fix(refine): bind relay to loopback by default - #5
Open
Osamaali313 wants to merge 1 commit into
Open
Conversation
The relay called server.listen(PORT) with no host, which binds to 0.0.0.0 / :: (all interfaces). Since the relay is a local dev daemon that answers jobs by spawning the user's coding agent, it should only be reachable from the same machine. Every other client already assumes loopback (the CLI health/shutdown/recheck probes all hit 127.0.0.1). Default the bind host to 127.0.0.1, with a REFINE_RELAY_HOST env var to opt back into a wider bind for anyone who intentionally needs to reach it from another device.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
refine/server/relay.mjsstarts the relay with:With no host argument, Node binds to
0.0.0.0/::— i.e. all network interfaces, not just localhost. Sincenpx transitions-refine liveis typically run inside a project on whatever network the machine is on, the relay ends up reachable from other devices on the LAN.That matters here because the relay isn't a passive data server — on the LLM path it answers jobs by spawning the user's coding agent to read and edit their source. It should only be reachable from the same machine. Everything else in the codebase already assumes loopback: the CLI's health / shutdown / recheck probes all hit
127.0.0.1(refine/bin/cli.mjs), and the logs/inject examples all saylocalhost.Change
Default the bind host to
127.0.0.1, with an opt-in override for anyone who intentionally wants a wider bind:One line of behavior change; loopback clients are unaffected.
Verification
node --check refine/server/relay.mjspasses.listen(PORT)reportsserver.address().address === "::", whilelisten(PORT, "127.0.0.1")reports"127.0.0.1". Localcurl http://127.0.0.1:7331/healthstill returns200.Related (not in this PR)
Separately, the relay sends
Access-Control-Allow-Origin: *, so a page in a browser can also reach it cross-origin. That one needs a design decision (reflect an allowlisted origin, or a per-session token minted ininject.jsand required on/jobs) rather than a mechanical change, so I've left it out of this PR — happy to help with it as a follow-up if you'd like.