Merge branch 'main' into ai-agents-dynamic-tools-memory-input

cli/src/guidance/skills.gen.ts

@@ -8525,6 +8525,21 @@ properties:
     type: boolean
     description: If true, passes the request body as a raw string instead of parsing
       as JSON
+  allowed_origins:
+    type: array
+    items:
+      type: string
+    description: 'Origins allowed to call this route cross-origin, matched against
+      the request''s Origin header (ignoring case) and echoed back on a match. When
+      set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin
+      the runnable returns via wm_headers. Use [''*''] to opt out of any restriction,
+      including the http_route_default_allowed_origins instance setting. An empty
+      list is not a configuration and resolves exactly as null does. When null, the
+      instance setting applies, or Access-Control-Allow-Origin: * if it is unset.
+      Ignored on a static website, which has no authentication of its own and so hands
+      out public files: restricting which browsers may read them protects nothing
+      while breaking cross-origin webfonts and fetches. A single-file static asset
+      is not exempt, since it can carry an authentication_method.'
   error_handler_path:
     type: string
     description: Path to a script to run when the triggered job fails. A bare path,