Revert "Merge pull request #3048 from code-yeongyu/fix/p0-2-https-enforcement-gaps"

This reverts commit ede561cb74, reversing
changes made to 2d13e125bb.

src/hooks/claude-code-hooks/execute-http-hook.ts

@@ -4,10 +4,13 @@ import { log } from "../../shared"
 
 const DEFAULT_HTTP_HOOK_TIMEOUT_S = 30
 const ALLOWED_SCHEMES = new Set(["http:", "https:"])
-const LOCALHOST_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"])
+
+function isProduction(): boolean {
+  return process.env.NODE_ENV === "production"
+}
 
 function isLocalhost(url: URL): boolean {
-  return LOCALHOST_HOSTNAMES.has(url.hostname)
+  return url.hostname === "localhost" || url.hostname === "127.0.0.1"
 }
 
 function isPlainHttp(url: URL): boolean {
@@ -65,10 +68,10 @@ export async function executeHttpHook(
 
   if (isPlainHttp(parsed)) {
     log("HTTP hook URL uses insecure protocol", { url: hook.url })
-    if (!isLocalhost(parsed)) {
+    if (isProduction() && !isLocalhost(parsed)) {
       return {
         exitCode: 1,
-        stderr: "HTTP hook URL must use HTTPS. Plain HTTP is only allowed for localhost, 127.0.0.1, and ::1.",
+        stderr: "HTTP hook URL must use HTTPS in production. Plain HTTP is only allowed for localhost/127.0.0.1.",
       }
     }
   }
@@ -81,7 +84,6 @@ export async function executeHttpHook(
       method: "POST",
       headers,
       body: stdin,
-      redirect: "manual",
       signal: AbortSignal.timeout(timeoutS * 1000),
     })