forexsmartbot 3.3.0__tar.gz → 3.3.1__tar.gz

{forexsmartbot-3.3.0 → forexsmartbot-3.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forexsmartbot
-Version: 3.3.0
+Version: 3.3.1
 Summary: Professional forex trading bot with advanced risk management and strategy plugins
 Author-email: VoxHash <contact@voxhash.dev>
 License: MIT

{forexsmartbot-3.3.0 → forexsmartbot-3.3.1}/forexsmartbot/__init__.py

@@ -1,2 +1,2 @@
 # ForexSmartBot Package
-__version__ = "3.3.0"
+__version__ = "3.3.1"

{forexsmartbot-3.3.0 → forexsmartbot-3.3.1}/forexsmartbot/cloud/__init__.py

@@ -7,7 +7,12 @@ from .cloud_sync import CloudSyncManager
 from .remote_monitor import RemoteMonitorServer
 from .api_server import APIServer, WebSocketServer
 from .mobile_api import MobileAppAPI, PushNotificationService
-from .companion_api import CompanionAPI, WebhookNotifier
+from .companion_api import (
+    CompanionAPI,
+    CompanionActionQueue,
+    CompanionPairingStore,
+    WebhookNotifier,
+)
 from .security import SecurityManager, RateLimiter
 from .api_client import APIClient, WebSocketClient
 from .error_handler import CloudErrorHandler, CloudHealthMonitor, retry_call
@@ -21,6 +26,8 @@ __all__ = [
     'MobileAppAPI',
     'PushNotificationService',
     'CompanionAPI',
+    'CompanionActionQueue',
+    'CompanionPairingStore',
     'WebhookNotifier',
     'SecurityManager',
     'RateLimiter',

{forexsmartbot-3.3.0 → forexsmartbot-3.3.1}/forexsmartbot/cloud/companion_api.py

@@ -8,9 +8,12 @@ Broker keys and order routing stay on the desktop host.
 
 from __future__ import annotations
 
+import json
 import logging
+import secrets
 import threading
-from datetime import datetime
+import uuid
+from datetime import datetime, timedelta
 from typing import Any, Callable, Dict, List, Optional
 from urllib.parse import urlparse
 
