PAB-43: canonicalize API origins and host policy

[pablopunk]

This PR hardens the application’s origin handling by introducing a canonical, strictly validated host policy across all layers (backend, Electron app, smoke tests, and preview environments).

What changed (functionally)

• Canonical hosts enforced – The web dashboard now consistently uses https://www.nvm.fyi, and the machine‑to‑machine API uses the origin‑only https://api.nvm.fyi. No other hosts (e.g., nvm.fyi, path‑bearing URLs) are accepted in production or preview contexts.
• New shared validation – A public-origin utility parses and validates origins against the expected policy (production web, production API, preview, local, smoke). It rejects paths, query strings, credentials, and non‑expected hosts early, preventing silent misconfigurations.
• Desktop app migration – Legacy desktop base URLs (https://nvm.fyi/api/, https://www.nvm.fyi) are automatically migrated to the canonical https://api.nvm.fyi. Environment‑switching and deep‑link handling now validate origins before use.
• Backend behavioral changes
  • The Astro site is now https://www.nvm.fyi.
  • Device auth verify URLs use the canonical web origin, not the request’s origin.
  • The API active‑model endpoint derives its base URL from the canonical API origin instead of the incoming request.
  • Preview auth and gateway configurations are validated against the canonical web host and fail‑closed on mismatch.
• Smoke tests hardened – Smoke targets now require a pure origin (no path) and refuse to follow redirects, ensuring tests connect directly to the intended deployment.

Context
These changes move the project from a set of sometimes‑ambiguous, hard‑coded URLs to a single source of truth for public origins. This reduces operational mistakes (e.g., redirect‑caused OAuth failures, webhook misdelivery) and improves security by eliminating unexpected host usage.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nvm	Ready	Preview, Comment	Jul 17, 2026 1:10pm

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	❌
Security	✅
Business Logic	❌

Access your configuration settings here.

​