5 Commits

Author	SHA1	Message	Date
Elie Habib	ed9cc922e2	Fix finance variant runtime resiliency and API pressure	2026-02-17 09:34:15 +04:00
Elie Habib	c353cf2070	Reduce egress costs, add PWA support, fix Polymarket and Railway relay ... Egress optimization: - Add s-maxage + stale-while-revalidate to all API endpoints for Vercel CDN caching - Add vercel.json with immutable caching for hashed assets - Add gzip compression to sidecar responses >1KB - Add gzip to Railway RSS responses (4 paths previously uncompressed) - Increase polling intervals: markets/crypto 60s→120s, ETF/macro/stablecoins 60s→180s - Remove hardcoded Railway URL from theater-posture.js (now env-var only) PWA / Service Worker: - Add vite-plugin-pwa with autoUpdate strategy - Cache map tiles (CacheFirst), fonts (StaleWhileRevalidate), static assets - NetworkOnly for all /api/* routes (real-time data must be fresh) - Manual SW registration (web only, skip Tauri) - Add offline fallback page - Replace manual manifest with plugin-generated manifest Polymarket fix: - Route dev proxy through production Vercel (bypasses JA3 blocking) - Add 4th fallback tier: production URL as absolute fallback Desktop/Sidecar: - Dual-backend cache (_upstash-cache.js): Redis cloud + in-memory+file desktop - Settings window OK/Cancel redesign - Runtime config and secret injection improvements	2026-02-14 19:53:04 +04:00
Elie Habib	f7119b9ed6	Harden CORS, XSS, and input validation across all API endpoints and components ... - Add CORS origin allowlist (api/_cors.js) replacing Access-Control-Allow-Origin: * - Add isDisallowedOrigin guard to all API endpoints (acled, cloudflare-outages, finnhub, fred-data, hackernews, wingbits) - Gut debug-env endpoint to return 404 - Tighten sanitizeUrl() with escapeAttr output and strict relative URL validation - Add sanitizeUrl() adoption in CountryIntelModal, InsightsPanel, PredictionPanel, RegulationPanel, TechEventsPanel - Comprehensive escapeHtml() hardening in MapPopup (cables, flights, vessels, clusters) - Bound HackerNews concurrent fetches (MAX_CONCURRENCY=10), validate story type and limit params - Add wingbits cache eviction (MAX_LOCAL_CACHE_ENTRIES=2000, sweep on TTL + LRU) - Fix arxiv http→https, og-story parseInt safety with Number.isFinite + clamping	2026-02-11 14:35:07 +04:00
Elie Habib	a46d98dae1	Move FRED API key to server-side for security ... - Updated api/fred-data.js serverless function to use FRED API with server-side API key (via FRED_API_KEY env var) - Removed hardcoded API key from frontend code - Frontend now calls /api/fred-data without exposing the API key - Updated vite proxy config for local dev IMPORTANT: Add FRED_API_KEY to Vercel environment variables! 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-11 00:32:03 +04:00
Elie Habib	dbdbde84c7	Simplify Vercel API proxies to single-file endpoints ... - cloudflare-outages.js - Cloudflare Radar API - faa-status.js - FAA NASSTATUS - fred-data.js - FRED economic data - gdelt-geo.js - GDELT protest data - nga-warnings.js - NGA maritime warnings Updated frontend services to use new endpoints. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-10 14:47:30 +04:00