Variant

Desktop app (Windows)

Affected area

Desktop app (Tauri)

Bug description

On Windows, the app shows "sidecar not reachable" on every launch and is completely non-functional.

The sidecar starts correctly (visible in desktop.log with a valid PID, routes loaded, listening on 127.0.0.1:46123), but every API request is blocked by CORS before it reaches any handler.

Root cause: src-tauri/sidecar/local-api-server.mjs line 427 only allows https://tauri.localhost in the CORS allowlist, but Windows Tauri webviews send requests with the origin http://tauri.localhost (HTTP, not HTTPS). The mismatch causes every request to be rejected with a CORS 403, which the frontend interprets as "sidecar not reachable".

One-line fix:
```diff

• /^https://tauri.localhost(:\d+)?$/,

• /^https?://tauri.localhost(:\d+)?$/,
  ```

Steps to reproduce

1. Install World Monitor on any Windows machine
2. Launch the app
3. Observe "sidecar not reachable" error
4. Open DevTools (Ctrl+Alt+I) → Console tab
5. Observe console flooded with: "has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'tauri://localhost' that is not equal to the supplied origin http://tauri.localhost"

Expected behavior

The sidecar should accept requests from http://tauri.localhost (the origin used by Tauri on Windows) and return valid API responses. The app should load normally without any "sidecar not reachable" error.

Note: macOS is unaffected because it uses the tauri://localhost custom scheme (matched by line 424). Only the Windows http://tauri.localhost origin is broken.

Screenshots / Console errors

Browser & OS

Windows 11