Security & polish: untrack settings.json, fix CORS, remove broken og:image, replace console.error with toast

README.md

@@ -195,7 +195,7 @@ agentic-os/
 ├── registry/              # Plugin marketplace
 ├── standards/             # Discover/inject conventions
 ├── prompts/               # 10 reusable templates
-├── data/                  # Runtime data (gitignored)
+├── data/                  # Runtime data (agent-routes.json tracked; settings/cost/chat gitignored)
 ├── audit/                 # Activity log (gitignored)
 └── backups/               # Snapshots (gitignored)
 ```

dashboard/app.js

@@ -8,7 +8,7 @@ async function loadPage(name) {
     await loadScript(`${PAGE_BASE}${name}.js`);
     pageCache[name] = true;
   } catch (err) {
-    console.error(`Failed to load page: ${name}`, err);
+    showToast(`Failed to load page: ${name}`, 'error');
     throw err;
   }
 }

data/settings.json

@@ -1,33 +0,0 @@
-{
-  "theme": "dark",
-  "agent_preferences": {
-    "opencode": {
-      "enabled": true,
-      "binary": "opencode",
-      "max_turns": 50
-    },
-    "hermes": {
-      "enabled": true,
-      "binary": "hermes",
-      "memory_path": "$HOME/.hermes"
-    },
-    "gemini": {
-      "enabled": true,
-      "binary": "gemini",
-      "model": "gemini-2.5-flash"
-    }
-  },
-  "api_keys": {
-    "gemini": "REPLACE_ME",
-    "openrouter": "REPLACE_ME"
-  },
-  "free_tier_limits": {
-    "gemini_flash": { "requests_per_day": 1500, "tokens_per_day": 1000000 },
-    "openrouter_free": { "requests_per_day": 100, "tokens_per_day": 200000 }
-  },
-  "dashboard": {
-    "port": 8080,
-    "host": "127.0.0.1",
-    "dark_mode": true
-  }
-}

docs/index.html

@@ -16,7 +16,6 @@
 <meta property="og:description" content="A locally-hosted OS for AI agents — coordinates opencode, Hermes, and Gemini CLI into one dashboard with skills, scheduler, cost analytics, memory, and backup.">
 <meta property="og:url" content="https://modimihir07.github.io/agentic-os/">
 <meta property="og:type" content="website">
-<meta property="og:image" content="https://modimihir07.github.io/agentic-os/og-image.png">
 
 <!-- Twitter Card -->
 <meta name="twitter:card" content="summary_large_image">

server.py

@@ -36,7 +36,7 @@ if HERMES_ENV.exists():
 # CORS for local dev
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=["http://127.0.0.1:8080", "http://localhost:8080"],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],