From f93254e3b83b11ac052a9d039dd1b006bd80abfe Mon Sep 17 00:00:00 2001
From: OpenClaw <gahr.coding@gmail.com>
Date: Tue, 7 Apr 2026 17:40:39 +0530
Subject: [PATCH] fix: add Private Network Access header for Chromium bridge
 mode

---
 gitnexus/src/server/api.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gitnexus/src/server/api.ts b/gitnexus/src/server/api.ts
index 8111c287b..9af070133 100644
--- a/gitnexus/src/server/api.ts
+++ b/gitnexus/src/server/api.ts
@@ -442,6 +442,23 @@ export const createServer = async (port: number, host: string = '127.0.0.1') =>
   );
   app.use(express.json({ limit: '10mb' }));
 
+  // Support Chromium Private Network Access (required since Chrome 130+).
+  // Without this header, Chrome/Edge/Brave/Arc block public->loopback requests
+  // which breaks bridge mode entirely.
+  app.use((_req, res, next) => {
+    res.setHeader('Access-Control-Allow-Private-Network', 'true');
+    next();
+  });
+
+  // Handle PNA preflight: Chromium sends Access-Control-Request-Private-Network
+  // on OPTIONS requests and expects the allow header in the response.
+  app.options('*', (_req, res, next) => {
+    if (_req.headers['access-control-request-private-network'] === 'true') {
+      res.setHeader('Access-Control-Allow-Private-Network', 'true');
+    }
+    next();
+  });
+
   // Initialize MCP backend (multi-repo, shared across all MCP sessions)
   const backend = new LocalBackend();
   await backend.init();