feat: webui multiple IP bindings

[2278535805]

The WebUI supports IPv6 and multiple IP bindings / WebUI 支持 IPv6 和绑定多 IP

Modifications / 改动点

cmd_config.json - dashboard.host str -> List[str] 支持多 IP
astrbot\core\config\astrbot_config.py 旧配置兼容
astrbot\core\config\default.py 默认同时指定 IPv4 和 IPv6
astrbot\core\utils\io.py 收集 IPv6 地址
astrbot\dashboard\server.py - 过滤 IP 和显示 IP

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

Summary by Sourcery

Support binding the WebUI to multiple IPv4/IPv6 hosts and improve network address handling.

New Features:

• Allow configuring the dashboard WebUI to bind to multiple host addresses, including IPv4 and IPv6.
• Display network URLs correctly for IPv6 addresses in the WebUI startup output.

Enhancements:

• Collect local IPv6 network addresses alongside IPv4 for WebUI discovery.
• Adjust dashboard host handling and password-skip logic to work with lists of hosts instead of a single host value.
• Update default dashboard configuration to bind to both IPv4 and IPv6 by default and migrate legacy single-host configs to the new format.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In dashboard.server.run, ip_addr can be referenced before assignment when all hosts are local (subset of local_hosts) or when get_local_ip_addresses() raises, since the subsequent IPv4/IPv6 filtering and later loop over ip_addr are unconditional; consider guarding those branches or initializing ip_addr safely.
• The host list parsing logic (string vs list, comma splitting, stripping) is duplicated in dashboard.server.run and auth_service.can_skip_default_password_auth; consider extracting a shared helper to keep behavior consistent and easier to maintain.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `dashboard.server.run`, `ip_addr` can be referenced before assignment when all `hosts` are local (subset of `local_hosts`) or when `get_local_ip_addresses()` raises, since the subsequent IPv4/IPv6 filtering and later loop over `ip_addr` are unconditional; consider guarding those branches or initializing `ip_addr` safely.
- The host list parsing logic (string vs list, comma splitting, stripping) is duplicated in `dashboard.server.run` and `auth_service.can_skip_default_password_auth`; consider extracting a shared helper to keep behavior consistent and easier to maintain.

## Individual Comments

### Comment 1
<location path="astrbot/dashboard/server.py" line_range="593-602" />
<code_context>
             )

-        if host not in ["localhost", "127.0.0.1"]:
+        if not set(hosts).issubset(local_hosts):
             try:
                 ip_addr = get_local_ip_addresses()
             except Exception as _:
                 pass
+
+        bound_v6 = all(":" in h for h in hosts)
+        bound_v4 = all(":" not in h for h in hosts)
+        if bound_v6 and not bound_v4:
+            ip_addr = [ip for ip in ip_addr if ":" in ip]
+        elif bound_v4 and not bound_v6:
+            ip_addr = [ip for ip in ip_addr if ":" not in ip]
         if isinstance(port, str):
</code_context>
<issue_to_address>
**issue (bug_risk):** Potential UnboundLocalError if `ip_addr` is never initialized before being filtered and iterated.

Because `ip_addr` is only assigned inside the `if not set(hosts).issubset(local_hosts)` block and that block is wrapped in a broad `try/except` that swallows errors, `ip_addr` may be undefined when the v4/v6 filtering and subsequent iteration run. This will raise an `UnboundLocalError` when `hosts` ⊆ `local_hosts` or `get_local_ip_addresses()` fails. Initialize `ip_addr` (e.g., to an empty list or a safe default) before the conditional, and gate the v4/v6 filtering on `ip_addr` being populated.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces support for binding the WebUI dashboard to multiple hosts, enabling dual-stack IPv4 and IPv6 support by default. Key changes include migrating the default host configuration to a list, parsing IPv6 addresses in network utilities, updating Hypercorn binding logic, and adapting authentication checks for multiple hosts. The reviewer feedback suggests retrieving the dashboard configuration reference after integrity checks for safety, formatting the bound URLs more cleanly in startup logs, and refining the local IP address filtering logic to handle specific non-wildcard IP bindings more robustly.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.