mirror of
https://github.com/meshtastic/Meshtastic-Android.git
synced 2026-09-12 21:30:02 -04:00
James RichandClaude Opus 5
d31db74c9f
The wasmJs web target cannot reach api.meshtastic.org at all. v1 keeps a hardcoded CORS origin allowlist and answers any request carrying an unrecognised Origin with HTTP 500 and the body "Origin not allowed by CORS". A browser sends Origin on every cross-origin request, and localhost is not on the list, so even local development against v1 fails. Verified: meshtastic.org and flasher.meshtastic.org get 200, client.meshtastic.org and http://localhost:8080 get 500, and the OPTIONS preflight is a 500 too. apiv2.meshtastic.org serves access-control-allow-origin: * and a 204 preflight, so the browser target works without any server-side change. Payload parity was checked endpoint by endpoint before switching. All six endpoints the app consumes return 200 with application/json on both hosts: resource/deviceHardware, resource/deviceLinks, github/firmware/list, resource/eventFirmware, resource/bootloaderOtaQuirks and resource/maintenanceUf2. Four are byte-identical; deviceLinks differs only in its generatedAt stamp with all 213 links identical, and github/firmware/list differs by one transient pull-request entry. Both are CDN cache freshness, not shape. The three maintenance UF2 binaries served under resource/maintenanceUf2/asset/ are byte-identical on both hosts and match the sha256 digests the manifest declares, so the digest-verified flash path is unaffected. The timeout and retry constants are left alone. v2 answered every probe in about 0.2s from a Cloudflare cache HIT, but that is no evidence about a cold MISS, and the generous deadline costs nothing given stale-while-revalidate callers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>