AochenShen99 c3bc6c7cd5

fix(nginx): defer CORS to gateway allowlist (#2861) ...

* fix(nginx): defer cors to gateway allowlist

Remove proxy-level wildcard CORS handling so browser origins are controlled by the Gateway allowlist and stay aligned with CSRF origin checks.

* docs: document gateway cors allowlist

Clarify that same-origin nginx access needs no CORS headers while split-origin or port-forwarded browser clients must opt in with GATEWAY_CORS_ORIGINS.

* docs(gateway): record cors source of truth

Document that Gateway CORSMiddleware and CSRFMiddleware share GATEWAY_CORS_ORIGINS as the split-origin source of truth.

* fix(gateway): align cors origin normalization

* docs: clarify gateway langgraph routing

* docs(gateway): update runtime routing note

2026-05-11 17:38:37 +08:00

..

nginx

fix(nginx): defer CORS to gateway allowlist (#2861)

2026-05-11 17:38:37 +08:00

provisioner

feat(provisioner): add optional PVC support for sandbox volumes (#2020)

2026-04-10 20:40:30 +08:00

dev-entrypoint.sh

fix(scripts): preserve uv extras across make dev restarts (#2754) (#2767)

2026-05-10 22:28:29 +08:00

docker-compose-dev.yaml

fix(scripts): preserve uv extras across make dev restarts (#2754) (#2767)

2026-05-10 22:28:29 +08:00

docker-compose.yaml

fix(harness): resolve runtime paths from project root (#2642)

2026-05-01 22:19:50 +08:00