packages/coding-agent/.changes/bash-network-perimeter.md at main in ptr.pet/prime-agent

435 B 2 lines

e88e3a28

dawn Sep 17

⋯

packages/coding-agent/.changes/bash-network-perimeter.md

at main Markdown

Added a bash() network perimeter guard that refuses binding a dev or admin server to a public interface (0.0.0.0, ::, --host 0.0.0.0, HOST=0.0.0.0, -p 0.0.0.0:...) and names the loopback form plus the RLM_ALLOW_PUBLIC_LISTEN=1 opt-in for a deliberate public bind.
Added a bash() warning when a command hardcodes a well-known dev port, naming the ephemeral form (PORT=0 or --port 0) instead of refusing the command.