fix(svos-front): kernel seat-host calls allowed on the terminal origin (app-terminal base_url reverted to it)

2026-10-12 09:44:06 -07:00
parent ca9e385316
commit 82987828f8
1 changed files with 10 additions and 1 deletions
@@ -168,7 +168,7 @@ https://svos-terminal.phasefinal.com:443 {

 		# The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused.
 		@not_from_box {
-			path /verbs/* /health
+			path /verbs/* /health /seats/*
 			not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1
 		}
 		handle @not_from_box {
@@ -211,6 +211,15 @@ https://svos-terminal.phasefinal.com:443 {
 		handle @health {
 			import svos_terminal_upstream
 		}
+		# U13 fix (2026-10-12): app-terminal's registry base_url is this origin again (browsers frame panes from it),
+		# so the kernel's signed seat-host calls (U5b) come through here too, from the box only (@not_from_box above).
+		@seat_host {
+			method POST
+			path /seats/observe /seats/check /seats/launch /seats/retire-launch
+		}
+		handle @seat_host {
+			import svos_terminal_upstream
+		}
 		handle {
 			respond 404
 		}