Repository navigation
[codex] Fix chat framework safety and preset switching - #3
Merged
Merged
Conversation
Owner
Author
|
Review summary:
Note: GitHub does not allow approving your own PR, so this is recorded as a review summary comment instead. |
There was a problem hiding this comment.
Pull request overview
This PR hardens the local chat app by defaulting the backend to loopback-only access with restricted CORS, improves OpenAI-compatible API URL/model discovery behavior, and increases provider compatibility via automatic request fallbacks.
Changes:
- Bind server to
127.0.0.1by default, add an allowlist-based CORS policy (with optionalALLOWED_ORIGINS). - Normalize API base URLs, fetch models from
/v1/modelsfirst, and add retry fallbacks for multimodal/thinking parameter incompatibilities. - Align upload UI with parseable file types, fix regenerate to avoid duplicating the last user message, and improve API preset switching/key handling.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| start.bat | Opens the app at 127.0.0.1 instead of localhost. |
| README.md | Updates Quick Start URL to 127.0.0.1. |
| frontend/js/app.js | File-type gating + accept sync, refactored API message building, regenerate fix, preset switching/key handling. |
| frontend/index.html | Narrows <input type="file"> accept list to match supported types. |
| backend/server.js | Loopback host binding, CORS allowlist, API URL normalization, /v1/models discovery with fallback, chat retry fallbacks, upload-type enforcement. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (f.type === 'image' && f.dataUrl) parts.push({ type: 'image_url', image_url: { url: f.dataUrl } }); | ||
| else if (f.text) parts.push({ type: 'text', text: '[文件内容: ' + f.name + ']\n' + f.text }); | ||
| } | ||
| return { role: msg.role, content: parts.length > 1 ? parts : (parts[0]?.text || textContent) }; |
Comment on lines
480
to
+484
| if (p.apiBaseUrl) settingUrl.value = p.apiBaseUrl; | ||
| if (p.model) settingModel.value = p.model; | ||
| settingKey.value = (p.apiKey && p.apiKey !== 'undefined') ? p.apiKey : ''; | ||
| if (p.name) presetName.value = p.name; | ||
| if (!settingKey.value.trim()) { |
Comment on lines
+168
to
+170
| return callback(new Error('Not allowed by CORS')); | ||
| }, | ||
| })); |
| return callback(new Error('Not allowed by CORS')); | ||
| }, | ||
| })); | ||
| app.use(express.json({ limit: '2mb' })); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
127.0.0.1by default and restrict CORS to local origins plus optionalALLOWED_ORIGINS./v1/modelsfirst.Why
The app had a few rough edges that could cause local API key exposure, model-list failures, bad provider compatibility, unsupported uploads, duplicated history entries, and 401s when presets were missing their own API key.
Validation
node --check frontend/js/app.jsnpm.cmd run checkgit diff --checkGET http://127.0.0.1:3001/api/settingsreturned 200.