claudomator.git/internal/config/bind_test.go, branch fix/dockersandbox-gitpush-host-securityclaudomator — task automation server
https://git.terst.org/claudomator.git/atom?h=fix%2Fdockersandbox-gitpush-host-security2026-05-26T21:08:25+00:00feat(config,cli): loopback-default binding with fail-loud on external (Phase 7)2026-05-26T21:08:25+00:00Claudenoreply@anthropic.com2026-05-26T21:08:25+00:00urn:sha1:b9d73497efe7c28800040b3e421bfb4cb6af6092
The server now defaults to binding 127.0.0.1 and refuses to bind a non-loopback
address (:8484, 0.0.0.0, a LAN IP, …) unless external_bind_allowed = true is set
in config — failing loud at startup instead of silently exposing itself.
External access is expected to go through a reverse proxy (Tailscale / Cloudflare
Access / Caddy), per the locked auth model.
- config: ExternalBindAllowed flag + ValidateBindAddr/isLoopbackHost (tested
across loopback, all-interfaces, LAN, and override cases).
- cli: --addr default is now 127.0.0.1:8484; serve() validates before binding.
Per-client bearer rotation stays deferred (single shared token for now).
https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39