Compare commits

...
Author SHA1 Message Date
praisonai-triage-agent[bot]andMervin Praison f1c3eb432f fix: remove redundant logging import and fix misleading print when using ngrok
- Remove inline 'import logging' since module already imports at top
- Suppress local bind address print when --public is used to avoid confusion
- Addresses reviewer feedback from Gemini and Greptile

Co-authored-by: Mervin Praison <[email protected]>
2026-05-04 05:05:12 +00:00
caoycandClaude Opus 4.7 944626f5c7 fix(security): bind API server to 127.0.0.1 by default instead of 0.0.0.0
The FastAPI server in api/call.py was binding to 0.0.0.0 (all interfaces)
while printing "Starting on http://localhost:{port}", misleading users into
thinking the server was local-only. On public WiFi, containers, or VMs this
exposes the OpenAI key-handling endpoint to the LAN.

Changes:
- run_server() now defaults to host="127.0.0.1"
- host="0.0.0.0" is only used when use_public=True (ngrok requires it)
- Added WARNING log when 0.0.0.0 is explicitly passed without --public
- Print message now shows the actual bind address
- Added --host CLI argument for explicit control
- Fixed misleading docstring example in _http_approval.py

Refs #1602 (Gap 2)

Co-Authored-By: Claude Opus 4.7 <[email protected]>
2026-05-04 12:52:12 +08:00
2 changed files with 17 additions and 7 deletions

No files matched your search

+16 -6
View File
@@ -351,22 +351,31 @@ def setup_public_url(port):
print(f"Praison AI Voice URL: {public_url}")
return public_url
def run_server(port: int, use_public: bool = False):
def run_server(port: int, host: str = "127.0.0.1", use_public: bool = False):
"""Run the FastAPI server using uvicorn."""
if not OPENAI_API_KEY:
raise ValueError('Missing the OpenAI API key. Please set it in the .env file or configure it through the GUI.')
if use_public:
setup_public_url(port)
else:
print(f"Starting Praison AI Call Server on http://localhost:{port}")
uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")
host = "0.0.0.0" # ngrok requires binding to all interfaces
if host == "0.0.0.0" and not use_public:
logger.warning(
"Binding to 0.0.0.0 exposes the server on all network interfaces. "
"Use --public for ngrok tunnelling, or bind to 127.0.0.1 for local-only access."
)
if not use_public:
print(f"Starting Praison AI Call Server on http://{host}:{port}")
uvicorn.run(app, host=host, port=port, log_level="warning")
def main(args=None):
"""Run the Praison AI Call Server."""
parser = argparse.ArgumentParser(description="Run the Praison AI Call Server.")
parser.add_argument('--public', action='store_true', help="Use ngrok to expose the server publicly")
parser.add_argument('--port', type=int, default=PORT, help="Port to run the server on")
parser.add_argument('--host', type=str, default="127.0.0.1", help="Host address to bind to (default: 127.0.0.1)")
if args is None:
args = parser.parse_args()
@@ -374,9 +383,10 @@ def main(args=None):
args = parser.parse_args(args)
port = args.port
host = args.host
use_public = args.public or PUBLIC
run_server(port=port, use_public=use_public)
run_server(port=port, host=host, use_public=use_public)
if __name__ == "__main__":
main()
@@ -15,7 +15,7 @@ Usage::
agent = Agent(
name="assistant",
tools=[execute_command],
approval=HTTPApproval(host="0.0.0.0", port=8899),
approval=HTTPApproval(port=8899),
)
"""