On loopback a call needs no key and the body's Content-Type isn't
checked, so any page the user visited could send a "simple" text/plain
POST to 127.0.0.1:3425 and spend their subscriptions without reading the
reply. corsGuard now refuses a request whose Origin is an http(s) origin
that is not on Settings → Network and sharing → Web pages, not loopback
(localhost, *.localhost, 127.0.0.0/8, [::1], any port) and not the
request's own (host:port equal to Host). usemagpie.ai still reads
/v1/magpie/omarchy. No Origin (agents), "null" and non-http schemes
(app://, file://, tauri://, vscode-webview://, chrome-extension://) pass
as before: those clients could only call before by not enforcing CORS,
and no web page can send those origins. Such a page never read a reply
before (no CORS headers), so nothing that worked is refused.
Verified: TestForeignPagesRefused (text/plain POSTs from https://evil.example
and other foreign origins on every route family: /v1/chat/completions,
/v1/responses, /v1/messages, count_tokens, /v1/systemone, /v1beta,
/v1/embeddings, /v1/rerank, images, videos, the Codex backend path, /mcp,
/_magpie/claude-mcp, /v1/magpie/*, /v1/models, the GET /v1/responses
upgrade, OPTIONS; loopback, *.localhost, listed with a key, same-origin
on a LAN address through lanGuard, no Origin, null, app://, file://,
tauri://, vscode-webview://, chrome-extension:// answered) fails without
the change (120 routes answered, the fake vendor reached 139 times).
go test -tags nogui ./... green; -race -count=10 on the CORS tests;
darwin, linux nogui and windows builds. The built binary served from a
sandbox HOME on 127.0.0.1:3591: curl from the foreign origins got 403 on
every route with the vendor untouched; the allowed origins got 200.
yetone
d5468283bb