feat(security): default worker to localhost-only binding

BREAKING: Worker now binds to 127.0.0.1 by default. Set CLAUDE_MEM_WORKER_HOST=0.0.0.0 for remote access.
2025-12-11 22:01:31 +08:00
parent b39cf84730
commit b8a9f366e7
22 changed files with 156 additions and 116 deletions
@@ -50,6 +50,7 @@ Settings are managed in `~/.claude-mem/settings.json`. The file is auto-created
 - `CLAUDE_MEM_MODEL` - Model for observations/summaries (default: claude-haiku-4-5)
 - `CLAUDE_MEM_CONTEXT_OBSERVATIONS` - Observations injected at SessionStart (default: 50)
 - `CLAUDE_MEM_WORKER_PORT` - Worker service port (default: 37777)
+- `CLAUDE_MEM_WORKER_HOST` - Worker bind address (default: 127.0.0.1, use 0.0.0.0 for remote access)

 **System Configuration:**
 - `CLAUDE_MEM_DATA_DIR` - Data directory location (default: ~/.claude-mem)