This specific bug has been fixed!
Granting CORS access to requests from .onion origins is weird, because Firefox (and therefore Tor Browser) rewrites the Origin header on the request to read Origin: null, but it still wants to see Access-Control-Allow-Origin: http://kagi....onion on the response. Discussion at https://github.com/whatwg/fetch/issues/1350. Making it work required going around our web framework's CORS middleware's back.
Requests that use the .onion site but don't use privacy pass hit a different code path that has not been fixed yet. Hopefully that will be ironed out soon.
Unfortunately, we still have that long-standing issue where our infrastructure sometimes blocks VPN and Tor users despite our best efforts to let them through. Using the .onion site should bypass most of the problems and therefore be more reliable than accessing clearnet kagi.com over Tor, but the connection out to clearnet assistant-api.kagi.com has a chance of snagging on something. It happened to me once during testing. I'm not currently sure how much of a problem it's going to be. Let us know if/how often you run into problems. As always, I'm very sorry about that long-standing issue.
