Bug: Launch Backend fails due to CORS / Private Network Access restriction

[hynady]

Bug: Launch Backend fails due to CORS / Private Network Access restriction

Description

When clicking "Launch Backend" on the Opencode Studio web application, the backend fails to start because the browser blocks requests from the hosted frontend to the local backend service.

Frontend URL:

https://opencode-studio.micr.dev/

Backend URL:

http://127.0.0.1:1920/

Steps to Reproduce

1. Open https://opencode-studio.micr.dev/
2. Click Launch Backend
3. Wait for the frontend to check backend availability
4. Observe the browser console

Actual Result

The request to the local backend is blocked by the browser:

GET http://127.0.0.1:1920/api/health net::ERR_FAILED

Access to fetch at 'http://127.0.0.1:1920/api/health'
from origin 'https://opencode-studio.micr.dev'
has been blocked by CORS policy:
Request had a target IP address space of `local`
yet the resource is in address space `loopback`.

Expected Result

The frontend should be able to successfully communicate with the local backend and complete the backend launch flow.

Additional Information

The backend health endpoint appears to be reachable directly:

curl http://127.0.0.1:1920/api/health

returns:

{
  "status": "ok"
}

Relevant response headers:

Access-Control-Allow-Credentials: true
Vary: Origin

This appears to be related to Chrome's Private Network Access (PNA) / address space restrictions when a public HTTPS origin (https://opencode-studio.micr.dev) attempts to access a loopback address (127.0.0.1).

Browser version: Chrome 148

Backend version:

opencode --version
1.17.7

Console Log

GET http://127.0.0.1:1920/api/health net::ERR_FAILED

Access to fetch at 'http://127.0.0.1:1920/api/health'
from origin 'https://opencode-studio.micr.dev'
has been blocked by CORS policy:
Request had a target IP address space of `local`
yet the resource is in address space `loopback`.