@threadbase-sh/streamer 1.52.1 → 1.52.3

package/README.md

@@ -35,7 +35,7 @@ node dist/cli.cjs serve --verbose --local-no-auth
 
 #### Server address
 
-The server listens on `http://localhost:8766` (WebSocket at `ws://localhost:8766/ws`).
+By default, the server listens on port `8766` on all interfaces (WebSocket path: `/ws`).
 
 #### Automatic updates
 
@@ -43,7 +43,7 @@ npm and Homebrew installs can auto-update: [docs/guides/auto-update.md](docs/gui
 
 ## Remote Access
 
-The server listens on port 8766 on all interfaces, so devices on the same LAN can already reach it. To let the mobile app reach it from *outside* your LAN, expose it via a tunnel — the fastest is a Cloudflare quick-tunnel (no account needed):
+The server listens on port 8766 on all interfaces by default, so devices on the same LAN can already reach it. To restrict it to this machine, start it with `tb-streamer serve --host 127.0.0.1`. To let the mobile app reach it from *outside* your LAN, expose it via a tunnel — the fastest is a Cloudflare quick-tunnel (no account needed):
 
 > **Before you do this, read [Security](#security--read-this-before-exposing-the-server).** A tunnel makes the server reachable from the public internet, and the API key is the only thing between a stranger and a shell on this machine.
 
@@ -72,11 +72,15 @@ npm run db:validate       # check for missing/duplicate/orphaned project_id data
 
 The key lives at `~/.threadbase/server.yaml` as plaintext (`chmod 0600`), which is the same posture as `~/.aws/credentials` or `~/.npmrc`. Rotate it with `POST /api/auth/rotate` if it leaks; re-pair your devices afterwards.
 
-**The server listens on all network interfaces**, not just loopback — `httpServer.listen(port)` is called without a host, which is Node's listen-everywhere default, and there is currently no flag to narrow it. So every device on your LAN can already reach port 8766, and the API key is the only thing stopping them. On a home network that is usually fine; on café Wi-Fi, a co-working space, or a corporate VLAN it is not.
+**The server listens on all network interfaces by default**, not just loopback. So every device on your LAN can already reach port 8766, and the API key is the only thing stopping them. On a home network that is usually fine; on café Wi-Fi, a co-working space, or a corporate VLAN it is not. To bind only to loopback, run:
+
+```bash
+tb-streamer serve --host 127.0.0.1
+```
 
 **A tunnel extends that to the entire internet.** From that moment the key is the only thing between a stranger and your filesystem.
 
-If you need it strictly local today, bind it yourself at the firewall or run it inside a network namespace — the server will not do it for you. Tracked as [#517](https://github.com/RonenMars/threadbase-streamer/issues/517).
+For stricter network policies, also use your firewall or a network namespace.
 
