docs: new configurable CORS option (#6522)

Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>

packages/web/src/content/docs/cli.mdx

@@ -362,11 +362,12 @@ This starts an HTTP server that provides API access to opencode functionality wi
 
 #### Flags
 
-| Flag         | Description           |
-| ------------ | --------------------- |
-| `--port`     | Port to listen on     |
-| `--hostname` | Hostname to listen on |
-| `--mdns`     | Enable mDNS discovery |
+| Flag         | Description                                |
+| ------------ | ------------------------------------------ |
+| `--port`     | Port to listen on                          |
+| `--hostname` | Hostname to listen on                      |
+| `--mdns`     | Enable mDNS discovery                      |
+| `--cors`     | Additional browser origin(s) to allow CORS |
 
 ---
 
@@ -457,11 +458,12 @@ This starts an HTTP server and opens a web browser to access OpenCode through a
 
 #### Flags
 
-| Flag         | Description           |
-| ------------ | --------------------- |
-| `--port`     | Port to listen on     |
-| `--hostname` | Hostname to listen on |
-| `--mdns`     | Enable mDNS discovery |
+| Flag         | Description                                |
+| ------------ | ------------------------------------------ |
+| `--port`     | Port to listen on                          |
+| `--hostname` | Hostname to listen on                      |
+| `--mdns`     | Enable mDNS discovery                      |
+| `--cors`     | Additional browser origin(s) to allow CORS |
 
 ---
 

packages/web/src/content/docs/config.mdx

@@ -132,7 +132,8 @@ You can configure server settings for the `opencode serve` and `opencode web` co
   "server": {
     "port": 4096,
     "hostname": "0.0.0.0",
-    "mdns": true
+    "mdns": true,
+    "cors": ["http://localhost:5173"]
   }
 }
 ```
@@ -142,6 +143,7 @@ Available options:
 - `port` - Port to listen on.
 - `hostname` - Hostname to listen on. When `mdns` is enabled and no hostname is set, defaults to `0.0.0.0`.
 - `mdns` - Enable mDNS service discovery. This allows other devices on the network to discover your OpenCode server.
+- `cors` - Additional origins to allow for CORS when using the HTTP server from a browser-based client. Values must be full origins (scheme + host + optional port), eg `https://app.example.com`.
 
 [Learn more about the server here](/docs/server).
 

packages/web/src/content/docs/server.mdx

@@ -13,16 +13,23 @@ The `opencode serve` command runs a headless HTTP server that exposes an OpenAPI
 ### Usage
 
 ```bash
-opencode serve [--port <number>] [--hostname <string>]
+opencode serve [--port <number>] [--hostname <string>] [--cors <origin>]
 ```
 
 #### Options
 
-| Flag         | Description           | Default     |
-| ------------ | --------------------- | ----------- |
-| `--port`     | Port to listen on     | `4096`      |
-| `--hostname` | Hostname to listen on | `127.0.0.1` |
-| `--mdns`     | Enable mDNS discovery | `false`     |
+| Flag         | Description                         | Default     |
+| ------------ | ----------------------------------- | ----------- |
+| `--port`     | Port to listen on                   | `4096`      |
+| `--hostname` | Hostname to listen on               | `127.0.0.1` |
+| `--mdns`     | Enable mDNS discovery               | `false`     |
+| `--cors`     | Additional browser origins to allow | `[]`        |
+
+`--cors` can be passed multiple times:
+
+```bash
+opencode serve --cors http://localhost:5173 --cors https://app.example.com
+```
 
 ---