样式修改

offline-backend-20260512/backend/CLAUDE.md

@@ -942,6 +942,14 @@ make gateway
 Direct access (without nginx):
 - Gateway: `http://localhost:8001`
 
+### Browser CORS
+
+The Gateway always permits the local TaskCOP/Vite origins
+`http://localhost:8080` and `http://127.0.0.1:8080` with credentials. A
+deployed frontend on another origin must be listed exactly in
+`GATEWAY_CORS_ORIGINS` (for example `http://47.88.25.99:7010`); those explicit
+origins are merged with the local TaskCOP origins.
+
 ### Frontend Configuration
 
 The frontend uses environment variables to connect to backend services:

offline-backend-20260512/backend/README.md

@@ -285,6 +285,14 @@ Provider note:
 - `models[*].use` references provider classes by module path (for example `langchain_openai:ChatOpenAI`).
 - If a provider module is missing, DeerFlow now returns an actionable error with install guidance (for example `uv add langchain-google-genai`).
 
+### Browser CORS
+
+The Gateway permits the local TaskCOP/Vite development origins
+`http://localhost:8080` and `http://127.0.0.1:8080` with credentials. For a
+separate deployed frontend, set `GATEWAY_CORS_ORIGINS` to its exact origin
+(including scheme and port), for example `http://47.88.25.99:7010`. Explicit
+origins are used in addition to the local TaskCOP development origins.
+
 ### Extensions Configuration (`extensions_config.json`)
 
 MCP servers and skill states in a single file:

offline-backend-20260512/backend/app/gateway/app.py

@@ -1328,8 +1328,18 @@ This gateway provides custom endpoints for models, MCP configuration, skills, an
         v = os.environ.get("GATEWAY_CORS_ALLOW_ALL", "").strip().lower()
         return v in ("1", "true", "yes", "on") or is_auth_disabled()
 
-    cors_origins_env = os.environ.get("GATEWAY_CORS_ORIGINS", "").strip()
-    cors_origins: list[str] = [o.strip() for o in cors_origins_env.split(",") if o.strip()] if cors_origins_env else []
+    # The legacy TaskCOP Vue application uses Vite's default development port.
+    # Keep these origins available even when deployments configure additional
+    # origins through GATEWAY_CORS_ORIGINS.
+    taskcop_vite_origins = [
+        "http://localhost:8080",
+        "http://127.0.0.1:8080",
+    ]
+
+    cors_origins_env = os.environ.get("GATEWAY_CORS_ORIGINS", "").strip()
+    cors_origins: list[str] = [o.strip() for o in cors_origins_env.split(",") if o.strip()] if cors_origins_env else []
+    if cors_origins:
+        cors_origins = list(dict.fromkeys([*cors_origins, *taskcop_vite_origins]))
 
     # Headers the LangGraph SDK / browser clients need to read from cross-origin
     # responses. Without exposing them, the SDK's `response.headers.get(...)` returns
@@ -1382,9 +1392,10 @@ This gateway provides custom endpoints for models, MCP configuration, skills, an
             "http://127.0.0.1:5173",
             "http://localhost:5174",
             "http://127.0.0.1:5174",
-            "http://localhost:3000",
-            "http://127.0.0.1:3000",
-        ]
+            "http://localhost:3000",
+            "http://127.0.0.1:3000",
+            *taskcop_vite_origins,
+        ]
         logger.warning(
             "No CORS configuration found; enabling local dev origins only: %s. "
             "Set GATEWAY_CORS_ORIGINS or GATEWAY_CORS_ALLOW_ALL for deployment.",