Audit fixes (2026-10): literal pathspecs, export comments, loopback bind, special-char paths

Dockerfile

@@ -49,11 +49,12 @@ EXPOSE 3002
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3002/api/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
+  CMD node -e "require('http').get('http://127.0.0.1:3002/api/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
 
 # Set environment
 ENV NODE_ENV=production
 ENV PORT=3002
+ENV HOST=0.0.0.0
 
 # Start application
 CMD ["node", "server.js"]

bin/ai-review.js

@@ -3,6 +3,7 @@
 const { spawn, execFileSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
+const { resolveHost, browseUrl } = require('../services/serverUrl');
 
 const PORT = process.env.PORT || 3002;
 
@@ -107,7 +108,7 @@
   // Open browser if requested
   if (openBrowser) {
     setTimeout(() => {
-      const url = `http://localhost:${port}`;
+      const url = browseUrl(resolveHost(process.env), port);
       console.log(`\n🌐 Opening browser: ${url}`);
 
       const start = (process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open');
@@ -206,7 +207,7 @@
         if (i + 1 < args.length) {
           port = parseInt(args[i + 1]);
           i++; // Skip next argument
           if (isNaN(port) || port < 1 || port > 65535) {
             console.error('❌ Invalid port number');
             process.exit(1);
           }

docker-compose.yml

@@ -7,17 +7,18 @@ services:
       dockerfile: Dockerfile
     container_name: ai-visual-code-review
     ports:
-      - "3002:3002"
+      - "127.0.0.1:3002:3002"
     environment:
       - NODE_ENV=production
       - PORT=3002
+      - HOST=0.0.0.0
     volumes:
       # Mount current directory for reviewing code
       - .:/workspace:ro
     working_dir: /workspace
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3002/api/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3002/api/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
       interval: 30s
       timeout: 3s
       retries: 3
@@ -31,10 +32,11 @@ services:
       target: builder
     container_name: ai-visual-code-review-dev
     ports:
-      - "3002:3002"
+      - "127.0.0.1:3002:3002"
     environment:
       - NODE_ENV=development
       - PORT=3002
+      - HOST=0.0.0.0
     volumes:
       - .:/app
       - /app/node_modules

docs/audit/FIXES.md

@@ -0,0 +1,12 @@
+# FIXES - ai-visual-code-review (branch fix/audit-2026-10)
+
+P0/P1 kept findings: AVCR-001, AVCR-002, AVCR-005. (AVCR-017/018/019/029 are P1 but verdict duplicate, so skipped; 018 and 029 are merged into 005.)
+Safe test command: 7 suites, 107/107 pass (not full npm test; worktree clean afterwards apart from the commits).
+
+| id | status | commit | evidence | remains |
+|---|---|---|---|---|
+| AVCR-001 | fixed | see git log (fix(git)) | test/git-service-paths.test.js: 3 of 4 cases fail before, 4/4 pass after | Args before `--` still use the old char filter (no caller passes any). |
+| AVCR-002 | fixed | see git log (fix(export)) | test/unified-review-comments.test.js fails before, passes after | "Files processed: undefined" in the page text (SETUP 5.3) not addressed; it is client-side and outside this finding. |
+| AVCR-005 | partial | see git log (fix(server)) | test/bind-host.test.js: 3 fail before, 3 pass after | Remote-access hardening beyond the loopback default is an owner decision (details kept privately by the owner). Docker still unfixed per AVCR-006 (no git in image, working_dir). Default now 127.0.0.1; HOST=0.0.0.0 set in Dockerfile/compose; compose publishes 127.0.0.1:3002. |
+
+Later review and Codex follow-ups on PR #43 (literal pathspecs, exact lineId matching, special-path web view, healthcheck host, own-key comment lookup, bind-address banner) are recorded in the PR itself.