Local server

pnpm dev (webpack dev server) and pnpm start (dist/standalone/server.cjs) serve the standalone app and a few narrow same-origin endpoints. The Overwolf app does not use them. The webhook gateway is a separate hosted service, not part of this server.

Endpoint	Purpose
/sb-proxy/...	Relay to Streamer.bot HTTP GetActions and DoAction only
PUT /webhook-relay/targets	Sets the list of allowed webhook URLs (the saved webhook destinations)
POST /webhook-relay	Sends a webhook request to an allowed URL only
POST /ingest/connect	Stream from the server to the open page that delivers ingested events
POST /ingest/<sourceId>	Custom REST event ingest, bearer token

Restrictions

• The server binds to 127.0.0.1. Every endpoint also requires a loopback Host header, and rejects requests whose Origin is not the server itself.
• Relays and the ingest stream require the X-Stream-Pulse: 1 header, which only the app sends.
• The Streamer.bot relay only allows GetActions and DoAction, with GET and POST.
• The webhook relay forwards only to exact URLs from the allowlist, does not follow redirects, drops hop-by-hop and cookie headers, and returns at most 2,000 characters of the response body.
• Ingest bodies are limited to 64 KB, and tokens are compared in constant time.

These are not general-purpose proxies.