From 1334b0b3207c19fe8c46b7771fa894357f3a2f55 Mon Sep 17 00:00:00 2001
From: Jason Walker <913443@dadeschools.net>
Date: Thu, 9 Jul 2026 08:10:36 -0400
Subject: [PATCH] fix: restore ISSUE_LOCK_FILE import and fail-closed public
 bind

Conflict resolution left webui/lease_loader.py importing ISSUE_LOCK_FILE
from merged_cleanup_reconcile (not exported); import from
issue_lock_provenance instead. Validate WEBUI_HOST before loading the
full app stack so 0.0.0.0 refuse exits immediately.

Addresses reviewer findings on PR #456 / issue #435.
---
 webui/__main__.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/webui/__main__.py b/webui/__main__.py
index 5c427da..9265ea8 100644
--- a/webui/__main__.py
+++ b/webui/__main__.py
@@ -7,7 +7,6 @@ import os
 
 import uvicorn
 
-from webui.app import create_app
 from webui.deployment_boundary import assess_bind_host
 
 logger = logging.getLogger("webui")
@@ -25,9 +24,13 @@ def _validate_bind_host(host: str) -> None:
 def main() -> None:
     host = os.environ.get("WEBUI_HOST", "127.0.0.1")
     port = int(os.environ.get("WEBUI_PORT", "8765"))
+    # Validate bind host before importing the full app stack so refuse paths
+    # fail closed quickly (tests and operators must not hang on create_app).
     _validate_bind_host(host)
+    from webui.app import create_app
+
     uvicorn.run(create_app(), host=host, port=port, log_level="info")
 
 
 if __name__ == "__main__":
-    main()
\ No newline at end of file
+    main()