feat(security): default worker to localhost-only binding

BREAKING: Worker now binds to 127.0.0.1 by default.
Set CLAUDE_MEM_WORKER_HOST=0.0.0.0 for remote access.

src/services/worker-service.ts

@@ -35,7 +35,7 @@ import http from 'http';
 import path from 'path';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { getWorkerPort } from '../shared/worker-utils.js';
+import { getWorkerPort, getWorkerHost } from '../shared/worker-utils.js';
 import { logger } from '../utils/logger.js';
 
 // Import composed domain services
@@ -146,12 +146,13 @@ export class WorkerService {
   async start(): Promise<void> {
     // Start HTTP server FIRST - make port available immediately
     const port = getWorkerPort();
+    const host = getWorkerHost();
     this.server = await new Promise<http.Server>((resolve, reject) => {
-      const srv = this.app.listen(port, () => resolve(srv));
+      const srv = this.app.listen(port, host, () => resolve(srv));
       srv.on('error', reject);
     });
 
-    logger.info('SYSTEM', 'Worker started', { port, pid: process.pid });
+    logger.info('SYSTEM', 'Worker started', { host, port, pid: process.pid });
 
     // Do slow initialization in background (non-blocking)
     this.initializeBackground().catch((error) => {

src/services/worker/http/routes/SettingsRoutes.ts

@@ -82,6 +82,20 @@ export class SettingsRoutes extends BaseRouteHandler {
       }
     }
 
+    // Validate CLAUDE_MEM_WORKER_HOST (IP address or 0.0.0.0)
+    if (req.body.CLAUDE_MEM_WORKER_HOST) {
+      const host = req.body.CLAUDE_MEM_WORKER_HOST;
+      // Allow localhost variants and valid IP patterns
+      const validHostPattern = /^(127\.0\.0\.1|0\.0\.0\.0|localhost|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/;
+      if (!validHostPattern.test(host)) {
+        res.status(400).json({
+          success: false,
+          error: 'CLAUDE_MEM_WORKER_HOST must be a valid IP address (e.g., 127.0.0.1, 0.0.0.0)'
+        });
+        return;
+      }
+    }
+
     // Validate CLAUDE_MEM_LOG_LEVEL
     if (req.body.CLAUDE_MEM_LOG_LEVEL) {
       const validLevels = ['DEBUG', 'INFO', 'WARN', 'ERROR', 'SILENT'];
@@ -131,6 +145,7 @@ export class SettingsRoutes extends BaseRouteHandler {
       'CLAUDE_MEM_MODEL',
       'CLAUDE_MEM_CONTEXT_OBSERVATIONS',
       'CLAUDE_MEM_WORKER_PORT',
+      'CLAUDE_MEM_WORKER_HOST',
       // System Configuration
       'CLAUDE_MEM_DATA_DIR',
       'CLAUDE_MEM_LOG_LEVEL',