[ryubyte]

Closes #8.

Problem

Browser-based A2A clients (Flutter Web, plain fetch()) can't call the inbound endpoint: no CORS headers are sent, and OPTIONS preflight falls into the 405 branch — so the browser refuses the real request even though curl/native clients work. There's also a latent SSE bug (below).

Approach: explicit origin allowlist, not a wildcard default

The original report (#8) suggested defaulting corsOrigin to '*', arguing it's safe because inbound is gated by the Bearer authToken. That reasoning only holds when a token is set — but authToken is optional and off by default. A '*' default would mean: on the common no-auth local setup, any website the user visits could drive their local agent cross-origin. Today the missing CORS is what blocks that. So this PR takes the safer shape:

• New corsOrigins?: string[] server config (persisted to a2a.json).
  • Empty/absent = no CORS (default) — cross-origin browser calls stay blocked, exactly as before.
  • Each request's Origin is matched against the list; a hit echoes that exact origin back with Vary: Origin; a miss sends no CORS headers.
  • The literal ["*"] opts into a wildcard (logged as a warning) for fully-trusted local setups.
  • Credentials are never allowed (auth is a Bearer header, not a cookie), so no CSRF surface even with *.
• Answer OPTIONS before routing and stamp resolved CORS on every response (AgentCard, JSON-RPC, SSE, 405, 401). The allowlist is read per-request from a mutable closure, so UI/config changes take effect live without a route rebuild.
• Settings-panel editor ("对外服务" tab): add/remove allowed origins as chips, with a warning banner when * is set. New set-server-cors control action + setServerCors hook; serverStatus reports the current allowlist.
• Fix a latent SSE bug: the success path called res.write() (via the onEvent callback) before res.writeHead(), so Node auto-flushed default headers and the stream never got content-type: text/event-stream or CORS. Auth is now checked up front (new public A2AServer.checkAuth), then stream headers are written before the first frame.

Testing

• npm run typecheck + npm test (46) + client-bundle smoke — all green.

• Verified live on dsh 0.1.7-rc.2 (server-mode instance):

  Scenario	Result
  Empty allowlist (default), any Origin	no Access-Control-* on OPTIONS/GET/POST — browser blocks ✅
  Allowlist [http://127.0.0.1:8080], matching Origin	Access-Control-Allow-Origin: http://127.0.0.1:8080 + Vary: Origin ✅
  Same allowlist, non-matching Origin (evil.com)	no CORS headers → blocked ✅
  ["*"], arbitrary Origin	echoes caller origin + Vary: Origin; warning logged ✅
  SSE (SendStreamingMessage)	content-type: text/event-stream + cache-control: no-cache + CORS, before first frame ✅
  Set via settings UI / API	applies live (no restart) and persists to a2a.json ✅

Notes

• The dashboard API (/a2a/api) stays loopback/same-origin only — no CORS there.
• Credit to the Inbound A2A endpoint has no CORS support — browser-based A2A clients (e.g. Flutter Web apps) cannot call SendMessage/AgentCard #8 reporter for the diagnosis and the SSE-ordering catch; this PR adopts the fix but hardens the default from * to an opt-in allowlist.