From c42a64b7a2c654ae118b9f2cb342867a7667878d Mon Sep 17 00:00:00 2001
From: Nexus Dev <nexus@local>
Date: Sat, 4 Apr 2026 02:31:49 +0000
Subject: [PATCH] feat(37-01): add COOP/COEP headers to Express server for
 SharedArrayBuffer support

- Add Cross-Origin-Opener-Policy: same-origin middleware before all routes
- Add Cross-Origin-Embedder-Policy: require-corp middleware before all routes
- Required for @ricky0123/vad-react (VAD uses SharedArrayBuffer internally)
---
 server/src/app.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/src/app.ts b/server/src/app.ts
index 389a656c..17703ef0 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -92,6 +92,13 @@ export async function createApp(
 ) {
   const app = express();
 
+  // COOP/COEP headers required for SharedArrayBuffer (VAD voice activity detection)
+  app.use((_req, res, next) => {
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+    res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+    next();
+  });
+
   app.use(express.json({
     // Company import/export payloads can inline full portable packages.
     limit: "10mb",