* fix(scripts): bind local make dev and make start to loopback
serve.sh and backend/Makefile started the Gateway with --host 0.0.0.0,
nginx.local.conf listened on every interface, and Next.js kept its
all-interfaces default outside Windows, so a local stack on a LAN or VPN
exposed ports 2026, 8001 and 3000, including /setup before the first
admin existed. The Docker stack and the README already document a
loopback-only default.
Bind the Gateway and frontend to 127.0.0.1 and keep nginx on loopback
unless BIND_HOST is set, the variable the Docker stack already honors.
nginx-local-conf.sh renders a copy listening on BIND_HOST, and serve.sh
resolves it before stopping anything so an invalid value cannot tear
down a running stack.
* docs(changelog): reference #6587
* docs(changelog): separate the loopback entry from the next bullet
---------
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
* fix(tests): make three backend test modules runnable on Windows hosts
Follow-up to #5210 (clock-granularity fix) clearing the remaining
deterministic Windows failures in modules that are otherwise
platform-neutral. Five tests fail on Windows for root causes unrelated
to the behavior under test:
- test_pnpm_script.py::test_make_install_dry_run_does_not_invoke_bare_pnpm
shells out to `make`, which Git Bash on Windows does not bundle
(the same gap reported in #5177). Skip when make is unavailable.
- test_mcp_session_pool.py: one test asserts the injected MCP temp dir
has POSIX mode 0o700; Windows has no POSIX mode bits (ntfs reports
0o777), so the mode check now runs only on POSIX. A second test
asserted `TMP.endswith("mcp-internal/tmp")` while Windows tmp paths
use backslashes; normalize the separator before comparing.
- test_skillscan_native.py: two tests build a 3000-operand `1+1+...`
chain to exercise deep-AST resilience. CPython's C recursion limit
for ast construction is platform-dependent (~800 on Windows vs
~8000 elsewhere), so 3000 reliably overflows on Windows and the
scanner records an error instead of findings. 600 chained BinOps
stays deep for the client-analysis walk while fitting the limit on
every supported platform.
No product code is touched; on POSIX the suite behaves exactly as
before.
* fix(tests): make three backend test modules runnable on Windows hosts
Follow-up to #5210 (clock-granularity fix) clearing the remaining
deterministic Windows failures in modules that are otherwise
platform-neutral. Five tests fail on Windows for root causes unrelated
to the behavior under test:
- test_pnpm_script.py::test_make_install_dry_run_does_not_invoke_bare_pnpm
shells out to `make`, which Git Bash on Windows does not bundle
(the same gap reported in #5177). Skip when make is unavailable.
- test_mcp_session_pool.py: one test asserts the injected MCP temp dir
has POSIX mode 0o700; Windows has no POSIX mode bits (ntfs reports
0o777), so the mode check now runs only on POSIX. A second test
asserted `TMP.endswith("mcp-internal/tmp")` while Windows tmp paths
use backslashes; normalize the separator before comparing.
- test_skillscan_native.py: two tests build a 3000-operand `1+1+...`
chain to exercise deep-AST resilience. CPython's C recursion limit
for ast construction is platform-dependent (~800 on Windows vs
~8000 elsewhere), so 3000 reliably overflows on Windows and the
scanner records an error instead of findings. 600 chained BinOps
stays deep for the client-analysis walk while fitting the limit on
every supported platform.
No product code is touched; on POSIX the suite behaves exactly as
before.
Update: address review feedback (P2, recursion-recovery regression)
The 600-operand chain no longer exercises recursion exhaustion on POSIX,
so the recovery handler in _scan_python was unprotected by the renamed
test. Replace the input-based variant with a controlled RecursionError
injected via monkeypatched _find_client_handle_sink (platform-
independent); removing the handler now turns the test red again.
* fix(tests): make three backend test modules runnable on Windows hosts
Follow-up to #5210 (clock-granularity fix) clearing the remaining
deterministic Windows failures in modules that are otherwise
platform-neutral. Five tests fail on Windows for root causes unrelated
to the behavior under test:
- test_pnpm_script.py::test_make_install_dry_run_does_not_invoke_bare_pnpm
shells out to `make`, which Git Bash on Windows does not bundle
(the same gap reported in #5177). Skip when make is unavailable.
- test_mcp_session_pool.py: one test asserts the injected MCP temp dir
has POSIX mode 0o700; Windows has no POSIX mode bits (ntfs reports
0o777), so the mode check now runs only on POSIX. A second test
asserted `TMP.endswith("mcp-internal/tmp")` while Windows tmp paths
use backslashes; normalize the separator before comparing.
- test_skillscan_native.py: two tests build a 3000-operand `1+1+...`
chain to exercise deep-AST resilience. CPython's C recursion limit
for ast construction is platform-dependent (~800 on Windows vs
~8000 elsewhere), so 3000 reliably overflows on Windows and the
scanner records an error instead of findings. 600 chained BinOps
stays deep for the client-analysis walk while fitting the limit on
every supported platform.
No product code is touched; on POSIX the suite behaves exactly as
before.
Update: address review feedback (P2, recursion-recovery regression)
The 600-operand chain no longer exercises recursion exhaustion on POSIX,
so the recovery handler in _scan_python was unprotected by the renamed
test. Replace the input-based variant with a controlled RecursionError
injected via monkeypatched _find_client_handle_sink (platform-
independent); removing the handler now turns the test red again.
Update: address second review feedback (P2, early-stop regression coverage)
The 600-operand tail no longer proves the walk stops after finding a
sink (it completes inside POSIX recursion limits either way). Replace it
with the suggested instrumentation: a sentinel os.system call after the
sink plus an instrumented _walk_client_scope that records any visit to
the sentinel while analysis.found is already set, failing the test if
traversal continues past the sink. Platform-independent; the sentinel's
shell-exec finding comes from the deterministic ast.walk pass and is
irrelevant to the walk guard.
