fix: v0.1.4: allow_headers wildcard — Open WebUI's tool layer sends X-Session-Id

app/main.py

@@ -1,4 +1,4 @@
-"""coreci-executor v0.1.3 — governed write rail (Design v1.0, approved 2026-10-03).
+"""coreci-executor v0.1.4 — governed write rail (Design v1.0, approved 2026-10-03).
 
 Tool endpoints (Authorization: Bearer <EXECUTOR_API_KEY> or X-Executor-Key):
   POST /submit_request   {agent, kind, targets[], content, justification}
@@ -12,6 +12,8 @@ Audit: JSONL to logs/ (+ optional Discord webhook). Secrets stay in env.
 
 v0.1.2: CORS for browser-origin schema fetch; Bearer auth support (Open WebUI).
 v0.1.3: never-500 login; OpenAPI securitySchemes (Swagger Authorize button).
+v0.1.4: allow_headers wildcard — Open WebUI's tool layer sends X-Session-Id
+        (and possibly other headers); the strict list 400'd the CORS preflight.
 """
 import hashlib
 import json
@@ -50,12 +52,12 @@ TIMEOUT_S      = int(ENV.get("REQUEST_TIMEOUT_S", "900"))
 COOKIE_NAME    = "exec_session"
 CRED_RE        = re.compile(r"https?://[^/\s@]+:[^@\s]+@")
 
-app = FastAPI(title="coreci-executor", version="0.1.3")
+app = FastAPI(title="coreci-executor", version="0.1.4")
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["https://chat.coreci.dev"],  # add other origins you use for Open WebUI here
     allow_methods=["GET", "POST", "OPTIONS"],
-    allow_headers=["Authorization", "Content-Type", "X-Executor-Key"],
+    allow_headers=["*"],  # v0.1.4: Open WebUI tool calls carry X-Session-Id; strict lists 400 the preflight
 )
 
 REQS: dict[str, dict] = {}
@@ -137,7 +139,7 @@ def page(title: str, body: str) -> str:
 
 @app.get("/health")
 def health():
-    return {"status": "ok", "version": "0.1.3", "requests": len(REQS)}
+    return {"status": "ok", "version": "0.1.4", "requests": len(REQS)}
 
 @app.post("/submit_request")
 async def submit(request: Request):
@@ -173,7 +175,7 @@ def status(request_id: str, request: Request):
         raise HTTPException(401, "unauthorized")
     r = get_req(request_id)
     return {k: r.get(k) for k in ("id", "agent", "kind", "targets", "decision",
-                                  "status", "exit_code", "output", "submitted_at", "finished_at")}
+                                 "status", "exit_code", "output", "submitted_at", "finished_at")}
 
 @app.get("/")
 def root(request: Request):