mirror of https://github.com/HKUDS/nanobot.git synced 2026-05-19 16:12:30 +00:00

chengyongru 4efd904ccc fix(webui): require token_issue_secret for LAN access with frontend auth

When host is set to 0.0.0.0, the gateway now enforces that either token
or token_issue_secret must be configured — it refuses to start otherwise.

Bootstrap endpoint behavior:
- token_issue_secret configured: always validate regardless of source IP
  (handles reverse-proxy scenarios where all connections appear as localhost)
- No secret: only localhost can bootstrap (local dev mode)

The frontend shows an authentication form when bootstrap returns 401/403,
persists the secret in localStorage, and retries automatically on reload.

2026-05-06 23:51:51 +08:00

2.7 KiB

Raw Permalink Blame History

nanobot webui

The browser front-end for the nanobot gateway. It is built with Vite + React 18 + TypeScript + Tailwind 3 + shadcn/ui, talks to the gateway over the WebSocket multiplex protocol, and reads session metadata from the embedded REST surface on the same port.

For the project overview, install guide, and general docs map, see the root README.md.

Current status

Note

The standalone WebUI development workflow currently requires a source checkout.

WebUI changes in the GitHub repository may land before they are included in the next packaged release, so source installs and published package versions are not yet guaranteed to move in lockstep.

Layout

webui/                 source tree (this directory)
nanobot/web/dist/      build output served by the gateway

Develop from source

1. Install nanobot from source

From the repository root:

pip install -e .

2. Enable the WebSocket channel

In ~/.nanobot/config.json:

{ "channels": { "websocket": { "enabled": true } } }

3. Start the gateway

In one terminal:

nanobot gateway

4. Start the WebUI dev server

In another terminal:

cd webui
bun install            # npm install also works
bun run dev

Then open http://127.0.0.1:5173.

By default, the dev server proxies /api, /webui, /auth, and WebSocket traffic to http://127.0.0.1:8765.

If your gateway listens on a non-default port, point the dev server at it:

NANOBOT_API_URL=http://127.0.0.1:9000 bun run dev

Access from another device (LAN)

To use the webui from another device on the same network, set host to "0.0.0.0" and configure a token or tokenIssueSecret in ~/.nanobot/config.json:

{
  "channels": {
    "websocket": {
      "enabled": true,
      "host": "0.0.0.0",
      "port": 8765,
      "tokenIssueSecret": "your-secret-here"
    }
  }
}

The gateway will refuse to start if host is "0.0.0.0" and neither token nor tokenIssueSecret is set.

Then open http://<your-ip>:8765 on the other device. The webui will show an authentication form where you enter the secret. It is saved in your browser so you only need to enter it once.

Build for packaged runtime

cd webui
bun run build

This writes the production assets to ../nanobot/web/dist, which is the directory served by nanobot gateway and bundled into the Python wheel.

If you are cutting a release, run the build before packaging so the published wheel contains the current WebUI assets.

Test

cd webui
bun run test

Acknowledgements

agent-chat-ui for UI and interaction inspiration across the chat surface.

2.7 KiB Raw Permalink Blame History