hypgraph 0.7.6__tar.gz → 0.7.7__tar.gz

{hypgraph-0.7.6 → hypgraph-0.7.7}/CHANGELOG.md

@@ -1,4 +1,12 @@
 # Changelog
+
+## 0.7.7 — 2026-10-29: `hypgraph serve` inside a container
+
+- **`hypgraph serve` bound to `0.0.0.0` answered 421 to everyone.** Its Host check knew only the bind address,
+  which no browser sends: inside a container with a published port, every request arrives as
+  `Host: 127.0.0.1:<host port>` and was refused as a possible DNS rebinding. A wildcard bind now accepts the
+  loopback names (the port was never part of the check), and `--allow-host NAME` (repeatable; `allow_hosts=` on
+  `make_server` / `serve`) adds a LAN or service name. A wildcard bind still never means "any Host".
  
 ## 0.7.6 — 2026-10-29: the swarm as swimlanes, and the UI walked on a real record
 

{hypgraph-0.7.6 → hypgraph-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.6
+Version: 0.7.7
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.6 → hypgraph-0.7.7}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.6"
+__version__ = "0.7.7"
 
 from .bundle import verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402

{hypgraph-0.7.6 → hypgraph-0.7.7}/src/hypgraph/cli.py

@@ -425,6 +425,7 @@ def cmd_serve(args) -> int:
     if tokens and not args.writable:
         print("note: --token only matters with --writable (reads are open)")
     serve(args.db, host=args.host, port=args.port, writable=args.writable, open_browser=not args.no_browser,
+          allow_hosts=tuple(args.allow_host or ()),
           tokens=tokens or None, telemetry=(args.telemetry or "auto") if not args.no_telemetry else None)
     return 0
 
@@ -537,6 +538,8 @@ def build_parser() -> argparse.ArgumentParser:
     s = cmd("serve", cmd_serve, "the HypGraph UI and JSON API on localhost")
     s.add_argument("--host", default="127.0.0.1")
     s.add_argument("--port", type=int, default=8765)
+    s.add_argument("--allow-host", action="append", metavar="NAME",
+                   help="a Host header name to answer to besides loopback (a LAN or service name); repeatable")
     s.add_argument("--writable", action="store_true", help="also accept writes (POST /api/graph/write)")
     s.add_argument("--no-browser", action="store_true")
     s.add_argument("--telemetry", default="", metavar="FILE",

{hypgraph-0.7.6 → hypgraph-0.7.7}/src/hypgraph/server.py

@@ -236,6 +236,28 @@ def read_telemetry(path: Path | None, after: int = 0, inv: str = "", limit: int
     return out, after + end + 1
 
 
+LOOPBACK_NAMES = frozenset({"localhost", "127.0.0.1", "::1"})
+WILDCARD_BINDS = frozenset({"", "0.0.0.0", "::", "*"})
+
+
+def accepted_hosts(host: str, allow_hosts: tuple[str, ...] | list[str] = ()) -> set[str]:
+    """The names a request's Host header may carry (port ignored); anything else is 421.
+
+    Bound to a loopback name, the server answers to every loopback name. Bound to a wildcard (``0.0.0.0``,
+    ``::``) — as inside a container whose port is published — it answers to the loopback names too, since the
+    browser reaches the published port as ``127.0.0.1:<host port>``; the bind address itself is never a name a
+    browser sends. ``allow_hosts`` adds names: a LAN hostname, a service name. The check is DNS-rebinding
+    defence (a page on another origin can't make the browser talk to this server by name), so a wildcard bind
+    never means "any Host"."""
+    names = {h.strip().lower() for h in allow_hosts if h and h.strip()}
+    h = (host or "").strip().lower()
+    if h in LOOPBACK_NAMES or h in WILDCARD_BINDS:
+        names |= LOOPBACK_NAMES
+    if h and h not in WILDCARD_BINDS:
+        names.add(h)
+    return names
+
+
 def make_handler(g: Graph, *, writable: bool, hosts: set[str], root: Path,
                  tokens: dict[str, frozenset] | None = None, telemetry: Path | None = None):
     class Handler(BaseHTTPRequestHandler):
@@ -389,7 +411,8 @@ def make_handler(g: Graph, *, writable: bool, hosts: set[str], root: Path,
 