@@ -30,6 +33,127 @@ logger = logging.getLogger(__name__)
 PortfolioProvider = Callable[[], Dict[str, Any]]
 AlertsProvider = Callable[[], List[Dict[str, Any]]]
 StrategiesProvider = Callable[[], Dict[str, Any]]
+HistoryProvider = Callable[[Optional[str], int], Dict[str, Any]]
+
+PAIRING_SCHEME = "fsb-companion"
+PAIRING_TTL_SECONDS = 300
+ALLOWED_ACTIONS = frozenset({"start_trading", "stop_trading", "pause_trading"})
+
+
+class CompanionActionQueue:
+    """Pending high-level companion actions awaiting host approve/reject."""
+
+    def __init__(self, *, max_pending: int = 64):
+        self.max_pending = max_pending
+        self._lock = threading.Lock()
+        self._items: Dict[str, Dict[str, Any]] = {}
+
+    def request(self, action: str, *, requested_by: str = "companion") -> Optional[Dict[str, Any]]:
+        action = (action or "").strip()
+        if action not in ALLOWED_ACTIONS:
+            return None
+        with self._lock:
+            pending = [i for i in self._items.values() if i["status"] == "pending"]
+            if len(pending) >= self.max_pending:
+                return None
+            item_id = uuid.uuid4().hex
+            item = {
+                "id": item_id,
+                "action": action,
+                "status": "pending",
+                "requested_by": requested_by,
+                "created_at": datetime.now().isoformat(),
+                "resolved_at": None,
+                "reason": None,
+            }
+            self._items[item_id] = item
+            return dict(item)
+
+    def list_pending(self) -> List[Dict[str, Any]]:
+        with self._lock:
+            return [dict(i) for i in self._items.values() if i["status"] == "pending"]
+
+    def get(self, action_id: str) -> Optional[Dict[str, Any]]:
+        with self._lock:
+            item = self._items.get(action_id)
+            return dict(item) if item else None
+
+    def resolve(
+        self, action_id: str, *, approve: bool, reason: Optional[str] = None
+    ) -> Optional[Dict[str, Any]]:
+        with self._lock:
+            item = self._items.get(action_id)
+            if not item or item["status"] != "pending":
+                return None
+            item["status"] = "approved" if approve else "rejected"
+            item["resolved_at"] = datetime.now().isoformat()
+            item["reason"] = reason
+            return dict(item)
+
+
+class CompanionPairingStore:
+    """Short-lived pairing sessions for QR onboarding (phone redeems without prior key)."""
+
+    def __init__(self, *, ttl_seconds: int = PAIRING_TTL_SECONDS):
+        self.ttl_seconds = ttl_seconds
+        self._lock = threading.Lock()
+        self._sessions: Dict[str, Dict[str, Any]] = {}
+
+    def create(
+        self,
+        *,
+        base_url: str,
+        api_key: str,
+        pin_sha256: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        code = secrets.token_urlsafe(12)
+        expires = datetime.now() + timedelta(seconds=self.ttl_seconds)
+        payload = {
+            "v": 1,
+            "scheme": PAIRING_SCHEME,
+            "base_url": base_url.rstrip("/"),
+            "pairing_code": code,
+            "expires_at": expires.isoformat(),
+            "pin_sha256": pin_sha256 or "",
+        }
+        with self._lock:
+            self._sessions[code] = {
+                "api_key": api_key,
+                "base_url": base_url.rstrip("/"),
+                "pin_sha256": pin_sha256 or "",
+                "expires_at": expires,
+                "redeemed": False,
+            }
+            # Drop expired
+            now = datetime.now()
+            dead = [k for k, v in self._sessions.items() if v["expires_at"] < now]
+            for k in dead:
+                del self._sessions[k]
+        return {
+            "pairing_code": code,
+            "expires_at": expires.isoformat(),
+            "ttl_seconds": self.ttl_seconds,
+            "qr_payload": payload,
+            "qr_text": json.dumps(payload, separators=(",", ":")),
+        }
+
+    def redeem(self, pairing_code: str) -> Optional[Dict[str, Any]]:
+        code = (pairing_code or "").strip()
+        with self._lock:
+            session = self._sessions.get(code)
+            if not session:
+                return None
+            if session["expires_at"] < datetime.now() or session["redeemed"]:
+                self._sessions.pop(code, None)
+                return None
+            session["redeemed"] = True
+            return {
+                "scheme": PAIRING_SCHEME,
+                "base_url": session["base_url"],
+                "api_key": session["api_key"],
+                "pin_sha256": session["pin_sha256"],
+                "redeemed_at": datetime.now().isoformat(),
+            }
 
 
 def _normalize_portfolio(raw: Dict[str, Any]) -> Dict[str, Any]:
@@ -143,7 +267,10 @@ class CompanionAPI:
         portfolio_provider: Optional[PortfolioProvider] = None,
         alerts_provider: Optional[AlertsProvider] = None,
         strategies_provider: Optional[StrategiesProvider] = None,
+        history_provider: Optional[HistoryProvider] = None,
         allow_control: bool = False,
+        public_base_url: Optional[str] = None,
+        pin_sha256: Optional[str] = None,
         url_prefix: str = "/api/v1/companion",
     ):
         self.app = app or Flask(__name__)
@@ -154,13 +281,18 @@ class CompanionAPI:
             require_api_key = not is_insecure_secret(self.api_key)
         self.require_api_key = require_api_key
         self.allow_control = allow_control
+        self.public_base_url = (public_base_url or "").rstrip("/")
+        self.pin_sha256 = (pin_sha256 or "").strip()
         self.url_prefix = url_prefix.rstrip("/") or "/api/v1/companion"
 
         self._portfolio_provider = portfolio_provider or (lambda: {})
         self._alerts_provider = alerts_provider or (lambda: [])
         self._strategies_provider = strategies_provider or (lambda: {"strategies": {}})
+        self._history_provider = history_provider
         self.webhook_notifier = WebhookNotifier()
         self.control_callbacks: Dict[str, Callable[[], bool]] = {}
+        self.action_queue = CompanionActionQueue()
+        self.pairing_store = CompanionPairingStore()
 
         self.setup_routes()
 
@@ -173,8 +305,14 @@ class CompanionAPI:
     def set_strategies_provider(self, provider: StrategiesProvider) -> None:
         self._strategies_provider = provider
 
