Work on CORS testing and fixes. Chrome and pfSense with the DNS resolution found a problem. Should be fixed now.

tests/private_network_cdp.test.ts

@@ -0,0 +1,62 @@
+import { test, expect } from '@playwright/test';
+
+// This test attaches to the Chrome DevTools Protocol to capture low-level
+// network events (including those from service workers). Run this with the
+// real Chrome binary (channel: 'chrome') to reproduce the exact browser
+// behavior that shows the PNA prompt.
+
+test('CDP: detect private/local network requests and PNA preflights', async ({ page }) => {
+    const privateRequests: Array<any> = [];
+
+    function isPrivateHostname(hostname: string) {
+        if (!hostname) return false;
+        if (hostname === 'localhost' || hostname.endsWith('.localhost')) return true;
+        if (/^(127)\.|^(10)\.|^(192\.168)\.|^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)) return true;
+        return false;
+    }
+
+    // Create a CDP session for the page to listen to Network events
+    const client = await page.context().newCDPSession(page);
+    await client.send('Network.enable');
+
+    client.on('Network.requestWillBeSent', (params) => {
+        try {
+            const url = params.request.url;
+            const hostname = new URL(url).hostname;
+            const headers = params.request.headers || {};
+            const pna = headers['access-control-request-private-network'] === 'true' || headers['Access-Control-Request-Private-Network'] === 'true';
+
+            if (isPrivateHostname(hostname) || pna) {
+                privateRequests.push({
+                    url,
+                    method: params.request.method,
+                    initiator: params.initiator?.type,
+                    pnaPreflight: pna,
+                    headers
+                });
+            }
+        } catch (e) {}
+    });
+
+    // Also capture console messages to surface the same errors you see in Chrome.
+    const consoleMessages: string[] = [];
+    page.on('console', (msg) => {
+        consoleMessages.push(`${msg.type()}: ${msg.text()}`);
+    });
+
+    // Navigate to the site that triggers the behavior in your environment.
+    await page.goto('http://demo.localhost:5173/');
+    await page.waitForLoadState('networkidle');
+
+    if (privateRequests.length > 0) {
+        console.error('CDP detected private/local requests or PNA preflights:');
+        for (const r of privateRequests) console.error(JSON.stringify(r, null, 2));
+    }
+
+    if (consoleMessages.length) {
+        console.log('Captured console messages:');
+        consoleMessages.forEach((m) => console.log(m));
+    }
+
+    expect(privateRequests.length, 'No private/local network requests or PNA preflights should be made').toBe(0);
+});