Summary

• add vidxp-api --share with an app-managed reusable bearer token, detected LAN binding, trusted-host configuration, and printed health/MCP connection details
• make vidxp ui loopback-only by default and add an explicit unauthenticated --share mode using Streamlit's wildcard bind and native URL output
• suppress Streamlit's first-run email prompt and usage-statistics collection for VidXP-managed launches
• move the native API default from collision-prone port 8000 to 32191 while retaining port 8000 explicitly for container deployments; add vidxp-api --port
• return a public empty favicon response so browser health checks do not create misleading authentication failures
• document local versus LAN behavior, authentication, token storage, and HTTP limitations

Root cause and impact

The API only exposed low-level environment configuration for non-loopback serving, while the UI inherited Streamlit's wildcard default and could become LAN-accessible without an explicit VidXP choice. The API also used Uvicorn's heavily reused development port, increasing collision risk for native installs. This change makes network exposure intentional and self-contained, protects API/MCP access with a generated token, keeps the browser UI local unless explicitly shared, and uses a lower-collision native port.

LAN traffic remains plain HTTP and share mode prints a warning. The browser UI remains unauthenticated and is labeled accordingly.

Validation

• uv run --no-sync python -m unittest tests.test_api_cli tests.test_network_share tests.test_cli tests.test_api tests.test_authentication tests.test_mcp (106 passed)
• uv run --no-sync python -m unittest tests.test_packaging (10 passed)
• targeted Ruff checks passed
• git diff --check passed
• manually verified /health from another LAN machine