@interactive-inc/claude-funnel 0.29.0 → 0.30.0

package/dist/index.d.ts

@@ -1122,7 +1122,8 @@ declare class FunnelGateway {
 type Deps$3 = {
   channels: FunnelChannels;
   settings: FunnelSettingsReader;
-  port?: number; /** SQLite event store file path. Parent directory is created on demand. Defaults to `<os.tmpdir()>/funnel/events.db`. Ignored when `eventLog` is supplied. */
+  port?: number; /** Bind address for `Bun.serve`. Defaults to `127.0.0.1` (loopback only). Set to `0.0.0.0` to expose on the network. */
+  hostname?: string; /** SQLite event store file path. Parent directory is created on demand. Defaults to `<os.tmpdir()>/funnel/events.db`. Ignored when `eventLog` is supplied. */
   dbPath?: string; /** Durable replay log. Defaults to a `SqliteFunnelEventLog` at `dbPath`. Inject a `MemoryFunnelEventLog` (or any `FunnelEventLog`) to swap or disable persistence. */
   eventLog?: FunnelEventLog;
   process?: FunnelProcessRunner;
@@ -1163,6 +1164,7 @@ declare class FunnelGatewayServer {
   private readonly channels;
   private readonly settings;
   private readonly port;
+  private readonly hostname;
   private readonly dbPath;
   private readonly process?;
   private readonly logger;
@@ -1445,7 +1447,8 @@ declare class Funnel {
    * useful for tests, embedding, or custom hosts.
    */
   gatewayServer(options?: {
-    port?: number;
+    port?: number; /** Bind address. Defaults to `127.0.0.1` (loopback only). Set to `0.0.0.0` to expose on the network. */
+    hostname?: string;
     dbPath?: string;
     killCompetingSlack?: boolean; /** Override the auth token. Defaults to the persisted gateway.token. Pass "" to disable auth (tests). */
     token?: string; /** Durable replay log. Defaults to a SqliteFunnelEventLog at dbPath; inject a MemoryFunnelEventLog (or any FunnelEventLog) to swap or disable persistence. */

package/dist/index.js

@@ -187,7 +187,7 @@ var FunnelSettingsStore = class extends FunnelSettingsReader {
 			...settings,
 			version: 1
 		};
-		this.fs.writeFileSync(this.path, `${JSON.stringify(versioned, null, 2)}\n`);
+		this.fs.writeSecretFileSync(this.path, `${JSON.stringify(versioned, null, 2)}\n`);
 	}
 };
 //#endregion
@@ -3047,6 +3047,13 @@ const gatewayRoutes = factory$1.createApp().get("/health", ...healthHandler).get
 //#endregion
 //#region lib/gateway/gateway-server.ts
 const DEFAULT_PORT = 9742;
+const DEFAULT_HOST = "127.0.0.1";
+const LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
 const defaultDbPath = () => join(funnelTmpDir(), "events.db");
 const defaultOnError = () => {};
 /**
@@ -3063,6 +3070,7 @@ var FunnelGatewayServer = class {
 	channels;
 	settings;
 	port;
+	hostname;
 	dbPath;
 	process;
 	logger;
@@ -3082,6 +3090,7 @@ var FunnelGatewayServer = class {
 		this.channels = deps.channels;
 		this.settings = deps.settings;
 		this.port = deps.port ?? DEFAULT_PORT;
+		this.hostname = deps.hostname ?? DEFAULT_HOST;
 		this.dbPath = deps.dbPath ?? defaultDbPath();
 		this.process = deps.process;
 		this.logger = deps.logger;
@@ -3126,10 +3135,12 @@ var FunnelGatewayServer = class {
 	}
 	async start() {
 		if (this.server) return this.server;
+		if (!this.token && !LOOPBACK_HOSTS.has(this.hostname)) this.logger?.warn("gateway auth is disabled on a non-loopback bind — every endpoint is reachable without a token", { hostname: this.hostname });
 		const app = this.buildApp();
 		this.startedAt = this.nowMs();
 		this.server = Bun.serve({
 			port: this.port,
+			hostname: this.hostname,
 			development: false,
 			fetch: (request, server) => this.handleFetch(request, server, app),
 			websocket: {
@@ -3734,6 +3745,7 @@ var Funnel = class Funnel {
 			channels: this.channels,
 			settings: this.store,
 			port: options.port,
+			hostname: options.hostname,
 			dbPath: options.dbPath,
 			eventLog: options.eventLog,
 			process: this.process,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@interactive-inc/claude-funnel",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Hub CLI that routes external events (Slack / GitHub / Discord) to Claude Code agents through subscription channels over MCP.",
   "keywords": [
     "bun",