core: allow CORS requests from *.opencode.ai subdomains

1 files changed, 16 insertions, 1 deletions

diff --git a/packages/opencode/src/server/server.ts b/packages/opencode/src/server/server.ts
index 5c9a64e17..4277f6c36 100644
--- a/packages/opencode/src/server/server.ts
+++ b/packages/opencode/src/server/server.ts
@@ -104,7 +104,22 @@ export namespace Server {
           timer.stop()
         }
       })
-      .use(cors())
+      .use(
+        cors({
+          origin(input) {
+            if (!input) return
+
+            if (input.startsWith("http://localhost:")) return input
+            if (input.startsWith("http://127.0.0.1:")) return input
+
+            // *.opencode.ai (https only, adjust if needed)
+            if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) {
+              return input
+            }
+            return
+          },
+        }),
+      )
       .get(
         "/global/health",
         describeRoute({