git-reviewer 2.13.1 → 2.14.1

package/README.md

@@ -3,9 +3,11 @@
 [![CI](https://github.com/dheerajjha/reviewer/actions/workflows/ci.yml/badge.svg)](https://github.com/dheerajjha/reviewer/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](package.json)
-[![Tests](https://img.shields.io/badge/tests-359-brightgreen.svg)](test/)
+[![Tests](https://img.shields.io/badge/tests-379-brightgreen.svg)](test/)
 [![Dependencies](https://img.shields.io/badge/dependencies-3-brightgreen.svg)](package.json)
 
+**English** · [简体中文](docs/README.zh-CN.md) · [日本語](docs/README.ja.md)
+
 When an agent writes the code, reading it becomes the bottleneck — and the tool
 built for reading a diff, the pull request, wants a branch, a remote and a push
 you are not ready to make yet.
@@ -77,6 +79,7 @@ git reviewer export [repository] [--format json|prompt]
   -p, --port <n>    Port to listen on (default 4500; falls back to a free
                     port if that one is taken)
       --no-open     Print the URL instead of opening a browser
+      --staged      Review only staged changes (HEAD vs index)
   -f, --format <f>  Export format: json (default) or prompt
   -h, --help        Show help
   -v, --version     Show the version
@@ -91,6 +94,15 @@ git reviewer . --port 8080  # somewhere other than 4500
 
 Two at once is fine — the second one finds its own port.
 
+Use `git reviewer --staged` to review what the next commit would contain.
+The file list, diff and full context come from the index, so edits made after
+`git add` stay out of the view. An empty index comparison stays empty; it does
+not fall back to the last commit. The scope bar and exported review identify
+this as a staged review. The default command still shows all working-tree
+changes. As with the default view, reload after changing what is staged. Saved comments
+are shared between views and may refer to code outside the current comparison;
+check their anchors before applying them.
+
 ### When you are not standing in a repository
 
 The page opens on a picker rather than on an empty box:
@@ -331,6 +343,32 @@ rather than guess when an anchor has vanished.
 Submitting in the UI writes this alongside the `.txt`. The full schema is in
 [docs/agent-format.md](docs/agent-format.md).
 
+## Use it from inside your agent
+
+Installed as a plugin, the agent opens the review itself, waits while you read
+and comment, and works through your comments the moment you press **Submit
+Review**. You never leave the conversation to start it.
+
+```
+/plugin install git-reviewer --marketplace dheerajjha/reviewer
+```
+
+That is Claude Code; then ask to review the changes, or run
+`/git-reviewer:review`. The same skill installs elsewhere:
+
+| Agent | Install |
+|---|---|
+| Codex CLI | `codex plugin marketplace add dheerajjha/reviewer`, then `codex plugin add git-reviewer@git-reviewer` |
+| Cursor | **Customize** → **From GitHub Repository** → `dheerajjha/reviewer` |
+| Copilot CLI | `copilot plugin marketplace add dheerajjha/reviewer`, then `copilot plugin install git-reviewer@git-reviewer` |
+| Anything else | `npx skills add dheerajjha/reviewer` |
+
+The skill is plain instructions, [skills/review/SKILL.md](skills/review/SKILL.md):
+start `git reviewer` in the background, wait for the submit, then apply every
+comment, finding the code a comment quotes rather than trusting its line
+number. Where an agent cannot leave a command running, it asks you to start
+`git reviewer` yourself and reads the result with `git reviewer export`.
+
 ## HTTP API
 
 The UI is a client of this; nothing is hidden from you.
@@ -372,7 +410,7 @@ rather than a public issue.
 
 ```bash
 npm install           # 3 dependencies, no build step, ~6MB
-npm test              # 359 tests
+npm test              # 379 tests
 npm run test:watch
 npm run test:coverage
 ```
@@ -399,7 +437,7 @@ temporary directory. The HTTP tests do not stub git: each one builds a real
 repository in a temp directory and runs real `git` against it, because diff
 parsing is exactly where a stub would be wrong in the same way the code is.
 