+    def set_history_provider(self, provider: HistoryProvider) -> None:
+        self._history_provider = provider
+
+    def set_public_base_url(self, base_url: str) -> None:
+        self.public_base_url = (base_url or "").rstrip("/")
+
     def register_control_callback(self, action: str, callback: Callable[[], bool]) -> None:
-        """Register optional start/stop callbacks (disabled unless allow_control)."""
+        """Register optional start/stop callbacks (used on approve or allow_control)."""
         self.control_callbacks[action] = callback
 
     def _auth_response(self):
@@ -210,7 +348,10 @@ class CompanionAPI:
                         "portfolio": True,
                         "alerts": True,
                         "strategies": True,
+                        "history": self._history_provider is not None,
                         "webhooks": True,
+                        "pairing": True,
+                        "actions": True,
                         "control": self.allow_control,
                     },
                     "timestamp": datetime.now().isoformat(),
@@ -271,6 +412,32 @@ class CompanionAPI:
             except Exception as exc:
                 return jsonify({"error": str(exc)}), 500
 
+        @self.app.route(f"{prefix}/strategies/history", methods=["GET"])
+        def companion_strategies_history():
+            denied = self._auth_response()
+            if denied:
+                return denied
+            if not self._history_provider:
+                return jsonify({"error": "History not available"}), 404
+            try:
+                limit = int(request.args.get("limit", 100))
+                return jsonify(self._history_provider(None, limit))
+            except Exception as exc:
+                return jsonify({"error": str(exc)}), 500
+
+        @self.app.route(f"{prefix}/strategies/<strategy_name>/history", methods=["GET"])
+        def companion_strategy_history(strategy_name: str):
+            denied = self._auth_response()
+            if denied:
+                return denied
+            if not self._history_provider:
+                return jsonify({"error": "History not available"}), 404
+            try:
+                limit = int(request.args.get("limit", 100))
+                return jsonify(self._history_provider(strategy_name, limit))
+            except Exception as exc:
+                return jsonify({"error": str(exc)}), 500
+
         @self.app.route(f"{prefix}/devices/webhook", methods=["POST"])
         def register_webhook():
             denied = self._auth_response()
@@ -301,6 +468,93 @@ class CompanionAPI:
             removed = self.webhook_notifier.unregister(url)
             return jsonify({"success": removed})
 
+        @self.app.route(f"{prefix}/pairing/session", methods=["POST"])
+        def pairing_session():
+            """Create QR pairing payload (authenticated host)."""
+            denied = self._auth_response()
+            if denied:
+                return denied
+            data = request.get_json(silent=True) or {}
+            base = str(
+                data.get("base_url")
+                or self.public_base_url
+                or request.host_url.rstrip("/")
+            ).rstrip("/")
+            pin = str(data.get("pin_sha256") or self.pin_sha256 or "").strip()
+            session = self.pairing_store.create(
+                base_url=base, api_key=self.api_key, pin_sha256=pin or None
+            )
+            return jsonify(session), 201
+
+        @self.app.route(f"{prefix}/pairing/redeem", methods=["POST"])
+        def pairing_redeem():
+            """Phone redeems short-lived pairing code (no prior API key)."""
+            data = request.get_json(silent=True) or {}
+            code = str(data.get("pairing_code") or data.get("code") or "").strip()
+            result = self.pairing_store.redeem(code)
+            if not result:
+                return jsonify({"error": "Invalid or expired pairing code"}), 400
+            return jsonify(result)
+
+        @self.app.route(f"{prefix}/actions", methods=["GET"])
+        def list_actions():
+            denied = self._auth_response()
+            if denied:
+                return denied
+            pending = self.action_queue.list_pending()
+            return jsonify({"pending": pending, "count": len(pending)})
+
+        @self.app.route(f"{prefix}/actions", methods=["POST"])
+        def request_action():
+            """Phone requests a high-level action (queued until host approves)."""
+            denied = self._auth_response()
+            if denied:
+                return denied
+            data = request.get_json(silent=True) or {}
+            action = str(data.get("action") or "").strip()
+            requested_by = str(data.get("requested_by") or "companion").strip() or "companion"
+            item = self.action_queue.request(action, requested_by=requested_by)
+            if not item:
+                return jsonify(
+                    {
+                        "error": "Invalid action or queue full",
+                        "allowed": sorted(ALLOWED_ACTIONS),
+                    }
+                ), 400
+            return jsonify({"action": item}), 201
+
+        @self.app.route(f"{prefix}/actions/<action_id>/approve", methods=["POST"])
+        def approve_action(action_id: str):
+            denied = self._auth_response()
+            if denied:
+                return denied
+            item = self.action_queue.resolve(action_id, approve=True)
+            if not item:
+                return jsonify({"error": "Action not found or already resolved"}), 404
+            cb = self.control_callbacks.get(item["action"])
+            executed = False
+            if cb:
+                try:
+                    executed = bool(cb())
+                except Exception as exc:
+                    logger.exception("Action callback failed")
+                    return jsonify(
+                        {"action": item, "executed": False, "error": str(exc)}
+                    ), 500
+            return jsonify({"action": item, "executed": executed})
+
+        @self.app.route(f"{prefix}/actions/<action_id>/reject", methods=["POST"])
+        def reject_action(action_id: str):
+            denied = self._auth_response()
+            if denied:
+                return denied
+            data = request.get_json(silent=True) or {}
+            reason = str(data.get("reason") or "").strip() or None
+            item = self.action_queue.resolve(action_id, approve=False, reason=reason)
+            if not item:
+                return jsonify({"error": "Action not found or already resolved"}), 404
+            return jsonify({"action": item})
+
         if self.allow_control:
 
             @self.app.route(f"{prefix}/control/start", methods=["POST"])

{forexsmartbot-3.3.0 → forexsmartbot-3.3.1}/forexsmartbot/cloud/remote_monitor.py

@@ -192,6 +192,22 @@ class RemoteMonitorServer:
                 return denied
             return jsonify(self._strategies_payload())
 
+        @self.app.route("/api/v1/strategies/history", methods=["GET"])
+        def get_strategies_history():
+            """All strategy metrics history for charts (authenticated)."""
+            denied = self._auth_response()
+            if denied:
+                return denied
+            return jsonify(self._history_payload(None))
+
+        @self.app.route("/api/v1/strategies/<strategy_name>/history", methods=["GET"])
+        def get_strategy_history(strategy_name: str):
+            """Single strategy metrics history (authenticated)."""
+            denied = self._auth_response()
+            if denied:
+                return denied
+            return jsonify(self._history_payload(strategy_name))
+
         @self.app.route("/api/v1/strategies/<strategy_name>", methods=["GET"])
         def get_strategy(strategy_name: str):
             """Single strategy health (authenticated)."""
@@ -205,7 +221,8 @@ class RemoteMonitorServer:
             return jsonify({"strategy": strategies[strategy_name], "timestamp": payload.get("timestamp")})
 
     def _mount_companion(self) -> None:
-        """Mount read-only companion API on the same Flask app."""
+        """Mount companion API on the same Flask app."""
+        base = f"http://{self.host}:{self.port}"
         self.companion = CompanionAPI(
             app=self.app,
             api_key=self.api_key,
@@ -213,12 +230,30 @@ class RemoteMonitorServer:
             portfolio_provider=lambda: self.trading_data,
             alerts_provider=self._get_recent_alerts,
             strategies_provider=self._strategies_payload,
+            history_provider=lambda name, limit: self._history_payload(name, limit),
             allow_control=False,
+            public_base_url=base,
         )
 
     def set_strategy_monitor(self, monitor: Any) -> None:
         """Attach a StrategyMonitor for /api/v1/strategies and companion clients."""
         self.strategy_monitor = monitor
+        if self.companion is not None:
+            self.companion.set_history_provider(
+                lambda name, limit: self._history_payload(name, limit)
+            )
+
+    def register_control_callback(self, action: str, callback: Callable):
+        """
+        Register callback for remote control actions.
+
+        Args:
+            action: Action name ('start_trading', 'stop_trading', etc.)
+            callback: Callback function
+        """
+        self.control_callbacks[action] = callback
+        if self.companion is not None:
+            self.companion.register_control_callback(action, callback)
 
     def _strategies_payload(self) -> Dict:
         """Build strategy health JSON for dashboard / companion."""
@@ -239,6 +274,34 @@ class RemoteMonitorServer:
         payload["timestamp"] = datetime.now().isoformat()
         return payload
 
