@inerrata-corporation/errata 2.0.22-dev.4071 → 2.0.22-dev.4121

package/errata.mjs

@@ -33350,8 +33350,7 @@ async function embedNodesByLabels(store, labels, opts = {}) {
     versionsSeen: {}
   };
   const hashOnly = opts.mode === "hash";
-  const currentVersion = hashOnly ? EMBEDDING_VERSION : (await embedBatchWithModelOrHash(["probe"]))[0]?.version ?? "unknown";
-  const todo = [];
+  const candidates = [];
   for (const label of labels) {
     for (const node2 of store.selectNodes({
       labels: [label],
@@ -33370,15 +33369,24 @@ async function embedNodesByLabels(store, labels, opts = {}) {
         report.skippedFresh++;
         continue;
       }
-      if (!opts.force && existingVersion === currentVersion && node2.embeddingDim > 0) {
-        report.skippedFresh++;
-        continue;
-      }
-      const text = buildText(store, node2);
-      if (!text) continue;
-      const embedding = node2.embeddingDim > 0 ? store.getNode(node2.id).embedding : [];
-      todo.push(embeddingSnapshot({ ...node2, embedding }, text));
+      candidates.push({ node: node2, existingVersion });
+    }
+  }
+  if (candidates.length === 0) {
+    report.durationMs = Date.now() - started2;
+    return report;
+  }
+  const currentVersion = hashOnly ? EMBEDDING_VERSION : (await embedBatchWithModelOrHash(["probe"]))[0]?.version ?? "unknown";
+  const todo = [];
+  for (const { node: node2, existingVersion } of candidates) {
+    if (!opts.force && existingVersion === currentVersion && node2.embeddingDim > 0) {
+      report.skippedFresh++;
+      continue;
     }
+    const text = buildText(store, node2);
+    if (!text) continue;
+    const embedding = node2.embeddingDim > 0 ? store.getNode(node2.id).embedding : [];
+    todo.push(embeddingSnapshot({ ...node2, embedding }, text));
   }
   for (let i2 = 0; i2 < todo.length; i2 += BATCH_SIZE) {
     const batch = todo.slice(i2, i2 + BATCH_SIZE);
@@ -85045,7 +85053,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.22-dev.4071" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.22-dev.4121" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -87715,6 +87723,39 @@ B: ${b}`,
   };
 }
 
+// src/loopback-guard.ts
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function isLoopbackHost(host) {
+  const h = host.trim().toLowerCase();
+  const m = /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(h);
+  return !!m && LOOPBACK_HOSTNAMES.has(m[1]);
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return u.protocol === "http:" && LOOPBACK_HOSTNAMES.has(u.hostname);
+  } catch {
+    return false;
+  }
+}
+function loopbackRefusal(headers) {
+  const host = headers.get("host");
+  if (host !== null && host !== "" && !isLoopbackHost(host)) return "non-loopback Host";
+  const origin = headers.get("origin");
+  if (origin !== null && !isLoopbackOrigin(origin)) return "non-loopback Origin";
+  return null;
+}
+function withLoopbackGuard(fetchFn) {
+  return (req) => {
+    const refusal = loopbackRefusal(req.headers);
+    if (refusal) return new Response(JSON.stringify({ error: "forbidden", reason: refusal }), {
+      status: 403,
+      headers: { "content-type": "application/json" }
+    });
+    return fetchFn(req);
+  };
+}
+
 // src/daemon.ts
 async function startDaemon(opts) {
   const processStartedAt = Date.now();
@@ -87796,7 +87837,7 @@ async function startDaemon(opts) {
 }
 async function listenServer(fetchFn, port) {
   return new Promise((resolve10, reject) => {
-    const server = serve({ fetch: fetchFn, hostname: "127.0.0.1", port }, (info2) => {
+    const server = serve({ fetch: withLoopbackGuard(fetchFn), hostname: "127.0.0.1", port }, (info2) => {
       resolve10({ server, port: info2.port });
     });
     server.once(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.22-dev.4071",
+  "version": "2.0.22-dev.4121",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/resources/context-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "errata-context",
-  "version": "2.0.22-dev.4071",
+  "version": "2.0.22-dev.4121",
   "description": "A minimal 3D view of loaded Errata priors and recent graph bursts.",
   "author": {
     "name": "inErrata"

package/resources/context-plugin/SHA256SUMS

@@ -1,4 +1,4 @@
-2a7469f40a64a12ef74c4313dce84feb8ecccca9e841502b5b2e159fa098636f  .codex-plugin/plugin.json
+9f7ae426e110baef3bb27e68785897f745b77ef23fd2ee4e73188e8e6047890d  .codex-plugin/plugin.json
 a7bebae9fb01c838d6c75fc784129e28be571233fa66ff5ee8039b574f35ccf7  assets/icon.png
 fc38b64e4df1e0b72c35764bef6c4c05430d97c9009ad0ecc8a9e75b4deab232  configure-local.mjs
 73dc6028b3b070257c7c31f252d11e55a9e096f4aed0f187f10cb21716e1e6d7  dist/client.js