 
 def make_server(graph: Graph | str, host: str = "127.0.0.1", port: int = 8765, *, writable: bool = False,
-                tokens: dict[str, frozenset] | None = None, telemetry: str | Path | None = "auto"):
+                tokens: dict[str, frozenset] | None = None, telemetry: str | Path | None = "auto",
+                allow_hosts: tuple[str, ...] | list[str] = ()):
     """``telemetry``: the swarm's sidecar to serve and stream — "auto" is ``<db>.telemetry.jsonl`` beside the record
     (it may appear later: a run started after the server is picked up), a path, or None for none."""
     g = graph if isinstance(graph, Graph) else Graph(graph)
@@ -399,19 +422,20 @@ def make_server(graph: Graph | str, host: str = "127.0.0.1", port: int = 8765, *
             tel = Path(g.path + ".telemetry.jsonl")
     elif telemetry:
         tel = Path(telemetry)
-    hosts = {host.lower(), "localhost", "127.0.0.1", "::1"} if host in ("127.0.0.1", "localhost", "::1") else \
-        {host.lower()}
+    hosts = accepted_hosts(host, allow_hosts)
     root = static_dir().resolve()
     return ThreadingHTTPServer((host, port), make_handler(g, writable=writable, hosts=hosts, root=root, tokens=tokens,
                                                           telemetry=tel))
 
 
 def serve(db: str, host: str = "127.0.0.1", port: int = 8765, *, writable: bool = False,
-          open_browser: bool = True, tokens: dict[str, frozenset] | None = None, telemetry: str | None = "auto") -> None:
+          open_browser: bool = True, tokens: dict[str, frozenset] | None = None, telemetry: str | None = "auto",
+          allow_hosts: tuple[str, ...] | list[str] = ()) -> None:
     if not Path(db).exists():
         print(f"{db} doesn't exist yet — `hypgraph demo` builds one to explore, `hypgraph init` starts your own.")
         return
-    srv = make_server(db, host, port, writable=writable, tokens=tokens, telemetry=telemetry)
+    srv = make_server(db, host, port, writable=writable, tokens=tokens, telemetry=telemetry,
+                      allow_hosts=allow_hosts)
     url = f"http://{host}:{srv.server_address[1]}/"
     auth = f", {len(tokens)} write token(s)" if tokens else (", writes unauthenticated" if writable else "")
     tel = telemetry if telemetry not in ("auto", None) else (db + ".telemetry.jsonl" if telemetry == "auto" else "")

hypgraph-0.7.7/tests/test_server_hosts.py

@@ -0,0 +1,65 @@
+"""Which Host headers `serve` answers to. Bound to loopback: loopback names. Bound to a wildcard (a container
+with a published port): loopback names too — the browser reaches the published port as 127.0.0.1:<host port>, and
+the bind address is never a name a browser sends. Anything else is 421, unless --allow-host names it."""
+import threading
+import urllib.error
+import urllib.request
+
+import pytest
+
+from hypgraph import Graph
+from hypgraph.server import accepted_hosts, make_server
+
+
+def _get(url, host_header):
+    req = urllib.request.Request(f"{url}/api/graph/investigations", headers={"Host": host_header})
+    try:
+        with urllib.request.urlopen(req) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+
+
+@pytest.fixture
+def serve_on(tmp_path):
+    servers = []
+
+    def start(host, **kw):
+        g = Graph(str(tmp_path / f"{len(servers)}.hypgraph"))
+        srv = make_server(g, host, port=0, **kw)
+        threading.Thread(target=srv.serve_forever, daemon=True).start()
+        servers.append(srv)
+        return f"http://127.0.0.1:{srv.server_address[1]}"
+
+    yield start
+    for srv in servers:
+        srv.shutdown()
+
+
+def test_accepted_hosts_rules():
+    assert accepted_hosts("127.0.0.1") == {"127.0.0.1", "localhost", "::1"}
+    assert accepted_hosts("0.0.0.0") == {"127.0.0.1", "localhost", "::1"}          # the bind address is not a name
+    assert accepted_hosts("::") == {"127.0.0.1", "localhost", "::1"}
+    assert accepted_hosts("lab.local") == {"lab.local"}                           # a real name: that name only
+    assert accepted_hosts("0.0.0.0", ["Swarm.Internal", " "]) == {"127.0.0.1", "localhost", "::1", "swarm.internal"}
+
+
+def test_loopback_bind_answers_loopback_names_and_refuses_others(serve_on):
+    url = serve_on("127.0.0.1")
+    assert _get(url, "127.0.0.1:9") == 200          # the port is not part of the check
+    assert _get(url, "localhost") == 200
+    assert _get(url, "evil.example") == 421
+
+
+def test_wildcard_bind_answers_loopback_through_a_published_port(serve_on):
+    url = serve_on("0.0.0.0")
+    assert _get(url, "127.0.0.1:8100") == 200       # the host side of a container's published port
+    assert _get(url, "localhost:8100") == 200
+    assert _get(url, "0.0.0.0:8000") == 421         # no browser sends the bind address; a rebinding page might
+    assert _get(url, "evil.example") == 421
+
+
+def test_allow_host_adds_a_name(serve_on):
+    url = serve_on("0.0.0.0", allow_hosts=["swarm.internal"])
+    assert _get(url, "swarm.internal:8000") == 200
+    assert _get(url, "other.internal") == 421