+    def _history_payload(
+        self, strategy_name: Optional[str] = None, limit: int = 100
+    ) -> Dict:
+        """Build strategy history JSON for charts."""
+        try:
+            from flask import has_request_context
+
+            if has_request_context() and request.args.get("limit") is not None:
+                limit = int(request.args.get("limit"))
+        except (TypeError, ValueError):
+            pass
+        if self.strategy_monitor is not None and hasattr(
+            self.strategy_monitor, "get_history_payload"
+        ):
+            return self.strategy_monitor.get_history_payload(strategy_name, limit=limit)
+        if strategy_name:
+            return {
+                "strategy": strategy_name,
+                "history": [],
+                "count": 0,
+                "timestamp": datetime.now().isoformat(),
+            }
+        return {
+            "histories": {},
+            "count": 0,
+            "timestamp": datetime.now().isoformat(),
+        }
+
     def _auth_response(self):
         """Return 401 response tuple when auth fails, else None."""
         if not self._check_auth():
@@ -312,12 +375,19 @@ class RemoteMonitorServer:
         .health-critical { color: #f44336; }
         .health-unknown { color: #9e9e9e; }
         .badge { display:inline-block; padding:2px 8px; border-radius:4px; background:#444; font-size:12px; }
+        .chart-grid { display:grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr)); gap:12px; margin-top:12px; }
+        .chart-card { background:#3d3d3d; padding:12px; border-radius:6px; }
+        .chart-card h3 { margin:0 0 8px; font-size:14px; color:#ccc; }
+        canvas.spark { width:100%; height:80px; background:#2a2a2a; border-radius:4px; }
+        #pairing-qr { background:#fff; padding:12px; display:inline-block; border-radius:8px; }
+        #pairing-text { width:100%; min-height:72px; font-family:monospace; font-size:12px; }
+        .action-row button { margin-right:6px; }
     </style>
 </head>
 <body>
     <div class="container">
         <h1>ForexSmartBot Remote Monitor</h1>
-        <p style="color:#aaa;">Strategy health dashboard + read-only companion API at <code>/api/v1/companion/*</code></p>
+        <p style="color:#aaa;">Strategy health + history charts + companion pairing / approve-reject at <code>/api/v1/companion/*</code></p>
 
         <div class="status-card">
             <h2>API Key</h2>
@@ -372,6 +442,23 @@ class RemoteMonitorServer:
                 </thead>
                 <tbody id="strategies-body"></tbody>
             </table>
+            <h2 style="margin-top:20px;">History Charts</h2>
+            <div id="history-charts" class="chart-grid"></div>
+        </div>
+
+        <div class="status-card">
+            <h2>Companion Pairing (QR)</h2>
+            <p style="color:#aaa;">Create a short-lived session; scan or paste on the Android companion.</p>
+            <button class="btn btn-start" onclick="createPairing()">Create pairing QR</button>
+            <div id="pairing-meta" style="color:#aaa;margin:8px 0;"></div>
+            <div id="pairing-qr"></div>
+            <textarea id="pairing-text" readonly placeholder="QR JSON payload appears here"></textarea>
+        </div>
+
+        <div class="status-card">
+            <h2>Pending Companion Actions</h2>
+            <p style="color:#aaa;">Phone-requested start/stop/pause — approve or reject on this host.</p>
+            <div id="actions-list" style="color:#aaa;">No pending actions</div>
         </div>
 
         <div class="status-card">
@@ -397,6 +484,7 @@ class RemoteMonitorServer:
         </div>
     </div>
 
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js"></script>
     <script>
         function authHeaders() {
             const key = sessionStorage.getItem('fsb_api_key') || '';
@@ -423,6 +511,59 @@ class RemoteMonitorServer:
             return 'health-unknown';
         }
 
