| 610 | |
| 611 | def run_server( |
| 612 | host: str = "127.0.0.1", |
| 613 | port: int = 8765, |
| 614 | open_browser: bool = True, |
| 615 | allow_remote: bool = False, |
| 616 | ) -> None: |
| 617 | if not _is_loopback_host(host) and not allow_remote: |
| 618 | raise SystemExit( |
| 619 | f"Refusing to bind {host}: the GUI has no authentication, and its settings\n" |
| 620 | "endpoint can read and rewrite .env (including provider API keys). Anyone\n" |
| 621 | "who can reach this port would have that access.\n\n" |
| 622 | "Use the default 127.0.0.1, or pass --allow-remote if you genuinely intend\n" |