-Tests run on Linux and macOS across Node 18, 20, and 22. See
+Tests run on Linux, macOS and Windows across Node 18, 20, and 22. See
 [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Tech
@@ -423,11 +461,18 @@ The ones most likely to change how the tool feels:
 - [#2](https://github.com/dheerajjha/reviewer/issues/2) — give comments a state, so a review can be worked through and marked off
 - [#3](https://github.com/dheerajjha/reviewer/issues/3) — report whether each anchor still matches the file
 - [#4](https://github.com/dheerajjha/reviewer/issues/4) — expose the review over MCP, so an agent works through it interactively
-- [#6](https://github.com/dheerajjha/reviewer/issues/6) — review a commit range, not just the working tree
+- [#6](https://github.com/dheerajjha/reviewer/issues/6) — open straight into a comparison from the command line, `git reviewer --range main...HEAD`
 
 [CONTRIBUTING.md](CONTRIBUTING.md) covers the setup and what a good change looks
 like here.
 
+## Related
+
+[margins](https://github.com/dheerajjha/margins) is its sibling for notes rather
+than diffs: `margins` in a folder of markdown opens it in the browser, with a
+file tree, `[[wikilinks]]` and backlinks, search, and editing with a live
+preview. `npm install -g margins`.
+
 ## License
 
 [MIT](LICENSE) © Dheeraj Jha

package/bin/reviewer.js

@@ -250,7 +250,7 @@ async function main() {
     options.port ?? (Number(process.env.PORT) || DEFAULT_PORT),
     { onReviewSubmitted, handoff: handingOff, onIdle }
   );
-  const url = buildUrl(`http://${DEFAULT_HOST}:${server.address().port}`, repoPath);
+  const url = buildUrl(`http://${DEFAULT_HOST}:${server.address().port}`, repoPath, options.staged);
 
   note(`\n  Code Reviewer  ${url}`);
   if (repoPath) note(`  reviewing      ${repoPath}`);

package/lib/agent.js

@@ -22,7 +22,7 @@ const SCHEMA = 'code-review/v1';
  * @property {string} schema
  * @property {string} generatedAt ISO 8601
  * @property {{path: string, name: string, head: string|null, branch: string|null}} repository
- * @property {'working'|'lastCommit'|null} mode
+ * @property {'working'|'staged'|'lastCommit'|'range'|null} mode
  * @property {{comments: number, files: number}} summary
  * @property {AgentComment[]} comments
  */
@@ -205,6 +205,10 @@ function describeScope({ repository, mode, range }) {
     return `Reviewed: uncommitted changes in the working tree, against ${repository.branch ?? 'HEAD'}${at}.`;
   }
 
+  if (mode === 'staged') {
+    return 'Comparison: staged changes in the index, against HEAD. Saved comments are shared between review views and may refer to changes outside this comparison; check their anchors before applying them.';
+  }
+
   if (mode === 'range' && range?.kind === 'commits') {
     // Commits themselves, picked from a list. Both ends are *in* the review,
     // which is the difference from a comparison and worth saying: an agent

package/lib/changes.js

@@ -268,7 +268,24 @@ function collectCommitChanges(diffSummary, statuses) {
   });
 }
 
+/**
+ * Files in the next commit, including their index status rather than any
+ * later working-tree edits. Omitting HEAD also works before the first commit.
+ * @param {import('simple-git').SimpleGit} git
+ */
+async function collectStagedChanges(git) {
+  if (await git.raw(['ls-files', '--unmerged', '-z'])) {
+    throw new Error('Resolve merge conflicts before reviewing staged changes.');
+  }
+  const [summary, raw] = await Promise.all([
+    git.diffSummary(['--cached']),
+    git.raw(['diff', '--cached', '--name-status', '-z', '-M'])
+  ]);
+  return collectCommitChanges(summary, parseNameStatus(raw));
+}
+
 module.exports = {
+  collectStagedChanges,
   collectWorkingChanges,
   collectCommitChanges,
   classifyCommitFile,

package/lib/cli.js

@@ -43,6 +43,7 @@ Options:
   -p, --port <n>    Port to listen on (default 4500; falls back to a free
                     port if that one is taken)
       --no-open     Print the URL instead of opening a browser
+      --staged      Review only staged changes (HEAD vs index)
   -f, --format <f>  Export format: json (default) or prompt
       --file <path> Export comments for one repo-relative file
   -h, --help        Show this help
@@ -83,6 +84,7 @@ class UsageError extends Error {
  * @property {string|null} repoPath absolute path, or null when not given
  * @property {number|null} port explicit port, or null to use the default
  * @property {boolean} open whether to launch a browser
+ * @property {boolean} staged whether to review only the index
  * @property {'json'|'prompt'} format for `export`
  * @property {string|null} file repo-relative file to export, or all files
  * @property {boolean} help
@@ -104,6 +106,7 @@ function parseArgs(argv, cwd = process.cwd()) {
     repoPath: null,
     port: null,
     open: true,
+    staged: false,
     format: 'json',
     file: null,
     help: false,
@@ -138,6 +141,10 @@ function parseArgs(argv, cwd = process.cwd()) {
         options.open = false;
         break;
 
