From 0a426c4e164190200576cd48239be15981b19049 Mon Sep 17 00:00:00 2001
From: uncle6me-web <uncle6.me@gmail.com>
Date: Fri, 31 Jul 2026 10:50:57 +0800
Subject: [PATCH] =?UTF-8?q?fix(cypher):=20CORS=20origin=20=E7=A9=BA?=
 =?UTF-8?q?=E5=80=BC=E6=94=BE=E8=A1=8C=E2=80=94=E2=80=94CLI/curl/MCP=20?=
 =?UTF-8?q?=E7=84=A1=20Origin=20=E6=A8=99=E9=A0=AD=E6=99=82=E4=B8=8D?=
 =?UTF-8?q?=E5=86=8D=20500?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cypher-executor/src/index.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/cypher-executor/src/index.ts b/cypher-executor/src/index.ts
index cf6626a..6d7a6bb 100644
--- a/cypher-executor/src/index.ts
+++ b/cypher-executor/src/index.ts
@@ -39,10 +39,15 @@ const STATIC_ORIGINS = ['https://arcrun.dev', 'https://www.arcrun.dev'];
 
 app.use('*', cors({
   origin: (origin, c) => {
-    const extra = (c.env.UI_ORIGINS || '')
-      .split(',')
-      .map((s: string) => s.trim())
-      .filter(Boolean);
+    // ⚠️ 非瀏覽器請求（CLI／curl／MCP）沒有 Origin 標頭 → origin 是空字串/undefined。
+    //    此時必須原樣放行，不能回 null——回 null 會讓 Hono cors 中介層在後續處理拋錯，
+    //    表現為所有 CLI 部署一律 500（2026-07-21 實撞：acr push 全掛，對照組亦然）。
+    if (!origin) return origin;
+    let extra: string[] = [];
+    try {
+      extra = String((c.env as Record<string, unknown>).UI_ORIGINS || '')
+        .split(',').map((s: string) => s.trim()).filter(Boolean);
+    } catch { /* UI_ORIGINS 未設定＝只用靜態白名單 */ }
     return [...STATIC_ORIGINS, ...extra].includes(origin) ? origin : null;
   },
   allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],