From 8de74a96d1350965911c7c63a1ff843da7a604dc Mon Sep 17 00:00:00 2001
From: bvn13 <from.github@bvn13.me>
Date: Sun, 20 Sep 2026 12:43:01 +0300
Subject: [PATCH] chore: bump both submodules and let the proxy wrapper allow a
 published host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cloudcli moves to d12813e1, which carries the fix this workspace was missing:
PluginsProvider and TasksSettingsProvider sit above ProtectedRoute and fetched
exactly once, on mount, so in a browser holding no token yet the request landed
on the login screen, came back 401, and nothing asked again — the whole session
then ran with an empty plugin list and no Tasks section until a reload.
plugin-taskwork moves to fdae5240, which keeps a task draft that loses focus.

dev-host-proxy.sh gains ALLOWED_HOST. Publishing the dev host under a name
rather than localhost — a port forward, a reverse proxy — otherwise ends at
Vite's "Blocked request. This host is not allowed.". The value goes into the
variable Vite reads for exactly this, so vite.config.js needs no local patch,
and leaving ALLOWED_HOST unset passes an empty string, which Vite ignores.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 cloudcli                  |  2 +-
 plugin-taskwork           |  2 +-
 scripts/dev-host-proxy.sh | 12 ++++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/cloudcli b/cloudcli
index 25ad334..d12813e 160000
--- a/cloudcli
+++ b/cloudcli
@@ -1 +1 @@
-Subproject commit 25ad3342d3843aae51e76cde5588a7b594341a53
+Subproject commit d12813e1253f2075f50a375f00d245f82f214c43
diff --git a/plugin-taskwork b/plugin-taskwork
index cadd21e..fdae524 160000
--- a/plugin-taskwork
+++ b/plugin-taskwork
@@ -1 +1 @@
-Subproject commit cadd21e8fed0237575f873d5f2abca8a01356163
+Subproject commit fdae5240077e0c014f17ef50eb38b0b6748b63e7
diff --git a/scripts/dev-host-proxy.sh b/scripts/dev-host-proxy.sh
index e47b19d..756a97c 100755
--- a/scripts/dev-host-proxy.sh
+++ b/scripts/dev-host-proxy.sh
@@ -13,8 +13,20 @@ export http_proxy="$HTTP_PROXY"
 export https_proxy="$HTTPS_PROXY"
 export no_proxy="$NO_PROXY"
 
+# Reaching the host through a name rather than localhost — publishing it behind
+# a port forward or a reverse proxy — needs that name allowed: Vite answers
+# "Blocked request. This host is not allowed." to every other Host header.
+#
+# ALLOWED_HOST carries it. The variable Vite reads is its own escape hatch: it
+# appends the value to server.allowedHosts, so cloudcli/vite.config.js stays
+# untouched. One name per run — the value is appended whole, commas are not
+# split. Unset means an empty string, which Vite ignores, so leaving it alone
+# keeps the default localhost-only behaviour.
+export __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS="${ALLOWED_HOST:-}"
+
 echo "-------"
 echo "HTTP_PROXY=${HTTP_PROXY}"
+echo "ALLOWED_HOST=${ALLOWED_HOST:-(none, localhost only)}"
 echo "-------"