Settings page keeps the list.
Verified: TestCORSOrigins (gateway, loopback requests: preflight, keyed
calls, keyless/managed-token/turned-off key refused, unlisted origins incl.
"null" and port/scheme variants get nothing, agents untouched) fails
without corsGuard in Handler (preflight 404); TestCleanOrigins;
TestCORSOriginsSetting fails without keeping CORSOrigins in POST
/api/settings; TestSettingsSaveKeepsWhatItDoesNotSend. GUI
cors-origins.test.cjs (en/zh, 440px, add by button and Enter, refusals,
remove, no scroll, no left border) in Chromium and WebKit fails without
renderCORS; gui-ja, gui-de, i18n-keys, gateway-port, lan-docker,
redact-rule-row, settings-* pass in both. go test -tags nogui ./... green;
-race -count=5 on the new tests; darwin, linux nogui, windows builds.
click-scroll's two Requests-page subtests fail the same on origin/main.
yetone
b234507842