From 421f61483344f5a31015afc07728b2202b02225e Mon Sep 17 00:00:00 2001 From: Stephen Herr Date: Sun, 12 Jul 2026 22:43:04 -0600 Subject: [PATCH] fix: bind to 127.0.0.1 by default, add --host option Fixes #11. Previously the server listened on 0.0.0.0 (all interfaces) by default, exposing conversation history to the local network without the user's knowledge. This change defaults the listen address to 127.0.0.1 (localhost only) so the server is not accessible from other devices. Users who want network access can opt in with: kiro-history --host 0.0.0.0 Changes: - server/index.ts: startServer() accepts a hostname parameter, defaults to '127.0.0.1', passes it to @hono/node-server serve(). - server/cli.ts: Added --host
CLI option (default: 127.0.0.1). - README.md: Documented the --host option in the options table and added a usage example. --- README.md | 4 ++++ server/cli.ts | 4 +++- server/index.ts | 4 +++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a1e3364..6e76aea 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,9 @@ kiro-history -p 3000 # Don't open browser automatically kiro-history --no-open + +# Listen on all interfaces (accessible from other devices on your network) +kiro-history --host 0.0.0.0 ``` ### Source Selection @@ -96,6 +99,7 @@ kiro-history --source ide ~/path/to/kiro.kiroagent | `path` | Custom path to database file (CLI) or sessions directory (IDE) | Auto-detected | | `-s, --source ` | Source type: `cli`, `ide`, or `auto` | `auto` | | `-p, --port ` | Port to run the server on | Random available port | +| `--host
` | Host address to bind to | `127.0.0.1` | | `--no-open` | Don't open browser automatically | Opens browser | | `-V, --version` | Show version number | - | | `-h, --help` | Show help | - | diff --git a/server/cli.ts b/server/cli.ts index 1f688fc..40029c7 100644 --- a/server/cli.ts +++ b/server/cli.ts @@ -77,8 +77,9 @@ export async function main(): Promise { .argument('[path]', 'Custom path to the database file (CLI) or sessions directory (IDE)') .option('-p, --port ', 'Port to run the server on (default: auto)') .option('-s, --source ', 'Source type: cli, ide, or auto (default: auto)', 'auto') + .option('--host
', 'Host address to bind to (default: 127.0.0.1)', '127.0.0.1') .option('--no-open', 'Do not open browser automatically') - .action(async (userPath?: string, options?: { port?: string; open?: boolean; source?: string }) => { + .action(async (userPath?: string, options?: { port?: string; open?: boolean; source?: string; host?: string }) => { const sourceOption = (options?.source || 'auto') as SourceType; const source = sourceOption === 'auto' ? detectSource() : sourceOption as 'cli' | 'ide'; @@ -162,6 +163,7 @@ export async function main(): Promise { const { port, close: closeServer } = await startServer({ reader, port: requestedPort, + hostname: options?.host, sourceType: source, alternateReader, alternateSourceType, diff --git a/server/index.ts b/server/index.ts index 8508982..f14986d 100644 --- a/server/index.ts +++ b/server/index.ts @@ -179,14 +179,16 @@ export function createApp(options: ServerOptions): Hono { } export async function startServer( - options: ServerOptions & { port?: number } + options: ServerOptions & { port?: number; hostname?: string } ): Promise<{ port: number; close: () => void }> { const app = createApp(options); + const hostname = options.hostname || '127.0.0.1'; return new Promise((resolve) => { const server = serve({ fetch: app.fetch, port: options.port || 0, // Use specified port or let OS assign + hostname, }, (info) => { resolve({ port: info.port,