 ### There is no spend limit
 

package/dist/cli.cjs

@@ -152274,6 +152274,7 @@ var StreamerServer = class {
   dbPool = null;
   dbInstanceId = null;
   disableDb = false;
+  host;
   // Skip the startup warm-up scan (test hook; see ServerConfig.skipStartupWarmup).
   skipStartupWarmup;
   autoResumeOnBoot;
@@ -152395,6 +152396,7 @@ var StreamerServer = class {
     }
     this.verbose = config2.verbose ?? false;
     this.disableDb = config2.disableDb ?? false;
+    this.host = config2.host;
     this.skipStartupWarmup = config2.skipStartupWarmup ?? false;
     this.autoResumeOnBoot = config2.autoResumeOnBoot ?? false;
     this.scanProfiles = config2.scanProfiles;
@@ -153047,7 +153049,7 @@ var StreamerServer = class {
       await runMigrations2(this.dbPool);
       this.log.info("Database migrations applied", { event: "db.migrations_applied" });
     }
-    await this.bindWithRetry(port);
+    await this.bindWithRetry(port, this.host);
     if (!this.ptyManager.isRemote()) {
       this.idleReaperTimer = setInterval(() => this.reapIdleSessions(), IDLE_REAP_SWEEP_MS);
       this.idleReaperTimer.unref?.();
@@ -153056,7 +153058,8 @@ var StreamerServer = class {
       {
         this.log.info(`Streamer server listening on port ${port}`, {
           port,
-          event: "server.listening"
+          event: "server.listening",
+          ...this.host !== void 0 && { host: this.host }
         });
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
@@ -153270,15 +153273,15 @@ var StreamerServer = class {
   // Bind the HTTP listener, retrying on a transient EADDRINUSE. See the call
   // site in listen() for why the race exists (kickstart -k relaunch). Total
   // worst case ≈ 6 × 500 ms = 3 s before the final attempt rethrows.
-  async bindWithRetry(port, attempts = 6, delayMs = 500) {
+  async bindWithRetry(port, host, attempts = 6, delayMs = 500) {
     this.binding = true;
     try {
-      await this.bindWithRetryLoop(port, attempts, delayMs);
+      await this.bindWithRetryLoop(port, host, attempts, delayMs);
     } finally {
       this.binding = false;
     }
   }
-  async bindWithRetryLoop(port, attempts, delayMs) {
+  async bindWithRetryLoop(port, host, attempts, delayMs) {
     for (let attempt = 1; attempt <= attempts; attempt++) {
       try {
         await new Promise((resolve4, reject) => {
@@ -153292,7 +153295,11 @@ var StreamerServer = class {
           };
           this.httpServer.once("error", onError);
           this.httpServer.once("listening", onListening);
-          this.httpServer.listen(port);
+          if (host === void 0) {
+            this.httpServer.listen(port);
+          } else {
+            this.httpServer.listen(port, host);
+          }
         });
         return;
       } catch (err) {
@@ -153300,13 +153307,18 @@ var StreamerServer = class {
         if (e.code === "EADDRINUSE" && attempt === attempts) {
           this.log.error(
             `port ${port} still busy (EADDRINUSE) after ${attempts} attempts; giving up`,
-            { port, attempts, event: "server.bind_failed" }
+            {
+              port,
+              attempts,
+              event: "server.bind_failed",
+              ...host !== void 0 && { host }
+            }
           );
         }
         if (e.code !== "EADDRINUSE" || attempt === attempts) throw err;
         this.log.debug?.(
           `port ${port} busy (EADDRINUSE), retry ${attempt}/${attempts - 1} in ${delayMs}ms`,
-          { port, attempt, event: "server.bind_retry" }
+          { port, attempt, event: "server.bind_retry", ...host !== void 0 && { host } }
         );
         await new Promise((r) => setTimeout(r, delayMs));
       }
@@ -157841,7 +157853,7 @@ function registerProdCommands(program3) {
 var log14 = getLogger("cli");
 var program2 = new Command();
 program2.name("threadbase-streamer").description("PTY session management, WebSocket streaming, and REST API server for Claude Code").version(getVersion());
-program2.command("serve").description("Start the streamer server").option("-p, --port <number>", "Port to listen on", "8766").option("--api-key <key>", "API key for authentication").option("--local-no-auth", "Skip auth for localhost requests", false).option("-v, --verbose", "Verbose output", false).option("--log-menubar-requests", "Log /healthz requests from the menubar app", false).option("--browse-root <path>", "Root directory for file browsing").option(
+program2.command("serve").description("Start the streamer server").option("-p, --port <number>", "Port to listen on", "8766").option("--host <address>", "Host/address to bind the server to (default: all interfaces)").option("--api-key <key>", "API key for authentication").option("--local-no-auth", "Skip auth for localhost requests", false).option("-v, --verbose", "Verbose output", false).option("--log-menubar-requests", "Log /healthz requests from the menubar app", false).option("--browse-root <path>", "Root directory for file browsing").option(
   "--public-url <url>",
   "Public URL clients should use to reach this server (https:// required, except localhost). Falls back to THREADBASE_PUBLIC_URL env or public_url: in ~/.threadbase/server.yaml."
 ).option(
@@ -158029,6 +158041,7 @@ program2.command("serve").description("Start the streamer server").option("-p, -
   }
   const server = new StreamerServer({
     port: resolvedPort,
+    host: opts.host,
     apiKey,
     apiKeySource: opts.apiKey ? "cli" : "config",
     localNoAuth: opts.localNoAuth,