fix: executor v0.1.5: allow_origins wildcard — sandbox iframe sends Origin: null

app/main.py

@@ -52,10 +52,10 @@ TIMEOUT_S      = int(ENV.get("REQUEST_TIMEOUT_S", "900"))
 COOKIE_NAME    = "exec_session"
 CRED_RE        = re.compile(r"https?://[^/\s@]+:[^@\s]+@")
 
-app = FastAPI(title="coreci-executor", version="0.1.4")
+app = FastAPI(title="coreci-executor", version="0.1.5")
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["https://chat.coreci.dev"],  # add other origins you use for Open WebUI here
+    allow_origins=["*"],  # add other origins you use for Open WebUI here
     allow_methods=["GET", "POST", "OPTIONS"],
     allow_headers=["*"],  # v0.1.4: Open WebUI tool calls carry X-Session-Id; strict lists 400 the preflight
 )
@@ -139,7 +139,7 @@ def page(title: str, body: str) -> str:
 
 @app.get("/health")
 def health():
-    return {"status": "ok", "version": "0.1.4", "requests": len(REQS)}
+    return {"status": "ok", "version": "0.1.5", "requests": len(REQS)}
 
 @app.post("/submit_request")
 async def submit(request: Request):