From 82987828f8b5f5ab441e7d39d50ab42c482c1e20 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Mon, 12 Oct 2026 09:44:06 -0700 Subject: [PATCH] fix(svos-front): kernel seat-host calls allowed on the terminal origin (app-terminal base_url reverted to it) --- configs/svos-front/Caddyfile | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/configs/svos-front/Caddyfile b/configs/svos-front/Caddyfile index dd19a26..01bb742 100644 --- a/configs/svos-front/Caddyfile +++ b/configs/svos-front/Caddyfile @@ -168,7 +168,7 @@ https://svos-terminal.phasefinal.com:443 { # The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused. @not_from_box { - path /verbs/* /health + path /verbs/* /health /seats/* not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1 } handle @not_from_box { @@ -211,6 +211,15 @@ https://svos-terminal.phasefinal.com:443 { handle @health { import svos_terminal_upstream } + # U13 fix (2026-10-12): app-terminal's registry base_url is this origin again (browsers frame panes from it), + # so the kernel's signed seat-host calls (U5b) come through here too, from the box only (@not_from_box above). + @seat_host { + method POST + path /seats/observe /seats/check /seats/launch /seats/retire-launch + } + handle @seat_host { + import svos_terminal_upstream + } handle { respond 404 }