feat(core): add allowedHosts to open-slide.config.ts

[ridemountainpig]

Closes #334

What

Adds allowedHosts to open-slide.config.ts, passed straight to Vite's server.allowedHosts:

const config: OpenSlideConfig = {
  allowedHosts: ['.my-workspace.example.com'], // or `true` to allow any host
};

Remote IDEs (Coder, Codespaces, Gitpod, …) reach the dev server through a generated proxy domain, and Vite blocks those requests with Blocked request. This host is not allowed. Since open-slide owns the Vite config, users had no way to allow their domain.

Why a config field instead of the proposed CLI flag

The issue proposed --allow-all-hosts. A config field covers the same need with two upsides: the workspace domain is a property of the environment, so it belongs in the config rather than on every invocation, and string[] lets users allow just their own domain instead of disabling host checking entirely (true still works for that). Happy to add the flag on top if you'd prefer both.

No change when the field is unset — Vite's default protection stays as is. open-slide preview picks it up too, since Vite's preview.allowedHosts defaults to server.allowedHosts.

Docs updated: schema + a "Remote IDE / proxied dev server" recipe in the config reference, and a pointer from the dev CLI page.

Testing

Verified end-to-end against the demo app (curl with a spoofed Host header):

Config	Coder-style host	Other host	localhost
unset (baseline)	403 Blocked	403	200
allowedHosts: true	200	200	200
allowedHosts: ['.domain.tld']	200	403	200

pnpm typecheck, pnpm check, and pnpm test (305 tests) all pass.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added optional allowedHosts configuration for development and preview servers.
  • Supports specifying permitted hostnames or allowing all hosts.
  • Improved compatibility with reverse proxies, Codespaces, Coder, and other remote development environments.

• Documentation

  • Added configuration guidance and troubleshooting steps for blocked-host errors.
  • Included examples for hostname patterns and unrestricted host access.

[vercel]

@ridemountainpig is attempting to deploy a commit to the open-slide Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Walkthrough

Adds optional allowedHosts support to OpenSlide configuration, forwards it to Vite when specified, documents proxied development-server usage, and records a minor core package release.

Changes

Allowed hosts configuration

Layer / File(s)	Summary
Configuration contract and Vite wiring packages/core/src/config.ts, packages/core/src/vite/config.ts	Adds allowedHosts?: string[] | true and conditionally maps it to Vite’s server.allowedHosts.
Documentation and release metadata apps/web/content/docs/reference/config.mdx, apps/web/content/docs/cli/dev.mdx, .changeset/allowed-hosts-config.md	Documents hostname lists, wildcard usage, true, proxied-server setup, and the core package minor release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant UserConfig
  participant createViteConfig
  participant ViteDevServer
  UserConfig->>createViteConfig: allowedHosts
  createViteConfig->>ViteDevServer: server.allowedHosts
  ViteDevServer->>ViteDevServer: Allow configured host

Loading

Suggested reviewers: 1weiho

Poem

A rabbit hops through hosts allowed,
Past proxy gates where errors howled.
Config lists names—or welcomes all,
Vite now hears the hopping call.
“No blocked requests!” we cheer and sprawl.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding allowedHosts to open-slide.config.ts.
Linked Issues check	✅ Passed	The PR adds allowedHosts and forwards it to Vite server.allowedHosts, covering the requested true/allowlist behavior for dev.
Out of Scope Changes check	✅ Passed	The docs and changeset support the new config feature and do not appear unrelated to the requested change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.changeset/allowed-hosts-config.md:
- Line 5: Update the changeset description in allowed-hosts-config.md to use
present-tense wording by changing “Add” to “Adds,” without altering the rest of
the description.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 842f2e0d-909c-487f-97b4-1abf19e1a849

📥 Commits

Reviewing files that changed from the base of the PR and between e850d8e and fdf9bb6.

📒 Files selected for processing (5)

• .changeset/allowed-hosts-config.md
• apps/web/content/docs/cli/dev.mdx
• apps/web/content/docs/reference/config.mdx
• packages/core/src/config.ts
• packages/core/src/vite/config.ts

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use present tense in the changeset description.

Change “Add” to “Adds” to follow the repository’s changeset wording rule.

Proposed fix

-Add `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.
+Adds `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Add `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.
	Adds `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.changeset/allowed-hosts-config.md at line 5, Update the changeset
description in allowed-hosts-config.md to use present-tense wording by changing
“Add” to “Adds,” without altering the rest of the description.

Source: Coding guidelines