Skip to main content
xbot
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
Edit page

Web Channel

Browser-based chat interface with user authentication, REST API, WebSocket real-time communication, file upload, and marketplace support.

Setup

Enable

WEB_ENABLED=true
WEB_HOST=0.0.0.0
WEB_PORT=8082
WEB_PERSONA_ISOLATION=true

Authentication

Two modes:

  1. Open — Anyone can register and use the web interface.
  2. Invite-only — Admin creates accounts via /runner commands or REST API.
WEB_INVITE_ONLY=true

Feishu SSO

Users can link their account with Feishu OAuth for seamless login:

OAUTH_ENABLE=true
OAUTH_HOST=127.0.0.1
OAUTH_PORT=8081

Features

Real-time Chat

  • WebSocket-based streaming responses
  • Markdown rendering
  • Code syntax highlighting
  • Message history

File Upload

  • Max file size: 10MB
  • Upload via REST API or drag-and-drop in the UI

REST API

EndpointMethodDescription
/api/auth/registerPOSTRegister new user
/api/auth/loginPOSTLogin
/api/auth/feishu-linkPOSTLink account to Feishu
/api/historyGETGet message history
/api/historyDELETEClear history
/api/settingsGET/PUTUser settings
/api/llm-configGET/POST/DELETELLM configuration
/api/llm-config/modelPOSTSwitch model
/api/llm-max-contextGET/POSTMax context tokens
/api/files/uploadPOSTUpload file
/api/searchGETGlobal search
/api/runner/tokenGET/POST/DELETERunner token management
/api/runnersGET/POSTList/create runners
/api/market/**Marketplace (browse/install/publish)

Persona Isolation

When WEB_PERSONA_ISOLATION=true, each web user gets an isolated agent persona — their core memory, settings, and conversation history are separate from other users.

Marketplace

Users can browse, install, publish, and uninstall skills and agents through the marketplace API.

Frontend

The web frontend is built with:

  • React 19 + Vite + TailwindCSS 4
  • Located in web/ directory
  • Served as static files via WEB_STATIC_DIR

Security Notes

  • Web users (web-* IDs) are blocked from server-side sandbox access by default
  • They must connect their own remote runner for tool execution
  • Override with WEB_USER_SERVER_RUNNER=true (not recommended for production)