fix(bridge): gate /api/config like every other endpoint

CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to Collie are recorded here. The format follows
 `version` in `herdr-plugin.toml`, `package.json`, and `web/package.json` (enforced by
 `scripts/check-version.sh`). See [`CLAUDE.md`](./CLAUDE.md) → *Versioning* for the bump policy.
 
+## [0.16.1] - 2026-07-27
+
+### Fixed
+- `/api/config` is now gated like every other endpoint — it was the one route that skipped the same-origin check and `COLLIE_PUBLIC_HOSTS`, noted by @Optic00 in #32 (a54afd9)
+
 ## [0.16.0] - 2026-07-27
 
 ### Added

bridge/server.ts

@@ -215,6 +215,14 @@ export function startServer(opts: {
 
       // ── Misc API ─────────────────────────────────────────────────────────
       if (pathname === "/api/config") {
+        // Read-level, like the other non-terminal endpoints. Nothing here is secret — the VAPID
+        // public key is handed to every browser by design — but this was the one route that skipped
+        // checkAccess entirely, so COLLIE_PUBLIC_HOSTS didn't cover it and a rebound DNS name could
+        // still read the build id. The client only ever calls this same-origin, and a refusal can't
+        // be mistaken for an outage: ConnectionBanner short-circuits to AuthErrorBanner before its
+        // red-state probe runs. Noted in #32.
+        const denied = guard(req, cfg, "read");
+        if (denied) return denied;
         return json({
           push: push.enabled,
           vapidPublicKey: push.publicKey,

herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.collie"
 name = "Collie"
-version = "0.16.0"
+version = "0.16.1"
 min_herdr_version = "0.7.0"
 description = "Mobile web UI to monitor and reply to your agent herd, served over Tailscale"
 platforms = ["linux", "macos"]

package.json

@@ -1,6 +1,6 @@
 {
   "name": "collie",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "private": true,
   "license": "MIT",
   "description": "Collie — a mobile web UI to monitor and reply to your Herdr agent herd over Tailscale",

web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "collie-web",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "private": true,
   "license": "MIT",
   "type": "module",