From 60fb9d23084522a4dd27dd792d2edb6aa4536485 Mon Sep 17 00:00:00 2001
From: Epheien <3406908+epheien@users.noreply.github.com>
Date: Mon, 17 Aug 2026 06:38:41 -0400
Subject: [PATCH] fix: allow LAN access to the dev server

Next 16 blocks cross-origin access to dev resources by default; the old
allowedDevOrigins only covered 127.0.0.1 and 192.168.*.*, so visiting the
dev server from a 10.x LAN address returned 403 on every /_next chunk and
the HMR websocket. Allow loopback and the RFC1918 LAN ranges (10/8,
172.16/12, 192.168/16) so the dev server stays reachable from other
machines on the same LAN.
---
 next.config.ts | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/next.config.ts b/next.config.ts
index 24322cbbc..f443bdd00 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -20,7 +20,31 @@ const nextConfig: NextConfig = {
     "@earendil-works/pi-ai",
     "@earendil-works/pi-tui",
   ],
-  allowedDevOrigins: ["127.0.0.1", "192.168.*.*"],
+  // Next 16 blocks cross-origin access to dev resources by default. Allow the
+  // loopback and the RFC1918 LAN ranges so the dev server stays reachable
+  // from other machines on the same LAN.
+  allowedDevOrigins: [
+    "127.0.0.1",
+    "10.*.*.*",
+    // 172.16.0.0/12
+    "172.16.*.*",
+    "172.17.*.*",
+    "172.18.*.*",
+    "172.19.*.*",
+    "172.20.*.*",
+    "172.21.*.*",
+    "172.22.*.*",
+    "172.23.*.*",
+    "172.24.*.*",
+    "172.25.*.*",
+    "172.26.*.*",
+    "172.27.*.*",
+    "172.28.*.*",
+    "172.29.*.*",
+    "172.30.*.*",
+    "172.31.*.*",
+    "192.168.*.*",
+  ],
   async headers() {
     return [
       {