+      case '--staged':
+        options.staged = true;
+        break;
+
       case '-p':
       case '--port': {
         const value = rest[++i];
@@ -201,6 +208,10 @@ function parseArgs(argv, cwd = process.cwd()) {
     throw new UsageError('--file is only valid with reviewer export');
   }
 
+  if (options.staged && options.command !== 'serve') {
+    throw new UsageError('--staged is only valid when serving a review');
+  }
+
   return options;
 }
 
@@ -249,10 +260,11 @@ function parseFile(value, flag) {
  *
  * @param {string} origin e.g. http://127.0.0.1:4500
  * @param {string|null} repoPath
+ * @param {boolean} [staged]
  * @returns {string}
  */
-function buildUrl(origin, repoPath) {
-  if (!repoPath) return origin;
+function buildUrl(origin, repoPath, staged = false) {
+  if (!repoPath) return staged ? `${origin}/?staged=1` : origin;
 
   // Slashes are left as slashes. They are legal in a query value -- RFC 3986
   // has `query = *( pchar / "/" / "?" )` -- and encoding them turns the most
@@ -263,7 +275,7 @@ function buildUrl(origin, repoPath) {
   //
   // Everything else stays encoded, including the characters that would
   // otherwise end the query and take the rest of the path with them.
-  return `${origin}/?repo=${encodeURIComponent(repoPath).replace(/%2F/g, '/')}`;
+  return `${origin}/?repo=${encodeURIComponent(repoPath).replace(/%2F/g, '/')}${staged ? '&staged=1' : ''}`;
 }
 
 /**

package/lib/export.js

@@ -3,7 +3,7 @@
 const fs = require('fs').promises;
 const path = require('path');
 
-const simpleGit = require('simple-git');
+const { simpleGit } = require('simple-git');
 
 const { buildReviewDocument, filterReviewDocument } = require('./agent');
 const { readSavedComments, belongsTo } = require('./store');

package/lib/repo.js

@@ -2,7 +2,7 @@
 
 const path = require('path');
 
-const simpleGit = require('simple-git');
+const { simpleGit } = require('simple-git');
 
 /**
  * Finding the repository a directory belongs to.

package/lib/sessions.js

@@ -11,10 +11,11 @@ const crypto = require('crypto');
  */
 
 /**
- * @typedef {'working'|'lastCommit'|'range'} ReviewMode
+ * @typedef {'working'|'staged'|'lastCommit'|'range'} ReviewMode
  * `working` diffs the working tree against HEAD; `lastCommit` diffs HEAD
  * against its parent, which is what a clean tree falls back to; `range`
  * diffs two refs the reviewer chose.
+ * `staged` diffs the index against HEAD without including working-tree edits.
  */
 
 /**

package/man/git-reviewer.1

@@ -51,6 +51,10 @@ Port to listen on. The default is 4500; if it is taken, a free one is used.
 .B \-\-no\-open
 Print the address instead of opening a browser.
 .TP
+.B \-\-staged
+Review only staged changes, comparing HEAD with the index. Unstaged edits are
+excluded, and an empty index comparison does not fall back to the last commit.
+.TP
 .BR \-f ", " \-\-format " \fIjson\fR|\fIprompt\fR"
 Export format. The default is json.
 .TP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-reviewer",
-  "version": "2.13.1",
+  "version": "2.14.1",
   "description": "Review your coding agent's changes like a pull request — locally, with inline comments and threaded follow-ups, then hand the marked-up review back to the agent",
   "author": "Dheeraj Jha",
   "license": "MIT",
@@ -51,7 +51,7 @@
   "dependencies": {
     "cors": "^2.8.5",
     "express": "^4.18.2",
-    "simple-git": "^3.20.0"
+    "simple-git": "^4.0.2"
   },
   "man": [
     "./man/git-reviewer.1"

package/public/app.js

@@ -2,6 +2,7 @@
 // In web mode, this will be http://localhost:4500
 // In Electron, this will be the random port Electron assigned
 const API_BASE = `${window.location.origin}/api`;
+const stagedByDefault = new URLSearchParams(window.location.search).get('staged') === '1';
 
 let currentRepoId = null;
 let currentFiles = [];
@@ -492,10 +493,10 @@ function renderScope(data) {
       document.getElementById('nextCommitBtn').disabled = true;
     }
   } else {
-    label.append('Uncommitted changes');
+    label.append(data.mode === 'staged' ? 'Staged changes' : 'Uncommitted changes');
     if (branch) label.append(' on ', strong(branch));
     meta.textContent = plural(data.files.length, 'file') + ' changed';
-    setNote(null);
+    setNote(data.mode === 'staged' ? 'The diff excludes unstaged changes. Saved comments are shared between views and may refer to other code; check their anchors.' : null);
   }
 
   row.classList.add('hidden');
@@ -781,7 +782,7 @@ async function loadRepo(scope = {}) {
       body: JSON.stringify(
         scope.commits ? { repoPath, commits: scope.commits }
           : scope.base ? { repoPath, base: scope.base, ...(scope.head ? { head: scope.head } : {}) }
-            : { repoPath }
+            : { repoPath, staged: stagedByDefault }
       )
     });
 
@@ -817,13 +818,13 @@ async function loadRepo(scope = {}) {
       // `message`, and the scope bar above is still showing how many commits
       // that covers -- so this is information, not an error, and it must not
       // be dressed as one.
-      if (data.mode === 'range') {
+      if (data.mode === 'range' || data.mode === 'staged') {
         // The scope bar is already explaining this; a status line repeating
         // it underneath is two bars saying one thing.
         clearStatus();
         hidePicker();
         displayFiles([]);
-        showEmptyFileList(data.range?.kind !== 'commits'
+        showEmptyFileList(data.mode === 'staged' ? 'No staged changes.' : data.range?.kind !== 'commits'
           ? 'No files differ between these two.'
           : data.range.first === data.range.last
             ? 'This commit changes no files.'

package/server.js

@@ -2,7 +2,7 @@
 
 const express = require('express');
 const cors = require('cors');
-const simpleGit = require('simple-git');
+const { simpleGit } = require('simple-git');
 const fs = require('fs').promises;
 const path = require('path');
 
@@ -12,7 +12,7 @@ const {
   resolveRepoFile,
   PathEscapeError
 } = require('./lib/paths');
-const { collectWorkingChanges, collectCommitChanges, parseNameStatus } = require('./lib/changes');
+const { collectWorkingChanges, collectStagedChanges, collectCommitChanges, parseNameStatus } = require('./lib/changes');
 const { SessionStore } = require('./lib/sessions');
 const { normalizeComments } = require('./lib/comments');
 const { formatReview, reviewFilename, commentsFilename } = require('./lib/review');
@@ -26,6 +26,39 @@ const { listReviews } = require('./lib/export');
 const DEFAULT_PORT = 4500;
 const DEFAULT_HOST = '127.0.0.1';
 
+// Addresses that only this machine can reach. Bound to one of these, the
+// server installs `loopbackHostOnly`.
+const LOOPBACK_ADDRESSES = new Set(['127.0.0.1', 'localhost', '::1']);
+
+// The names a browser puts in `Host` for a server it reached on loopback.
+// An IPv6 address keeps its brackets there.
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '[::1]']);
+
+/** The host name in a `Host` header, without the port. */
+function hostnameOf(header) {
+  const value = String(header || '').toLowerCase();
+  if (value.startsWith('[')) return value.slice(0, value.indexOf(']') + 1);
+  return value.split(':')[0];
+}
+
+/**
+ * Refuse a request addressed to this server by any name but a loopback one.
+ *
+ * That is DNS rebinding: a page on the attacker's own domain whose name is
+ * re-pointed at 127.0.0.1 after it loads. The browser then treats this server
+ * as that site, so `Origin` and `Host` agree and `sameOriginOnly` lets the
+ * request through. A server reachable only on loopback is only ever honestly
+ * addressed by a loopback name. Bound anywhere else (`HOST=0.0.0.0`), its
+ * owner has chosen to be reached by other names, and this is not installed.
+ */
+function loopbackHostOnly(req, res, next) {
+  if (!LOOPBACK_HOSTNAMES.has(hostnameOf(req.headers.host))) {
+    return res.status(403).json({ error: 'Not available under this host name' });
+  }
+
+  next();
+}
+
 
 /** A path inside the repository that names nothing, on disk or at HEAD. */
 class FileNotFoundError extends Error {
@@ -60,6 +93,8 @@ class FileNotFoundError extends Error {
  *   stop. Omitted means never: a server with no one to tell keeps serving.
  * @param {number} [options.idleGraceMs] how long to wait after the last tab
  *   leaves before deciding it is not coming back.
+ * @param {boolean} [options.loopbackOnly] refuse any request whose `Host` is
+ *   not a loopback name. `startServer` turns it on when it binds to loopback.
  * @returns {import('express').Express}
  */
 // How far back the range picker offers to go. Long enough to cover the work
@@ -86,12 +121,15 @@ function createApp(options = {}) {
     onReviewSubmitted = null,
     handoff = false,
     onIdle = null,
-    idleGraceMs = 5000
+    idleGraceMs = 5000,
+    loopbackOnly = false
   } = options;
 
   const app = express();
 
+  if (loopbackOnly) app.use(loopbackHostOnly);
   app.use(cors());
+  app.use('/api', sameOriginOnly);
   app.use(express.json({ limit: '10mb' }));
   app.use(express.static(path.join(__dirname, 'public')));
 
@@ -137,6 +175,18 @@ function createApp(options = {}) {
     const git = gitFactory(session.repoPath);
     const absolutePath = resolveRepoFile(session.repoPath, filePath);
 
+    if (session.mode === 'staged') {
+      try {
+        // `:0:` names the stage outright. A bare `:` reads a file called
+        // `0:foo` as stage 0 of `foo`, and shows the wrong file's text.
+        return await git.show([`:0:${filePath}`]);
+      } catch {
+        // A staged deletion has no index entry. Its old content comes from
+        // HEAD, even if a replacement now exists in the working tree.
+        return git.show([`HEAD:${filePath}`]).catch(() => { throw new FileNotFoundError(filePath); });
+      }
+    }
+
     if (session.range) {
       // A range is two commits, and the working tree is neither of them. It
       // used to be the fallback here, which was merely odd while the head of
@@ -222,6 +272,9 @@ function createApp(options = {}) {
   }
 
   async function diffForFile(git, session, filePath) {
+    if (session.mode === 'staged') {
+      return git.diff(['--cached', '--', filePath]);
+    }
     if (session.range) {
       return git.diff([session.range.from, session.range.head, '--', filePath]);
     }
@@ -645,20 +698,37 @@ function createApp(options = {}) {
   /**
    * Refuse a request a browser has marked as coming from somewhere else.
    *
-   * `cors()` above is open, deliberately, and that is a settled decision this
-   * does not reopen. It is a rule for the two endpoints below, which differ
-   * from every other one in kind: they enumerate directories and name
-   * projects, rather than answering about a repository whose path the caller
-   * already had. A browser sends `Origin` on exactly the requests where that
-   * distinction matters and omits it on same-origin GETs, so the page keeps
-   * working and a page on another site does not. Anything that is not a
-   * browser can read these directories without asking this server anyway.
+   * Every `/api` route goes through this (#66). Until 2.14.1 only the routes
+   * that enumerate directories did, on the reasoning that the rest answer
+   * about a repository whose path the caller already had. A path is easy to
+   * guess, though, and `cors()` is open, so a page on another site could read
+   * any file in a guessed repository. Worse, it could save a comment into the
+   * review, which `reviewer export` then hands to the coding agent as an
+   * instruction.
+   *
+   * A browser sends `Origin` on every cross-origin request that could do
+   * either, and leaves it out of the page's own same-origin GETs, so the page
+   * keeps working. A client that is not a browser sends no `Origin` and gets
+   * through: it could read these files without asking this server anyway.
+   * Only the host is compared, not the scheme, so the page still works behind
+   * a proxy that terminates TLS.
+   *
+   * This cannot catch DNS rebinding, where `Origin` and `Host` both name the
+   * attacker's domain. `loopbackHostOnly` does.
    */
   function sameOriginOnly(req, res, next) {
     const origin = req.get('origin');
 
-    if (origin && origin !== `http://${req.headers.host}`) {
-      return res.status(403).json({ error: 'Not available to another origin' });
+    if (origin) {
+      let originHost = null;
+      try {
+        originHost = new URL(origin).host;
+      } catch {
+        // `Origin: null` (a sandboxed frame, a file:// page) names no host.
+      }
+      if (originHost !== req.headers.host) {
+        return res.status(403).json({ error: 'Not available to another origin' });
+      }
     }
 
     next();
@@ -671,9 +741,9 @@ function createApp(options = {}) {
    * The connection *is* the signal. An open page holds this response open and
    * closing the page closes it, so there is no heartbeat interval to tune, and
    * two tabs are two connections rather than one flag that either close
-   * clears. `sameOriginOnly` is here for the same reason it is on the two
-   * below: without it a page on another site could hold this open and keep a
-   * server alive that its owner had finished with.
+   * clears. Like every `/api` route it goes through `sameOriginOnly`, which
+   * matters here too: without it a page on another site could hold this open
+   * and keep alive a server its owner had finished with.
    *
    * Nothing happens at the moment a watcher leaves. A reload closes and
    * reopens within milliseconds, and a dropped connection reopens when
@@ -686,7 +756,7 @@ function createApp(options = {}) {
    * after having been above it, so `reviewer` whose browser never launched
    * keeps serving rather than exiting into an empty terminal.
    */
-  app.get('/api/alive', sameOriginOnly, (req, res) => {
+  app.get('/api/alive', (req, res) => {
     if (idleTimer) {
       clearTimeout(idleTimer);
       idleTimer = null;
@@ -718,7 +788,7 @@ function createApp(options = {}) {
   });
 
   /** List the directories inside one, so a repository can be found by looking. */
-  app.get('/api/browse', sameOriginOnly, async (req, res) => {
+  app.get('/api/browse', async (req, res) => {
     try {
       res.json(await browse(req.query.path));
     } catch (error) {
@@ -735,7 +805,7 @@ function createApp(options = {}) {
   });
 
   /** Repositories opened before now, newest first. */
-  app.get('/api/recent', sameOriginOnly, async (req, res) => {
+  app.get('/api/recent', async (req, res) => {
     try {
       // Annotated with what is saved against each, because "3 comments" is
       // what tells you which of two checkouts you were in the middle of.
@@ -768,7 +838,10 @@ function createApp(options = {}) {
       // Resolve to the root of the working tree before anything is keyed on
       // this path. A subdirectory passes `checkIsRepo()` quite happily and
       // then produces a file list whose diffs are all empty; see lib/repo.js.
-      const { base, head, commits: run } = req.body ?? {};
+      const { base, head, commits: run, staged = false } = req.body ?? {};
+      if (typeof staged !== 'boolean' || (staged && (base != null || head != null || run != null))) {
+        return res.status(400).json({ error: 'Choose staged changes or a commit comparison, not both.' });
+      }
       const root = await repoRoot(repoPath, gitFactory);
       if (!root) {
         return res.status(400).json({ error: 'Not a valid git repository' });
@@ -781,7 +854,15 @@ function createApp(options = {}) {
       let range = null;
       let message;
 
-      if (run && typeof run === 'object') {
+      if (staged) {
+        try {
+          files = await collectStagedChanges(git);
+        } catch (error) {
+          return res.status(400).json({ error: error.message });
+        }
+        mode = 'staged';
+        message = files.length ? `Found ${files.length} staged file(s)` : 'No staged changes';
+      } else if (run && typeof run === 'object') {
         // Commits themselves, one or a run: see resolveCommitRun.
         try {
           range = await resolveCommitRun(git, `${run.from ?? ''}`.trim(), `${run.to ?? run.from ?? ''}`.trim());
@@ -1083,8 +1164,9 @@ function startServer(options = {}) {
     ...appOptions
   } = options;
   // Everything else in `options` -- reviewsDir, sessions, git, handoff and
-  // onReviewSubmitted -- goes through to the app.
-  const app = createApp(appOptions);
+  // onReviewSubmitted -- goes through to the app. Bound to loopback, the app
+  // also refuses any Host but a loopback name (see `loopbackHostOnly`).
+  const app = createApp({ loopbackOnly: LOOPBACK_ADDRESSES.has(host), ...appOptions });
 
   return new Promise((resolve, reject) => {
     const server = app.listen(port, host, () => {