fix: CORS for extension credentialed requests

Updated CORS headers to support credentials from Chrome extensions:
- Added getCorsHeaders() to detect chrome-extension:// origins
- Changed from wildcard Access-Control-Allow-Origin to specific origin
- Added Access-Control-Allow-Credentials: true for credentialed requests
- Updated session endpoint to pass event for CORS header detection

docs/git-history.json

···
 [
   {
+    "hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
+    "short_hash": "bd3aabb",
+    "author": "Ariel M. Lighty",
+    "date": "2025-12-27T22:10:11-05:00",
+    "message": "fix: extension dark mode and build mode messaging\n\n- Changed darkMode from 'class' to 'media' for automatic system preference detection\n- Made server offline message conditional on build mode (dev vs prod)\n- Hide dev server instructions in production builds",
+    "files_changed": 5
+  },
+  {
     "hash": "d07180cd3a19328b82b35118e525b59d4e2e060b",
     "short_hash": "d07180c",
     "author": "Ariel M. Lighty",
···
     "files_changed": 9
   },
   {
-    "hash": "6ac877ee6d1990bdab4ef3b03ac59f4682afe0a5",
-    "short_hash": "6ac877e",
+    "hash": "d07180cd3a19328b82b35118e525b59d4e2e060b",
+    "short_hash": "d07180c",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T16:03:56-05:00",
-    "message": "docs: update decision graph after markdown updates",
-    "files_changed": 2
+    "date": "2025-12-27T18:38:39-05:00",
+    "message": "feat: add Tailwind CSS to extension\n\nReplaced 299 lines of vanilla CSS with Tailwind for design consistency with web app. Production build minified to 13KB.",
+    "files_changed": 9
   },
   {
     "hash": "fe29bb3e5faa0151f63c14724f7509af669860de",
···
     "files_changed": 4
   },
   {
-    "hash": "46bab1202f69d8d03093a20bc8ada5ad6d365401",
-    "short_hash": "46bab12",
+    "hash": "fcf682bb8969aca108262348e7e17531077713be",
+    "short_hash": "fcf682b",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-26T22:10:11-05:00",
-    "message": "docs: update decision graph after Vite optimization",
-    "files_changed": 2
+    "date": "2025-12-27T15:48:44-05:00",
+    "message": "docs: improve decision graph workflow with lifecycle management\n\nUpdated CLAUDE.md with comprehensive node lifecycle management:\n- Added node status transitions (pending → in_progress → completed)\n- Correct orphan detection commands (awk instead of cut)\n- Common mistakes section with examples\n- Enhanced audit checklist with status verification\n- Verification workflow after node creation\n\nAlso updated extension popup with ATmosphere branding.\n\nDecision graph now at 331 nodes, 332 edges - all orphans resolved.",
+    "files_changed": 4
   },
   {
     "hash": "e04934ffb5e2d78791fcd23bc3afeb4d438a5546",

