fix: 修复 OpenCode 运行时启动与本地打包

electron/api/route-utils.ts

@@ -8,8 +8,6 @@ import { PORTS } from '../utils/config';
 const ALLOWED_ORIGINS = new Set([
   `http://127.0.0.1:${PORTS.NIANCODE_DEV}`,
   `http://localhost:${PORTS.NIANCODE_DEV}`,
-  `http://127.0.0.1:${PORTS.OPENCODE_RUNTIME}`,
-  `http://localhost:${PORTS.OPENCODE_RUNTIME}`,
 ]);
 
 export async function parseJsonBody<T>(req: IncomingMessage): Promise<T> {
@@ -43,11 +41,23 @@ export function requireJsonContentType(req: IncomingMessage): boolean {
   return ct.includes('application/json');
 }
 
-export function setCorsHeaders(res: ServerResponse, origin?: string): void {
+export function setCorsHeaders(
+  res: ServerResponse,
+  origin?: string,
+  runtimeUrl?: string,
+): void {
   // Only reflect the Origin header back if it is in the allow-list.
   // Omitting the header for unknown origins causes the browser to block
   // the response — this is the intended behavior for untrusted callers.
-  if (origin && ALLOWED_ORIGINS.has(origin)) {
+  let runtimeOrigin: string | null = null;
+  if (runtimeUrl) {
+    try {
+      runtimeOrigin = new URL(runtimeUrl).origin;
+    } catch {
+      runtimeOrigin = null;
+    }
+  }
+  if (origin && (ALLOWED_ORIGINS.has(origin) || origin === runtimeOrigin)) {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Vary', 'Origin');
   }