fix: 修复 OpenCode 运行时启动与本地打包

tests/unit/route-utils.test.ts

@@ -0,0 +1,53 @@
+import type { ServerResponse } from 'node:http';
+import { describe, expect, it, vi } from 'vitest';
+import { setCorsHeaders } from '@electron/api/route-utils';
+
+describe('Host API CORS', () => {
+  it('allows only the current dynamic OpenCode runtime origin', () => {
+    const setHeader = vi.fn();
+    const response = { setHeader } as unknown as ServerResponse;
+
+    setCorsHeaders(
+      response,
+      'http://127.0.0.1:54721',
+      'http://127.0.0.1:54721',
+    );
+
+    expect(setHeader).toHaveBeenCalledWith(
+      'Access-Control-Allow-Origin',
+      'http://127.0.0.1:54721',
+    );
+  });
+
+  it('does not allow another loopback port when the runtime uses a dynamic port', () => {
+    const setHeader = vi.fn();
+    const response = { setHeader } as unknown as ServerResponse;
+
+    setCorsHeaders(
+      response,
+      'http://127.0.0.1:54722',
+      'http://127.0.0.1:54721',
+    );
+
+    expect(setHeader).not.toHaveBeenCalledWith(
+      'Access-Control-Allow-Origin',
+      expect.anything(),
+    );
+  });
+
+  it('does not retain the preferred runtime port after falling back dynamically', () => {
+    const setHeader = vi.fn();
+    const response = { setHeader } as unknown as ServerResponse;
+
+    setCorsHeaders(
+      response,
+      'http://127.0.0.1:4096',
+      'http://127.0.0.1:54721',
+    );
+
+    expect(setHeader).not.toHaveBeenCalledWith(
+      'Access-Control-Allow-Origin',
+      expect.anything(),
+    );
+  });
+});