[openpilotcc]

Summary

Accessing LeLab from another machine over plain HTTP on a LAN IP (e.g. http://<server-ip>:8000/) rendered a completely blank page: correct <title> and favicon, empty #root, no visible errors, while the backend log showed every request succeeding. Beyond the frontend, the launcher always bound to 127.0.0.1 on port 8000, so the server could not even be reached from other machines, or started at all if :8000 was taken. This PR fixes the frontend issues and adds --host / --port flags so the network-access story works end to end.

Root causes

1. crypto.randomUUID is undefined in insecure contexts. SingleTabGuard calls it unconditionally in its mount effect, but the API is only exposed in secure contexts (HTTPS or localhost). On http://<lan-ip>:8000 the effect throws a TypeError, React unmounts the whole tree, and the page goes blank. localhost access works, which is why it went unnoticed.
2. The fallback API base URL is hardcoded to http://localhost:8000. Even with (1) fixed, a browser on another machine resolved every API call against its own localhost, where nothing listens.
3. The launcher binds to 127.0.0.1:8000 unconditionally. There was no way to expose the server to the network or move it off a taken port.

Changes

• SingleTabGuard.tsx: feature-detect crypto.randomUUID and fall back to a crypto.getRandomValues-based v4 UUID. The id is only used for tab election, so it does not need crypto-grade randomness, and getRandomValues is available in insecure contexts.

• ApiContext.tsx: default the base URL to window.location.origin in production, since lelab serves the UI and the API on the same origin (also covers access via hostname or other NICs). Two cases deliberately keep the localhost:8000 default:

  • --dev (Vite on :8080, API on :8000);
  • the HF Space, which serves only the UI and is driven via ?api= (detected with the existing isHostedSpace() helper).

  The ?api= query param and the stored override keep their current precedence in all cases.

• lelab/scripts/lelab.py: new --host and --port options, defaults 127.0.0.1 / 8000 (behavior unchanged unless opted in). lelab --host 0.0.0.0 --port 9000 binds the backend to the requested interface and port; in --dev, --host also applies to the Vite server and --port selects the backend port that the dev frontend's ?api= URL points to. lelab --stop --port N frees a matching custom backend port. Readiness probes and the auto-opened browser stay on loopback, which a wildcard-bound socket accepts anyway.

• README.md: a "Custom host and port" section in Quick Start documenting both flags.

Testing

• pytest tests/test_scripts_lelab.py: 23 pass (6 new: parser defaults, --host / --port parsing, custom host and port threaded through both prod and dev launchers, dev browser URL pointing at the custom API port, --stop port matching).
• ruff check and ruff format --check: clean.
• npm run test: 17 files / 58 tests pass; npx tsc -b and eslint output is identical to main (remaining findings are pre-existing); npm run build succeeds.
• End-to-end: built this branch, served it from a LAN host, and opened it in a browser with empty localStorage. The full UI renders, API calls hit the serving origin, and the joint-data WebSocket connects. The same build still works via localhost:8000.