From 8418d2535bb764724a23c3a525ee4774c3414c16 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Sun, 5 Jul 2026 10:42:08 +0800 Subject: [PATCH] allowlist CMS registry browse/detail fetch() to orchestrator endpoints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CMS registry browse tab and new Phase-5 detail view call the orchestrator's public Connect endpoints (PluginRegistryService / PluginReviewService) on a different origin. The CMS transport and generated hooks only cover the CMS's own proto surface, so these are plain JSON POSTs to the registry URL — same rationale routes/admin/plugins.tsx carried before the BrowseRegistryTab extraction. Co-Authored-By: Claude Fable 5 --- frontend.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/frontend.go b/frontend.go index 2ec71ae..f87d7e5 100644 --- a/frontend.go +++ b/frontend.go @@ -47,6 +47,14 @@ var allowedFrontendFiles = map[string]bool{ // with `for await` — generated Connect Query hooks are unary-only and // cannot express a streaming turn (same reason as use-restart-operation). "components/site-agent/use-site-agent-stream.ts": true, + + // Registry browse/detail call the ORCHESTRATOR's public Connect endpoints + // (PluginRegistryService/PluginReviewService) on a different origin. The + // CMS transport and generated hooks only cover the CMS's own proto surface, + // so these are plain JSON POSTs to the registry URL from GetAuthConfig + // (same reason routes/admin/plugins.tsx carried before the extraction). + "components/plugins/browse-registry-tab.tsx": true, + "components/plugins/registry-detail.tsx": true, } // Plugin web files that are allowed to call plugin-owned REST handlers because