kshitijk4poor 98f7ec3cf4 refactor(proxy): derive the bind policy once and pin the refusal status ...

The bind address never changes for an app's lifetime, so create_app now
canonicalises it and computes the wildcard flag and allowed Host set once
instead of on every request. _WILDCARD_HOSTS duplicated what
ip_address().is_unspecified already answers (only "" needs a special case),
the Sec-Fetch-Site sets become named module constants, and fetch_site is a
required argument so no caller can silently skip that check.

The 403 message now says what is actually refused (browser requests and
foreign Host names) rather than implying every non-local client is.

The parametrized proxy test asserted 200-vs-"some 4xx" via a tuple
comparison; it now pins status == 200/403 and the exact upstream request
count, so a regression to a different status or a leaked forward fails.

2026-10-03 16:29:17 +05:30

..

adapters

Merge origin/main (561b053f79) into simp/forwardport: forward-port 220 main commits into the simplified tree

2026-09-03 03:31:03 -07:00

__init__.py

refactor(hclib): remaining hermes_cli library modules — dead code, unified helpers, flattened branches

2026-09-02 15:03:42 -07:00

cli.py

refactor(hermes_cli): drop intra-function paragraph blanks in g5 files (whitespace-only)

2026-09-02 21:00:55 -07:00

server.py

refactor(proxy): derive the bind policy once and pin the refusal status

2026-10-03 16:29:17 +05:30

sse_done.py

refactor(hermes_cli): sse_done walrus loop; proxy_cli bitwarden token_env local + docstring trims

2026-09-02 21:09:53 -07:00