From 24d514693128ae9958ec831cb9663d76d80baaff Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Fri, 7 Aug 2026 13:41:28 -0700 Subject: [PATCH] docs: document agent-voice HOST + AGENT_VOICE_CORS_ORIGIN env vars in install hint (v0.42.74.0) The post-install hint's env-var quick-start predated the #2477 hardening and listed neither the loopback-default HOST bind nor the default-deny AGENT_VOICE_CORS_ORIGIN allowlist. Add both as optional entries (safe by default) and refresh the stale startup-log line to match the server's actual loopback-bind output. Co-Authored-By: Claude Fable 5 --- recipes/agent-voice/install/post-install-hint.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/recipes/agent-voice/install/post-install-hint.md b/recipes/agent-voice/install/post-install-hint.md index c2f906d79..66f5d716c 100644 --- a/recipes/agent-voice/install/post-install-hint.md +++ b/recipes/agent-voice/install/post-install-hint.md @@ -15,8 +15,14 @@ OPENAI_API_KEY=sk-... # required (OpenAI Realtime API) DEFAULT_PERSONA=venus # optional (one of: venus, mars) BRAIN_ROOT=/path/to/your/brain # optional (enables live context) TIMEZONE=US/Pacific # optional +HOST=0.0.0.0 # optional — binds 127.0.0.1 (loopback) by default; set only to expose beyond localhost +AGENT_VOICE_CORS_ORIGIN=https://your.app # optional — CORS is default-deny; list exact origins (comma-separated) only if a browser on another origin needs access ``` +The two security env vars ship safe by default: the server listens on loopback +only and refuses cross-origin browser requests. The local `/call` flow below +needs neither. See the recipe's production checklist before exposing publicly. + Optional for inbound Twilio: ```bash TWILIO_ACCOUNT_SID=AC... @@ -56,7 +62,7 @@ If any prompt-shape test fails, the privacy guard has caught a name you'd want t ```bash cd /services/voice-agent bun run start # or `npm start` -# → listening on http://localhost:8765 +# → listening on http://127.0.0.1:8765 (bind: 127.0.0.1 — set HOST=0.0.0.0 to expose beyond loopback) ``` Open `http://localhost:8765/call` in a browser, click Connect, grant mic permission. You should be talking to Venus (or Mars if you set `DEFAULT_PERSONA=mars`).