fix: 修复 OpenCode 运行时启动与本地打包

electron/api/route-utils.ts

@@ -8,8 +8,6 @@ import { PORTS } from '../utils/config';
 const ALLOWED_ORIGINS = new Set([
   `http://127.0.0.1:${PORTS.NIANCODE_DEV}`,
   `http://localhost:${PORTS.NIANCODE_DEV}`,
-  `http://127.0.0.1:${PORTS.OPENCODE_RUNTIME}`,
-  `http://localhost:${PORTS.OPENCODE_RUNTIME}`,
 ]);
 
 export async function parseJsonBody<T>(req: IncomingMessage): Promise<T> {
@@ -43,11 +41,23 @@ export function requireJsonContentType(req: IncomingMessage): boolean {
   return ct.includes('application/json');
 }
 
-export function setCorsHeaders(res: ServerResponse, origin?: string): void {
+export function setCorsHeaders(
+  res: ServerResponse,
+  origin?: string,
+  runtimeUrl?: string,
+): void {
   // Only reflect the Origin header back if it is in the allow-list.
   // Omitting the header for unknown origins causes the browser to block
   // the response — this is the intended behavior for untrusted callers.
-  if (origin && ALLOWED_ORIGINS.has(origin)) {
+  let runtimeOrigin: string | null = null;
+  if (runtimeUrl) {
+    try {
+      runtimeOrigin = new URL(runtimeUrl).origin;
+    } catch {
+      runtimeOrigin = null;
+    }
+  }
+  if (origin && (ALLOWED_ORIGINS.has(origin) || origin === runtimeOrigin)) {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Vary', 'Origin');
   }

electron/api/routes/opencode.ts

@@ -1770,7 +1770,7 @@ export async function handleOpencodeRoutes(
   if (url.pathname === '/api/opencode/stop' && req.method === 'POST') {
     try {
       await ctx.opencodeManager.stop();
-      sendJson(res, 200, { success: true });
+      sendJson(res, 200, { success: true, status: ctx.opencodeManager.getStatus() });
     } catch (error) {
       sendJson(res, 500, { success: false, error: String(error) });
     }

electron/api/server.ts

@@ -76,7 +76,7 @@ export function startHostApiServer(ctx: HostApiContext, port = getPort('NIANCODE
       // Set origin-aware CORS headers early so every response
       // (including error responses) carries them consistently.
       const origin = req.headers.origin;
-      setCorsHeaders(res, origin);
+      setCorsHeaders(res, origin, ctx.opencodeManager.getStatus().url);
 
       // CORS preflight — respond before auth so browsers can negotiate.
       if (req.method === 'OPTIONS') {