Repository navigation
fix(service): allow plain HTTP to every loopback address - #11
Merged
VikramLex merged 1 commit intoOct 25, 2026
Merged
Conversation
Connector, OAuth, vector, graph and model endpoints accepted plain HTTP only for localhost, 127.0.0.1 and [::1]. A local model or connector on 127.0.0.2 (any other 127/8 address) or [::ffff:127.0.0.1] was refused with "Use HTTPS, or HTTP on loopback", although it is loopback. The graph engine's provider check already accepts all of 127/8. Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
VikramLex
added a commit
that referenced
this pull request
Oct 25, 2026
…HTTP (#11) Code graph: the engine follows Graphify 0.9.95 (0.1.6 followed 0.9.91). The four releases 0.9.92 to 0.9.95 are ported, and against 0.9.95 every comparison check passes on Linux. YAML files are code, read structurally; each C# overload is a node of its own, with calls bound by argument count; type aliases and declarations are read in more languages; graph.json keeps parallel edges, and every reader reads an older graph.json the same way. The AST cache format and the code graph's episode names changed, so the first sync after upgrading extracts every file again and builds the code graph once more. graphicle graph update works on a graph over 512 MiB, such as that of kubernetes. Graphicle Core leaves the YAML keys out of its own code graph for now. Connections: the program allows plain http to every loopback address for the models, connectors, OAuth, vector and graph endpoints it calls, such as a local model on 127.0.0.2 (#11, by @rudycelekli). SDKs: the Python SDK keeps the service's Retry-After on an error, as GraphicleError.retry_after in seconds (#10, by @rudycelekli). On top of it, a Retry-After that is neither a number of seconds nor an HTTP date leaves retry_after as None, and the error stays a GraphicleError. Security: URLs with credentials, a bad port or no host are refused, and multicast addresses are blocked. Installing or refreshing a skill no longer writes through a symbolic link at SKILL.md or its version stamp, and its backups never follow a link. A link that a repository commits at .graphicle/.rebuild.lock, at the rebuild's temporary graph or at .gitattributes is no longer followed. Dependencies: yoke-derive 0.8.4 replaces 0.8.3, which was yanked. server.json is again the MCP Registry entry of the latest listed release, 0.1.6. Every crate and both SDKs are at 0.1.7, with a CHANGELOG entry. Signed-off-by: VikramLex <vikramlex@karlexai.com>
Member
|
Thank you again, @rudycelekli. This is merged as it is, and it ships in Graphicle 0.1.7. With it, a local model or connector on any loopback address works over plain HTTP, the same rule your #9 gave the SDKs. Release notes: https://github.com/Graphicle-AI/graphicle/releases/tag/v0.1.7 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The service's outbound URL rule (
model::checked_url, used for connector, OAuth, vector, graph and release endpoints, and by model profiles throughprovider_url) allows plain HTTP only on loopback, but itsloopback()matched three spellings:localhost,127.0.0.1and[::1]. So a local model server or connector on127.0.0.2(or any other 127.0.0.0/8 address) or on[::ffff:127.0.0.1]was refused with "Use HTTPS, or HTTP on loopback", even though it is loopback. The docs (docs/configuration.md,crates/graphicle/README.md) promise "HTTP on loopback", and the graph engine's provider check (graphicle-graph/src/llm_config.rs) already accepts all of127.*.This is the Rust service, a separate code path from #9 (which fixed the Python and TypeScript SDK clients).
Fix
loopback()now matches on the parsed host:localhost,Ipv4Addr::is_loopback,Ipv6Addr::is_loopback, or an IPv4-mapped loopback address. Nothing else changes: other plain-HTTP hosts are still refused, andGRAPHICLE_PROVIDER_HTTP_HOSTSbehaves as before.Test
New unit test
model::tests::plain_http_reaches_every_loopback_address_and_nothing_else: it accepts every loopback form through bothchecked_urlandprovider_url_with(including with a credential), and still refuses128.0.0.1,126.255.255.255,0.0.0.0,[::2],[::ffff:10.0.0.1],127.0.0.1.example.comandlocalhost.example.com.main(ddfd775): FAILED, panicked athttp://127.0.0.2:11434/v1model::tests::passRust 1.95.0.
rustfmt --checkandgit diff --checkare clean.