Python: [BREAKING] Python: DevUI improvements

[moonbox3]

Motivation and Context

Small improvements for DevUI startup behavior.

Description

Updates DevUI startup handling, CLI help, and package guidance so local opt-out behavior stays local and shared-host usage is explicit.

Adds focused coverage for the server, serve(), and CLI paths.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the Contribution Guidelines
• All unit tests pass, and I have added new tests where possible
• Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

[Copilot]

Pull request overview

Tightens DevUI's startup security model so that disabling auth (--no-auth or auth_enabled=False) and relying on auto-generated tokens are restricted to loopback binds; non-loopback hosts now hard-fail unless an explicit DEVUI_AUTH_TOKEN/--auth-token is provided. Validation moves from serve() into DevServer.__init__ so all entry points (CLI, serve(), direct DevServer use) share the invariant. Documentation and CLI help are updated, and focused tests cover the new server, serve(), and CLI paths.

Changes:

• Move loopback/auth validation into DevServer._resolve_auth_token and remove the duplicated serve() checks; raise ValueError for non-loopback --no-auth or missing token.
• Update CLI help and README/dev/AGENTS docs to reflect loopback-only no-auth and the explicit-token requirement for shared hosts (including Authorization: Bearer examples).
• Add server, serve(), and CLI tests for accept/reject paths around loopback vs. non-loopback hosts.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
python/packages/devui/agent_framework_devui/_server.py	Centralizes auth invariant in _resolve_auth_token, host-aware loopback check, error messages
python/packages/devui/agent_framework_devui/init.py	Removes now-redundant warnings/validation from serve(); relies on DevServer
python/packages/devui/agent_framework_devui/_cli.py	Updates --no-auth and --auth-token help text
python/packages/devui/tests/devui/test_server.py	Adds tests for loopback/non-loopback auth validation across DevServer, serve(), and CLI
python/packages/devui/README.md	Documents new auth defaults, shared-host guidance, updated CLI options/examples
python/packages/devui/dev.md	Adds Bearer token usage notes and --no-auth loopback caveat
python/packages/devui/AGENTS.md	Adds short security posture summary

[moonbox3]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	33944	3910	88%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
6702	30 💤	0 ❌	0 🔥	1m 49s ⏱️

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 90% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Design Approach

---

Automated review by moonbox3's agents