Feature/web based onboarding by DonSidro · Pull Request #9 · Python-roborock/local_roborock_server

DonSidro · 2026-04-16T22:46:33Z

Added a web based onboarding to help people that doesn't/dont know how to use CLI.

Also updated onboarding.md to reflect the web based onboarding.

Configure Page

Select vacuum Page

Send onboarding Page

Reconnect and poll Page

Done Page

Has been tested on one device onboarding, might need more testing if possible.

…ocs.

Copilot

Pull request overview

Adds a browser-based onboarding flow (served from localhost) to guide users through vacuum pairing without requiring CLI interaction, and updates the onboarding docs accordingly.

Changes:

Introduces a standalone FastAPI + Uvicorn local web server (start_onboarding_gui.py) implementing the onboarding state machine and HTTP API.
Adds a single-page web UI (ui.html) that polls state, renders step-by-step guidance, and shows a live log.
Updates documentation (docs/onboarding.md) to describe how to run and use the new web UI onboarding flow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
`ui.html`	New browser UI for configuring, selecting a device, sending onboarding, polling, and viewing logs.
`start_onboarding_gui.py`	New local FastAPI server + worker thread implementing the onboarding flow and serving UI/state.
`docs/onboarding.md`	Documents the GUI onboarding workflow, phases, and troubleshooting.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-16T22:52:04Z

+        api = RemoteOnboardingApi(
+            base_url=config.api_base_url,
+            admin_password=config.admin_password,
+            ssl_context=ssl._create_unverified_context(),


The GUI onboarding client disables TLS certificate verification by using ssl._create_unverified_context() when talking to the main server. This exposes the admin password/session cookies to MITM and differs from the CLI onboarding script which uses default verification. Please remove the unverified context (or make it an explicit opt-in for self-signed deployments, e.g. a toggle/flag + clear warning).

Suggested change

ssl_context=ssl._create_unverified_context(),

Copilot · 2026-04-16T22:52:04Z

+
+
+@app.get("/", response_class=HTMLResponse)
+async def index(request: Request) -> HTMLResponse:


The / (index) route returns the UI HTML without calling _check_token, but the docs state the token is required on every request. Consider requiring the token for the index page too (or adjust the docs) so that access control is consistent across all endpoints.

Suggested change

async def index(request: Request) -> HTMLResponse:

async def index(request: Request) -> HTMLResponse:

_check_token(request)

Copilot · 2026-04-16T22:52:04Z

+3. Starts a local server bound to localhost only.
+4. Opens your default browser to `http://127.0.0.1:<port>/?token=<token>`.
+
+The server is not reachable from your LAN. The token is required on every request, so other processes or browser tabs on the same machine cannot poke at it either. If the browser does not open on its own, copy the URL printed in the terminal (including the `?token=...` part) and open it manually.


This section says the token is required on every request, but the GUI server currently serves / without token validation (only the /api/* endpoints enforce _check_token). Either protect the index route as well or soften this statement so the documentation matches the implementation.

Suggested change

The server is not reachable from your LAN. The token is required on every request, so other processes or browser tabs on the same machine cannot poke at it either. If the browser does not open on its own, copy the URL printed in the terminal (including the `?token=...` part) and open it manually.

The server is not reachable from your LAN. The token is included in the launch URL and is required for the protected UI/API requests, so other processes or browser tabs on the same machine cannot drive the onboarding flow unless they have that URL. If the browser does not open on its own, copy the URL printed in the terminal (including the `?token=...` part) and open it manually.

Copilot · 2026-04-16T22:52:05Z

+    async function quit() {
+      if (!confirm("Shut down the local server?")) return;
+      try { await api("POST", "/api/quit"); } catch {}
+      document.body.innerHTML = '<div class="wrap"><div class="panel"><div class="panel-body"><h2>Server stopped</h2><div class="note">You can close this tab now.</div></div></div></div>';
+    }


quit() replaces document.body.innerHTML but the 1s polling interval keeps running afterwards, leading to repeated errors when poll() tries to touch DOM nodes that no longer exist. Consider storing the interval id and clearing it (and/or using a stopped flag) when quitting so polling stops cleanly.

