client sdk

.env.example

@@ -343,3 +343,12 @@ LLM_TOOL_RESULT_MAX_CHARS=2000
 # Then open https://localhost:8787/ and accept the certificate warning.
 TLS_CERT=certs/cert.pem
 TLS_KEY=certs/key.pem
+
+# --- CORS (optional) ---
+# Comma-separated browser origins allowed to call the REST surface cross-origin
+# (single `*` = any origin). Empty = no CORS layer (default behaviour: the
+# engine answers cross-origin fetch requests without CORS headers). Needed when
+# the JavaScript client SDK (see sdk/) is served from another origin. It does
+# NOT affect /ws: a WebSocket handshake is not a CORS request, so the realtime
+# session works cross-origin regardless.
+# CORS_ALLOW_ORIGIN=https://your-app.example,http://localhost:3000