feat: embed reproducible WebUI bundle - #1857
Merged
Merged
Conversation
inureyes
added a commit
that referenced
this pull request
Sep 12, 2026
Record bundle decisions, review fixes, measured budgets, and development/release relocation evidence in English and Korean. Separate local static-harness validation from pending CI and downstream production startup, authentication, Safari, and real-model gates. Validated both reports against the local manifest, relocation result artifacts, implementation commits, and current PR metadata. Refs #1836, #1834
Add the pinned React, TypeScript, Vite, ESLint, Vitest, and Playwright WebUI scaffold with deterministic checked-in assets and a manifest that records toolchain versions, source digest, file hashes, and size budgets. Expose the feature-gated Rust static router API and standalone relocation harness so the production startup work can mount `/webui` later while this PR verifies MIME, ETag, cache, HEAD, routing, and path-attack behavior independently. Validation covered frontend typecheck, lint, unit, browser, bundle reproducibility, WebUI contract, feature graphs, and the focused Rust static-router tests. Refs #1834; Closes #1836
Harden the WebUI bundle after security review so the shipped default feature cannot silently lose license notices, serve a blank shell, or emit unprotected method/path errors. The bundle gate now enforces the exact Node/pnpm toolchain, hashes every generated file against the manifest, retains React runtime MIT notices in both NOTICE and embedded assets, separates initial and total JavaScript budgets, and rejects stale source digests, missing JS, debug artifacts, and active external-origin references. The static router now handles 405 responses itself, validates malformed encoded paths before extraction, preserves security headers, accepts weak/list ETags, and refuses an unbootable index. Validation: make verify-webui-bundle; pnpm --dir webui install --frozen-lockfile; pnpm --dir webui run typecheck; pnpm --dir webui run lint; pnpm --dir webui run unit; pnpm --dir webui run browser; cargo test --profile test-fast assets_tests --features webui; cargo check --profile test-fast --no-default-features --lib; cargo fmt --check; git diff --check; blank-index and missing-JS verifier negatives against temp asset copies.
Distinguish the manifest-producing pipeline from raw Vite builds and the static harness from the later production startup integration. Document feature selection, router mounting, budgets, licensing, and honest relocated-artifact validation boundaries in English and Korean. Validated local documentation links, source header policy, cross-repository references, and whitespace. Runtime and browser acceptance remain owned by the issue implementation and root validation runs. Refs #1836, #1834
Record bundle decisions, review fixes, measured budgets, and development/release relocation evidence in English and Korean. Separate local static-harness validation from pending CI and downstream production startup, authentication, Safari, and real-model gates. Validated both reports against the local manifest, relocation result artifacts, implementation commits, and current PR metadata. Refs #1836, #1834
inureyes
force-pushed
the
feature/issue-1836-webui-bundle
branch
from
September 12, 2026 04:49
c019fd3 to
2580cf1
Compare
This was referenced Sep 12, 2026
inureyes
added a commit
that referenced
this pull request
Sep 14, 2026
…clean (#1889) ## Summary Restores the `OpenXLA feature compile` CI job, which has failed on `main` since 2026-09-12 16:12 and therefore fails on every open PR. No behavior changes on any feature set. ## Cause The job's second step is `cargo check --no-default-features --features xla-diagnostics --all-targets` under `RUSTFLAGS="-D warnings"`. Because `default = ["surgery", "webui"]`, that step builds with the WebUI off. The last success on `main` was `9ead2b7d` (2026-09-12 04:43) and the first failure `70386ac6` (2026-09-12 16:12). The only commits between them are the WebUI series: #1857, #1860, #1865, #1868, #1864. They registered their routes behind `#[cfg(feature = "webui")]` but left the handlers, validators, constants, request types and imports those routes use outside the gate. With `webui` off all of it is dead code, and `-D warnings` makes each an error. I checked before writing this that it was not already fixed elsewhere: current `origin/main` still carries the imports and its latest CI run still fails the job, `lablup/mlxcel-internal` was last pushed on 2026-09-10 and predates the breakage, and no merged or open PR fixes it. ## Change Every orphaned item is gated on `webui`, matching the gate its only callers already carry. - `src/server/router_server.rs`: 35 handlers, validators, constants and types, plus the `router_lifecycle`, `HeaderMap`, `Uri`, `AxumPath` and `RouterModelAction` imports only they use. - `src/server/app.rs`: six axum imports. - `src/models/mod.rs`: six detection re-exports used only by `server::webui`. `is_sequence_classification_architecture` stays ungated because `src/rerank/mod.rs` uses it. - `src/server/auth.rs`: `with_extra_key`, called only from the WebUI security setup in `startup.rs`. - `src/server/router_server_tests.rs`: `restore_env_var`, used only by a webui-gated test. Gating the first layer exposed a second layer of imports that only the gated items used, so this was iterated until the compiler reported nothing. The only deleted lines are import lists being split; no logic is touched. ## Verification Reproduced first on `main`: `cargo check --no-default-features --features cuda --lib --tests` reports 42 warnings in the `mlxcel` crate. After the change, every `cargo check` below reports zero warnings and zero errors in workspace crates: | features | targets | |---|---| | `--no-default-features --features cuda` | `--lib --tests` | | `--features cuda` (defaults on) | `--lib --tests` | | `--no-default-features --features cuda,webui` | `--lib --tests` | | `--no-default-features --features cuda,surgery` | `--lib --tests` | | `--no-default-features --features cuda` | `--all-targets` | | `--features cuda` (defaults on) | `--all-targets` | The `--all-targets` rows cover bins, benches and examples, where a gated item used by another target would have been a hard compile error rather than a warning. `cargo fmt --all -- --check` is clean. Not built locally: the `xla-iree` feature itself. The `OpenXLA feature compile` job on this PR is the check for it, and it is the job this PR exists to turn green. ## Follow-up for open PRs PR #1872 edits `src/server/router_server.rs` and carries the same imports, so it will need a rebase once this lands. A rebase request will be posted there.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundle the WebUI foundation without adding a runtime Node dependency. Cargo embeds the same committed assets in debug and release; production startup mounting remains assigned to #1838.
Implementation
webuifeature and reusable static router with prefix-safe routing, HEAD, weak/list ETags, cache policy, security headers and malformed-path rejection.Validation
Closes #1836
Refs #1834