+        function drawSpark(canvas, series, key, color) {
+            const ctx = canvas.getContext('2d');
+            const w = canvas.width = canvas.clientWidth * (window.devicePixelRatio || 1);
+            const h = canvas.height = 80 * (window.devicePixelRatio || 1);
+            ctx.clearRect(0, 0, w, h);
+            const vals = (series || []).map(p => Number(p[key] || 0));
+            if (vals.length < 2) {
+                ctx.fillStyle = '#666';
+                ctx.font = '12px sans-serif';
+                ctx.fillText('Not enough samples', 8, h/2);
+                return;
+            }
+            const min = Math.min(...vals), max = Math.max(...vals);
+            const span = (max - min) || 1;
+            ctx.strokeStyle = color;
+            ctx.lineWidth = 2;
+            ctx.beginPath();
+            vals.forEach((v, i) => {
+                const x = (i / (vals.length - 1)) * (w - 4) + 2;
+                const y = h - 4 - ((v - min) / span) * (h - 8);
+                if (i === 0) ctx.moveTo(x, y); else ctx.lineTo(x, y);
+            });
+            ctx.stroke();
+        }
+
+        function updateHistoryCharts() {
+            fetch('/api/v1/strategies/history?limit=80', {headers: authHeaders()})
+                .then(async r => {
+                    if (r.status === 401) throw new Error('unauthorized');
+                    return r.json();
+                })
+                .then(data => {
+                    const histories = data.histories || {};
+                    const root = document.getElementById('history-charts');
+                    const names = Object.keys(histories);
+                    if (!names.length) {
+                        root.innerHTML = '<div style="color:#888;">No history yet — signals populate charts</div>';
+                        return;
+                    }
+                    root.innerHTML = names.map(name => {
+                        const id = 'spark-' + name.replace(/[^a-zA-Z0-9_-]/g, '_');
+                        return '<div class="chart-card"><h3>' + name + ' · signals</h3>' +
+                            '<canvas class="spark" id="' + id + '"></canvas></div>';
+                    }).join('');
+                    names.forEach(name => {
+                        const id = 'spark-' + name.replace(/[^a-zA-Z0-9_-]/g, '_');
+                        const el = document.getElementById(id);
+                        if (el) drawSpark(el, histories[name], 'signal_count', '#4CAF50');
+                    });
+                })
+                .catch(() => {});
+        }
+
         function updateStrategies() {
             fetch('/api/v1/strategies', {headers: authHeaders()})
                 .then(async r => {
@@ -456,6 +597,72 @@ class RemoteMonitorServer:
                     }).join('');
                 })
                 .catch(() => {});
+            updateHistoryCharts();
+            updateActions();
+        }
+
+        function createPairing() {
+            fetch('/api/v1/companion/pairing/session', {
+                method: 'POST',
+                headers: authHeaders(),
+                body: JSON.stringify({}),
+            })
+            .then(async r => {
+                if (r.status === 401) throw new Error('unauthorized');
+                return r.json();
+            })
+            .then(data => {
+                const text = data.qr_text || JSON.stringify(data.qr_payload || {});
+                document.getElementById('pairing-text').value = text;
+                document.getElementById('pairing-meta').textContent =
+                    'Code ' + data.pairing_code + ' · expires ' + data.expires_at +
+                    ' · TTL ' + data.ttl_seconds + 's';
+                const box = document.getElementById('pairing-qr');
+                box.innerHTML = '';
+                if (window.QRCode) {
+                    new QRCode(box, { text: text, width: 192, height: 192 });
+                } else {
+                    box.textContent = 'QR library unavailable — copy JSON below';
+                }
+            })
+            .catch(err => alert('Pairing failed: ' + err));
+        }
+
+        function updateActions() {
+            fetch('/api/v1/companion/actions', {headers: authHeaders()})
+                .then(async r => {
+                    if (r.status === 401) throw new Error('unauthorized');
+                    return r.json();
+                })
+                .then(data => {
+                    const pending = data.pending || [];
+                    const root = document.getElementById('actions-list');
+                    if (!pending.length) {
+                        root.innerHTML = 'No pending actions';
+                        return;
+                    }
+                    root.innerHTML = pending.map(a =>
+                        '<div class="action-row" style="margin:8px 0;">' +
+                        '<span class="badge">' + a.action + '</span> ' +
+                        '<span style="color:#aaa;">' + a.id.slice(0,8) + ' · ' + a.requested_by + ' · ' + a.created_at + '</span> ' +
+                        '<button class="btn btn-start" onclick="resolveAction(\\'' + a.id + '\\', true)">Approve</button>' +
+                        '<button class="btn btn-stop" onclick="resolveAction(\\'' + a.id + '\\', false)">Reject</button>' +
+                        '</div>'
+                    ).join('');
+                })
+                .catch(() => {});
+        }
+
+        function resolveAction(id, approve) {
+            const path = approve ? 'approve' : 'reject';
+            fetch('/api/v1/companion/actions/' + id + '/' + path, {
+                method: 'POST',
+                headers: authHeaders(),
+                body: JSON.stringify(approve ? {} : {reason: 'rejected from dashboard'}),
+            })
+            .then(r => r.json())
+            .then(() => updateActions())
+            .catch(err => alert(err));
         }
 
         function updateStatus() {
@@ -535,16 +742,6 @@ class RemoteMonitorServer:
         self.trading_data.update(data)
         self.trading_data["last_update"] = datetime.now().isoformat()
 
-    def register_control_callback(self, action: str, callback: Callable):
-        """
-        Register callback for remote control actions.
-
-        Args:
-            action: Action name ('start_trading', 'stop_trading', etc.)
-            callback: Callback function
-        """
-        self.control_callbacks[action] = callback
-
     def register_alert_callback(self, callback: Callable):
         """
         Register callback for alerts.