Copilot · 2026-04-16T22:52:05Z

+        sock.sendto(wifi_pkt, target)
+        output.write(f"TOKEN_S={token_s}\n")
+        output.write(f"TOKEN_T={token_t}\n")
+        output.write(f"WIFI_BODY_SENT={json.dumps(body, separators=(',', ':'))}\n")
+


The UI log currently includes WIFI_BODY_SENT=... which serializes and displays the full onboarding payload, including the home Wi‑Fi password (passwd). Since the log is shown in the browser and returned via /api/state, please redact sensitive fields (Wi‑Fi password, tokens) before logging to reduce accidental disclosure (screenshots/copy-paste, etc.).

Copilot · 2026-04-16T22:52:05Z

+    def snapshot(self) -> list[dict[str, Any]]:
+        return [{"ts": e.ts, "level": e.level, "msg": e.msg} for e in self._entries]
+


_UILogBuffer.snapshot() reads _entries while the worker thread appends to it, but there’s no lock around these operations. Consider adding synchronization (e.g., a threading.Lock inside _UILogBuffer or reusing _state_lock) to make log snapshotting thread-safe.

Copilot · 2026-04-16T22:52:05Z

+_INDEX_HTML = (Path(__file__).parent / "ui.html").read_text(encoding="utf-8")
+
+app = FastAPI(title="Vacuum Onboarding", docs_url=None, redoc_url=None, openapi_url=None)
+


This adds a new FastAPI-driven GUI onboarding flow but there are no tests covering its API/state-machine behavior. Since the repo already tests the CLI onboarding flow, consider adding a focused test module for start_onboarding_gui.py (e.g., _build_config_from_payload validation and basic /api/* token enforcement + a couple of phase transitions via FastAPI TestClient).

Lash-L · 2026-04-17T01:01:16Z

Will test this out in a few days! I have a few things i want to get working that I will need to reauth my vacuum for, so that will be a perfect time for me to test it!

Sidon Kodraliu and others added 3 commits April 15, 2026 23:28

Add start_onboarding_gui.py for web-based onboarding. and updated d…

ceb6e84

…ocs.

Updated ui.html to reflect onboarding.md

c73cb5d

Merge branch 'Python-roborock:main' into feature/web_based_onboarding

750c5d1

Lash-L requested a review from Copilot April 16, 2026 22:47

Copilot started reviewing on behalf of Lash-L April 16, 2026 22:48 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/web based onboarding#9

Feature/web based onboarding#9
DonSidro wants to merge 3 commits intoPython-roborock:mainfrom
DonSidro:feature/web_based_onboarding

DonSidro commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Lash-L commented Apr 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants



		@app.get("/", response_class=HTMLResponse)
		async def index(request: Request) -> HTMLResponse:

	async def index(request: Request) -> HTMLResponse:
	async def index(request: Request) -> HTMLResponse:
	_check_token(request)

	The server is not reachable from your LAN. The token is required on every request, so other processes or browser tabs on the same machine cannot poke at it either. If the browser does not open on its own, copy the URL printed in the terminal (including the `?token=...` part) and open it manually.
	The server is not reachable from your LAN. The token is included in the launch URL and is required for the protected UI/API requests, so other processes or browser tabs on the same machine cannot drive the onboarding flow unless they have that URL. If the browser does not open on its own, copy the URL printed in the terminal (including the `?token=...` part) and open it manually.

		def snapshot(self) -> list[dict[str, Any]]:
		return [{"ts": e.ts, "level": e.level, "msg": e.msg} for e in self._entries]

		_INDEX_HTML = (Path(__file__).parent / "ui.html").read_text(encoding="utf-8")

		app = FastAPI(title="Vacuum Onboarding", docs_url=None, redoc_url=None, openapi_url=None)

Conversation

DonSidro commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Lash-L commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Lash-L commented Apr 17, 2026 •

edited

Loading