docs/graph-data.json

···
       "created_at": "2025-12-27T22:09:28.843864300-05:00",
       "updated_at": "2025-12-27T22:09:32.017503200-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 359,
+      "change_id": "4a7d5885-1713-4ba7-ad13-bb12b58c9410",
+      "node_type": "outcome",
+      "title": "Committed fixes to git",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:10:25.576235500-05:00",
+      "updated_at": "2025-12-27T22:10:28.961887300-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"commit\":\"bd3aabb\",\"confidence\":95}"
+    },
+    {
+      "id": 360,
+      "change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "node_type": "goal",
+      "title": "Fix extension not detecting login session despite dev server running",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:23:13.072419900-05:00",
+      "updated_at": "2025-12-27T22:41:49.160848100-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90,\"prompt\":\"dark mode is fixed, but the extension in /chrome/ uploaded still is saying login with atlast and dev server is running\"}"
+    },
+    {
+      "id": 361,
+      "change_id": "aecf2327-d20d-4c6c-b6b0-06ccf26a2b27",
+      "node_type": "observation",
+      "title": "Extension dist/chrome contains production build, not dev build. User ran build:prod last.",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:23:45.918832500-05:00",
+      "updated_at": "2025-12-27T22:23:48.919570500-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 362,
+      "change_id": "e897db97-44d8-4993-b4c3-0d829265b2f8",
+      "node_type": "observation",
+      "title": "Dev build now deployed. Extension will check session at http://127.0.0.1:8888/.netlify/functions/session with credentials:include",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:24:17.767230200-05:00",
+      "updated_at": "2025-12-27T22:24:20.981953100-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
+    },
+    {
+      "id": 363,
+      "change_id": "2c62bfa3-d148-4448-8c2b-d0cf1e94ceb0",
+      "node_type": "observation",
+      "title": "Found CORS issue: successResponse uses 'Access-Control-Allow-Origin: *' which blocks credentialed requests from extension",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:24:51.861265800-05:00",
+      "updated_at": "2025-12-27T22:24:55.482724500-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 364,
+      "change_id": "560d6bea-47ec-408d-919b-15ca7198aac9",
+      "node_type": "action",
+      "title": "Updating CORS headers to support credentialed requests from extension",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:25:23.035212700-05:00",
+      "updated_at": "2025-12-27T22:26:03.046221900-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
+    },
+    {
+      "id": 365,
+      "change_id": "3ef0c9e9-aa40-4914-a5f4-32bcfaf68d04",
+      "node_type": "outcome",
+      "title": "Fixed CORS to support credentialed requests from extensions",
+      "description": null,
+      "status": "completed",
+      "created_at": "2025-12-27T22:41:38.430661200-05:00",
+      "updated_at": "2025-12-27T22:41:48.981429600-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     }
   ],
   "edges": [
···
       "weight": 1.0,
       "rationale": "Final outcome of fixes",
       "created_at": "2025-12-27T22:09:30.425884400-05:00"
+    },
+    {
+      "id": 358,
+      "from_node_id": 352,
+      "to_node_id": 359,
+      "from_change_id": "b852ce18-1747-4c26-a65e-acfbbed2b1a5",
+      "to_change_id": "4a7d5885-1713-4ba7-ad13-bb12b58c9410",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Git commit for fixes",
+      "created_at": "2025-12-27T22:10:27.225192300-05:00"
+    },
+    {
+      "id": 359,
+      "from_node_id": 360,
+      "to_node_id": 361,
+      "from_change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "to_change_id": "aecf2327-d20d-4c6c-b6b0-06ccf26a2b27",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Root cause analysis",
+      "created_at": "2025-12-27T22:23:47.445630900-05:00"
+    },
+    {
+      "id": 360,
+      "from_node_id": 360,
+      "to_node_id": 362,
+      "from_change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "to_change_id": "e897db97-44d8-4993-b4c3-0d829265b2f8",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Rebuilt dev version",
+      "created_at": "2025-12-27T22:24:19.438433600-05:00"
+    },
+    {
+      "id": 361,
+      "from_node_id": 360,
+      "to_node_id": 363,
+      "from_change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "to_change_id": "2c62bfa3-d148-4448-8c2b-d0cf1e94ceb0",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Root cause: CORS configuration",
+      "created_at": "2025-12-27T22:24:53.741163700-05:00"
+    },
+    {
+      "id": 362,
+      "from_node_id": 360,
+      "to_node_id": 364,
+      "from_change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "to_change_id": "560d6bea-47ec-408d-919b-15ca7198aac9",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Implementation of CORS fix",
+      "created_at": "2025-12-27T22:25:24.843330900-05:00"
+    },
+    {
+      "id": 363,
+      "from_node_id": 360,
+      "to_node_id": 365,
+      "from_change_id": "706d5a7f-08ed-43f7-aee5-0bed28d9402a",
+      "to_change_id": "3ef0c9e9-aa40-4914-a5f4-32bcfaf68d04",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "CORS fix completed",
+      "created_at": "2025-12-27T22:41:44.160528300-05:00"
     }
   ]
 }

packages/functions/src/session.ts

···
     return successResponse(cached, 200, {
       "Cache-Control": "private, max-age=300",
       "X-Cache-Status": "HIT",
-    });
+    }, event);
   }
 
   const { agent } = await SessionService.getAgentForSession(sessionId, event);
···
   return successResponse(profileData, 200, {
     "Cache-Control": "private, max-age=300",
     "X-Cache-Status": "MISS",
-  });
+  }, event);
 };
 
 export const handler = withErrorHandling(sessionHandler);

packages/functions/src/utils/response.utils.ts

···
-import { HandlerResponse } from "@netlify/functions";
+import { HandlerResponse, HandlerEvent } from "@netlify/functions";
 import { ApiResponse } from "../core/types";
 
+/**
+ * Get CORS headers based on request origin
+ * Supports credentialed requests from extensions and localhost
+ */
+function getCorsHeaders(event?: HandlerEvent): Record<string, string> {
+  const origin = event?.headers?.origin || event?.headers?.Origin;
+
+  // Allow all origins for non-credentialed requests (backward compatibility)
+  if (!origin) {
+    return {
+      "Access-Control-Allow-Origin": "*",
+    };
+  }
+
+  // Check if origin is allowed for credentialed requests
+  const allowedOrigins = [
+    'http://localhost:8888',
+    'http://127.0.0.1:8888',
+    'https://atlast.byarielm.fyi',
+  ];
+
+  const isExtension = origin.startsWith('chrome-extension://');
+  const isAllowedOrigin = allowedOrigins.includes(origin);
+
+  if (isExtension || isAllowedOrigin) {
+    return {
+      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Allow-Credentials": "true",
+    };
+  }
+
+  // Default to wildcard for unknown origins
+  return {
+    "Access-Control-Allow-Origin": "*",
+  };
+}
+
 export function successResponse<T>(
   data: T,
   statusCode: number = 200,
   additionalHeaders: Record<string, string> = {},
+  event?: HandlerEvent,
 ): HandlerResponse {
   const response: ApiResponse<T> = {
     success: true,
···
     statusCode,
     headers: {
       "Content-Type": "application/json",
-      "Access-Control-Allow-Origin": "*",
+      ...getCorsHeaders(event),
       ...additionalHeaders,
     },
     body: JSON.stringify(response),
···
   error: string,
   statusCode: number = 500,
   details?: string,
+  event?: HandlerEvent,
 ): HandlerResponse {
   const response: ApiResponse = {
     success: false,
···
     statusCode,
     headers: {
       "Content-Type": "application/json",
-      "Access-Control-Allow-Origin": "*",
+      ...getCorsHeaders(event),
     },
     body: JSON.stringify(response),
   };