fix(ws): infer GATEWAY_WS_ORIGIN from CORS_ORIGIN if not set

[itsmiso-ai]

Problem

GATEWAY_WS_ORIGIN previously defaulted to http://localhost:3000. When miso-chat is deployed behind a reverse proxy with a different external URL (e.g. https://miso-chat.jory.dev), the gateway rejects the WebSocket connection with "origin not allowed" because localhost:3000 isn't in its allowed origins list.

Fix

Instead of hardcoding localhost:3000, the code now checks CORS_ORIGIN (or ALLOWED_ORIGINS) as a fallback before falling back to localhost:3000:

const configuredGatewayWsOrigin = process.env.GATEWAY_WS_ORIGIN;
const corsOrigin = process.env.CORS_ORIGIN || process.env.ALLOWED_ORIGINS || '';
const firstCorsOrigin = corsOrigin.split(',')[0].trim();
const gatewayWsOrigin = configuredGatewayWsOrigin || firstCorsOrigin || 'http://localhost:3000';

This means deployments that already set CORS_ORIGIN don't need to also set GATEWAY_WS_ORIGIN explicitly.

Explicit GATEWAY_WS_ORIGIN still takes precedence if set (for cases where WS origin needs to differ from CORS origin).

[its-miso]

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://api.minimax.io/v1

Summary

Approve. This PR fixes a deployment configuration issue where GATEWAY_WS_ORIGIN hardcoded to http://localhost:3000 caused WebSocket connection failures when miso-chat is deployed behind a reverse proxy with a different external URL.

Change Analysis

Before (line 889):

const gatewayWsOrigin = process.env.GATEWAY_WS_ORIGIN || 'http://localhost:3000';

After:

// Infer GATEWAY_WS_ORIGIN from CORS_ORIGIN if not explicitly set
const configuredGatewayWsOrigin = process.env.GATEWAY_WS_ORIGIN;
const corsOrigin = process.env.CORS_ORIGIN || process.env.ALLOWED_ORIGINS || '';
const firstCorsOrigin = corsOrigin.split(',')[0].trim();
const gatewayWsOrigin = configuredGatewayWsOrigin || firstCorsOrigin || 'http://localhost:3000';

Key Points

1. Problem Solved: Deployments with CORS_ORIGIN=https://miso-chat.jory.dev no longer need to also set GATEWAY_WS_ORIGIN explicitly
2. Priority Preserved: Explicit GATEWAY_WS_ORIGIN still takes precedence (for cases where WS origin differs from CORS origin)
3. Backward Compatible: Local development still defaults to http://localhost:3000
4. Pattern Consistency: Follows the same multi-env-var fallback pattern used elsewhere in this file (line 892: GATEWAY_URL, line 895: GATEWAY_TOKEN)

Standards Compliance

• ✅ Follows existing codebase patterns for environment variable fallbacks
• ✅ Preserves backward compatibility
• ✅ No security-sensitive changes (internal gateway-to-backend WebSocket origin, not user-facing)
• ✅ Clean, well-commented code
• ✅ Handles comma-separated origins by extracting only the first entry

Unknowns / Needs Verification

• No existing tests found for this configuration path
• Repository scan shows this is the first commit on this branch (no prior CI results to compare)
• Cannot verify actual runtime behavior without deployment testing