Skip to content

New UI - #19

Merged
dimittal merged 2 commits into
mainfrom
new_ui
Aug 11, 2026
Merged

New UI#19
dimittal merged 2 commits into
mainfrom
new_ui

Conversation

@dimittal

Copy link
Copy Markdown
Contributor

No description provided.

dimittal and others added 2 commits August 11, 2026 08:27
Streamlit was capping how good this could look and how easily it could be
changed. Every visual decision went through framework selectors, the map went
through a wrapper that could not be styled, and nothing had a URL.

The rendering layer is replaced; the view-model is not. `view.py` was already
free of Streamlit and fully tested, so it carries over untouched and stays the
contract — only `app.py`'s 642 lines of widget calls were thrown away.

What this buys beyond appearance:

  every view has a URL   /<index>/schema, /<index>/explore?q=…&t=…,
                         /<index>/entity/<id>, /<index>/map?focus=<id>. Tabs,
                         filters, an entity and a focused map are all linkable,
                         the back button works, and a demo can be sent as a
                         link. Under Streamlit all of this was session state.
  the index is a route   /<name> is a path parameter rather than something
                         parsed out of a URL the browser reported over a
                         websocket. The bug where every path served whichever
                         brain sorted first is now unrepresentable.
  no websocket           pages are HTML and render on first byte; the map's
                         data is fetched separately, so a large graph cannot
                         stop the page from appearing.
  a real 404             an unknown index or a deleted entity says so with a
                         status code, rather than a 200 that reads as empty.

The endpoint on the help tab now comes from the request and honours
X-Forwarded-Proto, so a TLS-terminating proxy no longer advertises an http://
endpoint for an https:// page.

Design is a token sheet — light and dark, no build step. Tailwind would have
meant a Node toolchain in a pip-installable package, which is the property that
made server-rendering attractive in the first place. The map is Cytoscape,
vendored so the package stays installable and usable offline.

Deployment is unchanged on purpose: same `open-index ui`, same port, same
OPEN_INDEX_BRAINS_ROOT, so containers and proxy config carry over as-is.

Drops the streamlit and streamlit-agraph dependencies.
513 tests pass; view.py at 100%, web.py at 96%.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two things found looking at it running.

The map's tooltip never appeared. map.js loaded from the body block, which
renders above the tooltip element, so getElementById returned null and the
first hover threw — the graph drew perfectly and looked inert. It loads from
the scripts block now, and creates the element if it is missing, so the same
ordering mistake cannot silently break it again.

OPEN_INDEX_HIDE_DIRECTORY=1 stops the explorer enumerating what it serves. On a
host running several unrelated indexes the names are themselves the sensitive
part — knowing that /acme-index exists is the leak, not what is in it. With it
set, / is a 404 that names nothing (not a redirect even with one index, which
would reveal which), an unknown name 404s without listing the alternatives, and
no page links to a sibling. A known name still works, so only someone already
holding one can get in.

Off by default: a self-hosted instance wants a home page listing its indexes.

This closes the UI only — a proxy publishing its own directory has to be dealt
with separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@dimittal
dimittal merged commit 97427d4 into main Aug 11, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant