better-code-review-graph 3.28.0__tar.gz → 3.28.1__tar.gz

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "better-code-review-graph",
   "description": "Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.",
-  "version": "3.28.0",
+  "version": "3.28.1",
   "userConfig": {
     "EMBEDDING_MODELS": {
       "type": "string",

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 <!-- version list -->
 
+## v3.28.1 (2026-09-27)
+
+### Bug Fixes
+
+- Enforce no-auth loopback guard against config-sourced host
+  ([#1102](https://github.com/n24q02m/crg/pull/1102),
+  [`bf4afc3`](https://github.com/n24q02m/crg/commit/bf4afc338aa7443959fc522cfa980ef583d7e26d))
+
+
 ## v3.28.0 (2026-09-27)
 
 ### Code Style

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: better-code-review-graph
-Version: 3.28.0
+Version: 3.28.1
 Summary: Token-efficient code review knowledge graph: semantic search and call-graph resolution.
 Author: n24q02m
 License-Expression: Apache-2.0

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "better-code-review-graph"
-version = "3.28.0"
+version = "3.28.1"
 description = "Token-efficient code review knowledge graph: semantic search and call-graph resolution."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = "Apache-2.0"

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/n24q02m/crg.git",
     "source": "github"
   },
-  "version": "3.28.0",
+  "version": "3.28.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "better-code-review-graph",
-      "version": "3.28.0",
+      "version": "3.28.1",
       "runtimeHint": "uvx",
       "runtimeArgs": [
         "--python",

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/src/better_code_review_graph/cli.py

@@ -537,18 +537,21 @@ def _handle_server_start(args: argparse.Namespace) -> int:
     from .server import serve_main
 
     os.environ["MCP_TRANSPORT"] = "http"
-    # run_http() resolves bind address from these (falls back to config).
-    host = args.host or os.environ.get("MCP_HOST")
+    # run_http() bind precedence: MCP_HOST env > settings.server.host; --port
+    # hands off via MCP_PORT (honored at server.py:986-989).
+    settings = load_instance_settings()
     if args.host:
         os.environ["MCP_HOST"] = args.host
     if args.port:
         os.environ["MCP_PORT"] = str(args.port)
     # Security property carried over from the wp2-wip line: an
     # unauthenticated (no-auth) listener must never bind off-loopback.
+    # Resolve the EFFECTIVE bind host the way run_http does.
+    host = args.host or os.environ.get("MCP_HOST") or settings.server.host
     if (
         host
         and host not in {"localhost", "127.0.0.1", "::1"}
-        and load_instance_settings().server.auth == "no-auth"
+        and settings.server.auth == "no-auth"
     ):
         print(
             "crg refuses to start: auth = 'no-auth' only permits loopback "

{better_code_review_graph-3.28.0 → better_code_review_graph-3.28.1}/tests/test_cli_control_plane.py

@@ -73,7 +73,13 @@ def test_db_path_prints_graph_db(capsys) -> None:
     assert out.endswith("graph.db")
 
 
-def test_server_start_forces_http_transport(capsys, monkeypatch) -> None:
+def test_server_start_forces_http_transport(capsys, tmp_path, monkeypatch) -> None:
+    cfg = tmp_path / "cfg"
+    cfg.mkdir()
+    (cfg / "config.toml").write_text(
+        '[server]\nhost = "127.0.0.1"\nport = 61000\nauth = "no-auth"\n'
+    )
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(cfg))
     monkeypatch.delenv("MCP_TRANSPORT", raising=False)
     monkeypatch.delenv("MCP_HOST", raising=False)
     monkeypatch.delenv("MCP_PORT", raising=False)
@@ -110,6 +116,7 @@ def test_server_start_refuses_no_auth_off_loopback(
     )
     monkeypatch.setenv("CRG_CONFIG_DIR", str(cfg))
     monkeypatch.delenv("MCP_TRANSPORT", raising=False)
+    monkeypatch.delenv("MCP_HOST", raising=False)
     serve_called = False
 
     def must_not_serve() -> None:
@@ -124,6 +131,32 @@ def test_server_start_refuses_no_auth_off_loopback(
     assert serve_called is False
 
 
+def test_server_start_refuses_no_auth_config_host_off_loopback(
+    capsys, tmp_path, monkeypatch
+) -> None:
+    """Bypass regression: no --host/MCP_HOST, config-sourced host binds."""
+    cfg = tmp_path / "cfg"
+    cfg.mkdir()
+    (cfg / "config.toml").write_text(
+        '[server]\nhost = "0.0.0.0"\nport = 61000\nauth = "no-auth"\n'
+    )
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(cfg))
+    monkeypatch.delenv("MCP_TRANSPORT", raising=False)
+    monkeypatch.delenv("MCP_HOST", raising=False)
+    serve_called = False
+
+    def must_not_serve() -> None:
+        nonlocal serve_called  # noqa: F841
+        serve_called = True  # pragma: no cover
+
+    monkeypatch.setattr("better_code_review_graph.server.serve_main", must_not_serve)
+    rc = _run(capsys, "server", "start")
+    err = capsys.readouterr().err
+    assert rc == 2
+    assert "no-auth" in err and "loopback" in err
+    assert serve_called is False
+
+
 def test_unknown_subcommand_is_rc2(capsys) -> None:
     rc = _run(capsys, "nope")
     err = capsys.readouterr().err