Harden the backend, modernise the frontend, and make LLM setup a choice from a list

[sim186]

Started as a review of where AmicoScript was weakest, then grew into fixing those, shipping three requested features, reworking LLM configuration, and running the app end to end to see what that turned up.

79 files changed · 439 tests passing (was 128).

🔐 Access control

AmicoScript now refuses network requests until a password is set. The project documents a Traefik deployment on a public domain, but every API route was open there — anyone who found the hostname could read the library, download the audio, and read the stored Hugging Face token straight out of GET /api/settings.

Requests from the machine AmicoScript runs on behave exactly as before: no password, no prompt. Requests from anywhere else are refused with an explanation until a password exists. Exposing the app unconfigured now fails closed.

• Security panel to set, change or remove the password, plus an API token for headless clients
• AMICOSCRIPT_AUTH=auto|always|off, AMICOSCRIPT_PASSWORD for startup
• Secrets are no longer echoed to clients — settings report whether a token is stored, never its value
• Login throttling; the loopback check reads the direct peer address, never X-Forwarded-For

🧠 LLM setup that does not require guesswork

• Nine provider presets — Ollama, LM Studio, Unsloth Studio, llama.cpp, vLLM, Jan, LocalAI, OpenRouter, and anything OpenAI-compatible. Each fills in its address, states whether a key is required and what it looks like, and links to that tool's setup guide.
• Find running servers scans the well-known ports, reports what answered and which models it has, and adopts it in one click. A server answering 401 still shows up, marked as needing a key — Unsloth Studio's normal state.
• The /v1 trap is gone. Every one of these tools displays a URL ending in /v1, but AmicoScript appends /v1/chat/completions itself, so pasting what LM Studio showed you produced /v1/v1/… and a 404 that looked like a broken server. All four forms now resolve to the same thing, with the change explained.
• Docker works out of the box. docker-compose.yml maps host.docker.internal to the host gateway (Docker Desktop provides it, Linux does not), and the app rewrites localhost addresses when containerised, saying so.
• Hosted providers are gated. Audio never leaves your machine either way, but OpenRouter receives the transcript text — that takes an explicit confirmation, and analyses refuse to run without it.

✨ Features

• Library export/import — the whole library as one zip you can back up or move between machines. Import matches by id, so re-importing is a no-op. Bundles deliberately exclude settings.json.
• WebVTT and CSV exports — VTT uses <v Name> voice spans; CSV ships with a BOM for Excel and defuses formula injection in transcript text.
• Automatic meeting summaries — optional, fires only for captured calls with an LLM configured, once per recording.

🔧 Reliability

• A restart no longer destroys work in progress. Interrupted recordings were flipped to error with no explanation. Anything whose audio is on disk is requeued; anything unresumable is marked interrupted with a reason.
• Failed transcriptions can be retried — the audio was always still on disk, but recovery meant delete-and-re-upload.
• Long transcripts stop being silently truncated. A one-hour meeting is ~12k tokens against Ollama's 4096 default, so the model dropped the beginning and returned a confident summary of the last few minutes. Oversized transcripts are now map-reduced.
• Search survives punctuation. covid-19, C++, hello "world and a bare AND were FTS5 syntax errors that silently downgraded the query.
• Versioned migrations replace ad-hoc ALTER TABLE wrapped in except: pass, which left broken databases looking healthy.
• URL imports download while the previous job transcribes — inference stays serialized, fetching does not.

🧹 Maintenance

• The frontend is 20 ES modules instead of one 4,800-line inline <script>. Still no build step, no bundler. Split with a real JS parser computing the import graph, then verified against the pre-split page for behavioural parity.
• Route-level tests. The suite had 128 unit tests over helpers and none that exercised an HTTP route; test_search_escaping.py re-implemented the code it claimed to test.
• CI runs the whole suite — the workflow named ten files explicitly, so everything added since was never run.

🐛 Found by actually running the app

Drove the real application in a browser — upload, live transcription, editing, all six exports, folders, tags, search, backup round trip — with only Whisper inference stubbed (huggingface.co is blocked in the dev sandbox).

• Creating a duplicate tag returned HTTP 500; now a 409 naming the clash
• API errors were shown as raw JSON: Save failed: {"detail":"…"}
• Password fields were not inside a form and had no username field
• No retry path, invisible status reasons, no origin badge on recordings

⌨️ The TUI

Auditing it turned up a regression this branch introduced: masking secrets broke the settings form, so opening it and pressing Save erased the stored Hugging Face token. Fixed, plus /retry, /backup export|import, /llm-providers, /llm-detect, VTT/CSV export, the new status marks, and readable transport errors.

---

Reviewer notes

• Auth trusts loopback by default. On a shared multi-user machine you'd want AMICOSCRIPT_AUTH=always.
• GET /api/settings changed shape — hf_token is now hf_token_set + hf_token_preview; GET /api/llm/settings reports llm_api_key_set. Any other client reading those fields needs the same treatment the TUI got.
• Not included: the speaker library and library-wide RAG from the original review. Both are at the top of docs/ROADMAP.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JmgRm98BjMyfRok7eN9L12

---

Generated by Claude Code