feat(core): add allowedHosts to open-slide.config.ts

[ridemountainpig]

Closes #334

What

Adds allowedHosts to open-slide.config.ts, passed straight to Vite's server.allowedHosts:

const config: OpenSlideConfig = {
  allowedHosts: ['.my-workspace.example.com'], // or `true` to allow any host
};

Remote IDEs (Coder, Codespaces, Gitpod, …) reach the dev server through a generated proxy domain, and Vite blocks those requests with Blocked request. This host is not allowed. Since open-slide owns the Vite config, users had no way to allow their domain.

Why a config field instead of the proposed CLI flag

The issue proposed --allow-all-hosts. A config field covers the same need with two upsides: the workspace domain is a property of the environment, so it belongs in the config rather than on every invocation, and string[] lets users allow just their own domain instead of disabling host checking entirely (true still works for that). Happy to add the flag on top if you'd prefer both.

No change when the field is unset — Vite's default protection stays as is. open-slide preview picks it up too, since Vite's preview.allowedHosts defaults to server.allowedHosts.

Docs updated: schema + a "Remote IDE / proxied dev server" recipe in the config reference, and a pointer from the dev CLI page.

Testing

Verified end-to-end against the demo app (curl with a spoofed Host header):

Config	Coder-style host	Other host	localhost
unset (baseline)	403 Blocked	403	200
allowedHosts: true	200	200	200
allowedHosts: ['.domain.tld']	200	403	200

pnpm typecheck, pnpm check, and pnpm test (305 tests) all pass.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added optional allowedHosts configuration for development and preview servers.
  • Supports specifying permitted hostnames or allowing all hosts.
  • Improved compatibility with reverse proxies and remote development environments.

• Documentation

  • Added guidance for resolving blocked-host errors.
  • Included examples for hostname patterns and unrestricted host access.

[vercel]

@ridemountainpig is attempting to deploy a commit to the open-slide Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f4cff3c4-fd7b-4555-ad14-13e40093d8ec

📥 Commits

Reviewing files that changed from the base of the PR and between fdf9bb6 and c9a4ac4.

📒 Files selected for processing (1)

• apps/web/content/docs/reference/config.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

• apps/web/content/docs/reference/config.mdx

---

Walkthrough

Adds optional allowedHosts support to OpenSlide configuration, forwards it to Vite when specified, documents proxied development-server usage, and records a minor core package release.

Changes

Allowed hosts configuration

Layer / File(s)	Summary
Configuration contract and Vite wiring packages/core/src/config.ts, packages/core/src/vite/config.ts	Adds allowedHosts?: string[] | true and conditionally maps it to Vite’s server.allowedHosts.
Documentation and release metadata apps/web/content/docs/reference/config.mdx, apps/web/content/docs/cli/dev.mdx, .changeset/allowed-hosts-config.md	Documents hostname lists, wildcard usage, true, proxied-server setup, preview behavior, and the core package minor release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant UserConfig
  participant createViteConfig
  participant ViteDevServer
  UserConfig->>createViteConfig: allowedHosts
  createViteConfig->>ViteDevServer: server.allowedHosts
  ViteDevServer->>ViteDevServer: Allow configured host

Loading

Poem

A rabbit checks the host list bright,
Then sends it to Vite for the night.
Proxy names pass the gate,
Wildcards open when set to true,
And blocked requests take flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding allowedHosts to open-slide.config.ts.
Linked Issues check	✅ Passed	The PR satisfies issue #334 by exposing Vite server.allowedHosts through configuration, including true for all hosts and specific host allowlists.
Out of Scope Changes check	✅ Passed	The code, schema, documentation, and changeset updates directly support the allowedHosts feature and issue #334.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.changeset/allowed-hosts-config.md:
- Line 5: Update the changeset description in allowed-hosts-config.md to use
present-tense wording by changing “Add” to “Adds,” without altering the rest of
the description.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 842f2e0d-909c-487f-97b4-1abf19e1a849

📥 Commits

Reviewing files that changed from the base of the PR and between e850d8e and fdf9bb6.

📒 Files selected for processing (5)

• .changeset/allowed-hosts-config.md
• apps/web/content/docs/cli/dev.mdx
• apps/web/content/docs/reference/config.mdx
• packages/core/src/config.ts
• packages/core/src/vite/config.ts

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use present tense in the changeset description.

Change “Add” to “Adds” to follow the repository’s changeset wording rule.

Proposed fix

-Add `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.
+Adds `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Add `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.
	Adds `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.changeset/allowed-hosts-config.md at line 5, Update the changeset
description in allowed-hosts-config.md to use present-tense wording by changing
“Add” to “Adds,” without altering the rest of the description.

Source: Coding guidelines

[1weiho]

@ridemountainpig Hey Yen 👋🏻
Thanks for the contribution, LGTM!