evOo-local

cynarAI/evOo-local

Fork 0

Commit Graph

Author	SHA1	Message	Date
cynarAI	de2a64f070	fix(web): read sidebar trading mode from the bot status API (#80 ) The Live Trading control stored its mode in localStorage, so the shell could claim live money while the bot was in dry-run. Show the Tradingbot status when TRADING_BOT_URL is set, and an unknown state when it is not. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>	2026-09-22 22:10:18 +02:00
Cursor Agent	797d73145e	fix(cockpit): replace blanket CORS * with origin allowlist Mission Control previously set Access-Control-Allow-Origin: * on every route. That widens cross-origin browser access when Cockpit binds beyond loopback, even with bearer auth. Add server-config helpers compatible with PR #28 bind/token patterns: - loopback binds default to local web/API origins for the Heute shell - privileged /api/* routes never receive *; only reflected allowlist hits - non-loopback binds require explicit EVOO_COCKPIT_CORS_ORIGIN - default bind moves to 127.0.0.1 with token gate off-loopback Document env vars in .env.example and cover config/CORS in unit tests. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>	2026-09-22 06:23:52 +00:00
cynarAI	6c7eed7580	Initial clean evOo-local from f00577b Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline (Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/* packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.	2026-09-20 17:15:16 +02:00

Author

SHA1

Message

Date

cynarAI

de2a64f070

fix(web): read sidebar trading mode from the bot status API (#80 )

The Live Trading control stored its mode in localStorage, so the shell could
claim live money while the bot was in dry-run. Show the Tradingbot status
when TRADING_BOT_URL is set, and an unknown state when it is not.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

2026-09-22 22:10:18 +02:00

Cursor Agent

797d73145e

fix(cockpit): replace blanket CORS * with origin allowlist

Mission Control previously set Access-Control-Allow-Origin: * on every
route. That widens cross-origin browser access when Cockpit binds beyond
loopback, even with bearer auth.

Add server-config helpers compatible with PR #28 bind/token patterns:
- loopback binds default to local web/API origins for the Heute shell
- privileged /api/* routes never receive *; only reflected allowlist hits
- non-loopback binds require explicit EVOO_COCKPIT_CORS_ORIGIN
- default bind moves to 127.0.0.1 with token gate off-loopback

Document env vars in .env.example and cover config/CORS in unit tests.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

2026-09-22 06:23:52 +00:00

cynarAI

6c7eed7580

Initial clean evOo-local from f00577b

Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline
(Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/*
packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.

2026-09-20 17:15:16 +02:00

3 Commits