Added cors

app.py

@@ -12,6 +12,7 @@ from threading import RLock
 from typing import Any
 
 from fastapi import FastAPI, HTTPException, Query
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, StreamingResponse
 from pydantic import BaseModel
@@ -36,6 +37,15 @@ app = FastAPI(
     version="1.0.0",
 )
 
+# Add CORS middleware to allow browser requests from frontend
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],  # Allow all origins (use specific domains in production)
+    allow_credentials=True,
+    allow_methods=["*"],  # Allow all HTTP methods (GET, POST, OPTIONS, etc.)
+    allow_headers=["*"],  # Allow all headers
+)
+
 @dataclass
 class SessionEntry:
     env: SentinelEnv | ClusterTrustEnv

ui/app/hooks/useSentinel.ts

@@ -92,12 +92,12 @@ export function useSentinel() {
 
   /* load evaluation data once */
   useEffect(() => {
-    fetch("/assets/evaluation_results.json")
+    fetch(`${process.env.NEXT_PUBLIC_API_URL}/assets/evaluation_results.json`)
       .then((r) => r.json())
       .then(setEval)
       .catch(() => null);
 
-    fetch("/assets/trained_policy_replay.jsonl")
+    fetch(`${process.env.NEXT_PUBLIC_API_URL}/assets/trained_policy_replay.jsonl`)
       .then((r) => r.ok ? r.text() : "")
       .then((txt) => {
         const table = new Map<string, ReplayRow>();
@@ -151,7 +151,7 @@ export function useSentinel() {
       const payload = { task_type: t, seed: s };
       setLastReq({ method: "POST", path: "/reset", body: payload });
       try {
-        const res  = await fetch("/reset", {
+        const res  = await fetch(`${process.env.NEXT_PUBLIC_API_URL}/reset`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(payload),
@@ -203,7 +203,7 @@ export function useSentinel() {
       };
       setLastReq({ method: "POST", path: `/step?session_id=${sid}`, body: payload });
       try {
-        const res  = await fetch(`/step?session_id=${encodeURIComponent(sid)}`, {
+        const res  = await fetch(`${process.env.NEXT_PUBLIC_API_URL}/step?session_id=${encodeURIComponent(sid)}`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(payload),