feat(security): default worker to localhost-only binding

BREAKING: Worker now binds to 127.0.0.1 by default. Set CLAUDE_MEM_WORKER_HOST=0.0.0.0 for remote access.
2025-12-11 22:01:31 +08:00
parent b39cf84730
commit b8a9f366e7
22 changed files with 156 additions and 116 deletions
@@ -26,6 +26,16 @@ export function getWorkerPort(): number {
  return parseInt(settings.CLAUDE_MEM_WORKER_PORT, 10);
 }

+/**
+ * Get the worker host address
+ * Priority: ~/.claude-mem/settings.json > env var > default (127.0.0.1)
+ */
+export function getWorkerHost(): string {
+  const settingsPath = path.join(homedir(), '.claude-mem', 'settings.json');
+  const settings = SettingsDefaultsManager.loadFromFile(settingsPath);
+  return settings.CLAUDE_MEM_WORKER_HOST;
+}
+
 /**
 * Check if worker is responsive by trying the health endpoint
 */