Ingo Wagner 20afcb0d0b feat: security headers + onboarding scan & profile creation flow

Security:
- Add CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
  Permissions-Policy as Hono middleware (after CORS)
- CORS already hardened via isTrustedOrigin (localhost, private, Tailscale)

Onboarding scan flow:
- New 'scan' step between 'integrations' and 'bot' in onboarding
- OnboardingScanProgress.tsx: progress UI with 4 phases (scanning, connecting,
  building, briefing) with real-time polling
- onboarding-scan.ts: backend scan pipeline (in-memory registry, async phases)
- RPC routes: onboarding.scan + onboarding.scanStatus
- Contracts updated with new procedure definitions

Co-Authored-By: Claude Code <noreply@anthropic.com>

2026-09-23 23:31:12 +00:00

1.1 KiB

Raw Blame History

GROK-CLAUDE-HANDOFF — 2026-09-23T22:59:11+00:00

Autopilot merged #84 (Product CI gate) → main cf4d5cc.
Checkout pulled to cf4d5cc; Claude WIP stashed then restored (app.ts/router.ts/rpc.ts + onboarding-scan.ts).
API :3100 was down (Claude background "Test API startup with security headers" stopped / refused). Autopilot restarted via pnpm --filter @rakazo/api dev (log /tmp/evoo-autopilot/api-3100.log).
Web :5173 left running.
PR #85 rebase agent in flight: https://cursor.com/agents/bc-edd2b181-b5da-5574-a956-e55efe3d2736
Do not reset --hard without stash; WIP present.
Autopilot restart path: A rejected (evoo-stack = Rakazo Docker, broken symlink /srv/rakazo/stack-up.sh → missing /srv/evoo/rakazo/…). Chose new user unit evoo-local.service + ~/.local/bin/evoo-dev-stack.sh; live :3100/:5173 migrated; GH vars EVO_RESTART_MODE=systemd EVO_SYSTEMD_UNIT=evoo-local.service. Do not use evoo-stack for evo-deploy.
Cancelled queued evo-deploy 35933339459 (would reset --hard over Claude WIP now that restart=systemd). Re-dispatch after WIP committed/stashed.

1.1 KiB Raw Blame History

GROK-CLAUDE-HANDOFF — 2026-09-23T22:59:11+00:00

1.1 KiB

Raw Blame History