[fernandogarzaaa]

What

Deep-eval pass (Oct 2026) on the built-in web UI (opendrop/ui/web.py), following the security hardening in #15.

• API-key servers were confusing to use from the browser. Since Audit fixes (Oct 2026): loopback-only origins, optional API key, no public bind without key, trust_remote_code opt-in #15 the server can require OPENDROP_API_KEY, but the UI only read a key from localStorage that the user had to set by hand in devtools. A 401 on /v1/models rendered an empty list (or "Cannot reach OpenDrop server"). New apiFetch() wrapper: on 401 it asks for the key once, stores it, and retries; a rejected key is cleared. /v1/models non-2xx now shows "API key required" / "Server error N".
• Chat errors were swallowed. /v1/chat/completions errors (e.g. no model loaded, 401, 502) were read as an SSE stream and produced an empty reply. Non-2xx now shows Error: HTTP <code>: <body> in the reply bubble.
• Phones: body is a fixed-height row flex with a 280px sidebar; under 700px the sidebar now stacks above the chat (max 45vh, scrollable).
• Accessibility: aria-label on the pull input, <label for> on the temperature / max-tokens sliders, role="log" aria-live="polite" on the message list.

No backend changes. CHANGELOG [Unreleased] updated.

Testing

• node --check on the extracted UI script: OK; module parses; all added lines are within the 100-char ruff limit.
• CI (ruff, mypy, pytest incl. tests/test_server.py::mount_web_ui) is the gate.
• testteeth: n/a (UI string only).

Not done (owner decision)

• No tag/release: publish.yml fires on tags and publishes to PyPI as opendrop, a name already owned by another project. Also pyproject/__init__ say 0.1.0b1 while CHANGELOG already has a [0.1.0b2] - 2026-05-14 section.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cafac393-4acd-40e3-9747-1c5584ed942d

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}