expose Location, X-Request-Id, Idempotency-Key via CORS - #3707
Conversation
…ote even when local setup complete
…ure; synthesize remote reminder only in message layer
…move broken preloaded prompt block
alt-glitch
added
type/feature
teknium1
left a comment
teknium1
left a comment
There was a problem hiding this comment.
Thanks for the browser-CORS improvement. The premise remains valid on current main: _CORS_HEADERS at gateway/platforms/api_server.py:546-549 lacks Access-Control-Expose-Headers, and cors_middleware applies that set to allowed-origin responses at gateway/platforms/api_server.py:554-572. The proposed CORS addition therefore targets the live response path.
Problems
- The PR also changes
agent/skill_commands.py:104-149andagent/skill_commands.py:292-308, which is unrelated to the stated API-server CORS scope. GitHub currently reports the aggregate branch as conflicting. The linked salvage PR #62759 specifically preserves the API-server change while omitting these drive-by skill-command edits.
Suggested changes
- Retain the focused API-server header and test only; handle the skill-command work separately.
Automated hermes-sweeper review.
| @@ -104,7 +104,7 @@ def _build_skill_message( | |||
| f"[Skill setup note: {loaded_skill['gateway_setup_hint']}]", | |||
There was a problem hiding this comment.
This skill-message behavior is unrelated to the PR's stated API-server CORS change. Please keep the CORS salvage focused on gateway/platforms/api_server.py and its test; the mixed scope is what leaves this aggregate branch conflicting.
teknium1
added
sweeper:risk-security-boundary
…e of NousResearch#3707/NousResearch#3712 by @aydnOktay) Rebuilt on latest main (Bartok9 hygiene 2026-08-01). Original: NousResearch#62759
|
Closing to concentrate review on a single linked product bug: #89979. |
3 participants
Enhances browser compatibility by adding Access-Control-Expose-Headers to CORS responses so front-end clients can read common response headers. We expose Location, X-Request-Id, and Idempotency-Key, which are frequently needed for navigation, tracing, and request deduplication. The change is minimal, low risk, and includes a unit test that verifies the exposed headers are present on a simple CORS GET response