Code quality pass: address review items

- Compute AssignmentBoundaryPrecedence from BinaryOperators dynamically
- PathParametersBinding constant for "parameter" magic string
- Token.ToString falls back to OriginalValue when Value is null
- Move CA1859 suppression to .editorconfig (with explanation)
- Structural equality for lists and besetning instances
- Use BaconJsonSerializer.Options consistently in error responses
- Document HTTP method case-sensitivity in LANGUAGE.md
- Document BaconProcess.Closure semantics with XML comment
- Add line numbers to RuntimeException with CLI integration
- Add --host flag for binding to non-localhost addresses
- Document HTTP-only and reverse proxy guidance

Author: Eiromplays

.editorconfig

@@ -0,0 +1,4 @@
+# CA1859: Use concrete types when possible
+# We deliberately return IReadOnlyList<T> for API stability over micro-optimization
+[*.cs]
+dotnet_diagnostic.CA1859.severity = none

LANGUAGE.md

@@ -166,7 +166,13 @@ Run as web server with `--serve`:
 dotnet run --project src/Bacon.Cli/Bacon.Cli.csproj -- --serve api.bacon
 ```
 
-Currently supported HTTP methods: GET, POST, PUT, DELETE, PATCH.
+Options:
+- `--port <port>` — port to bind to (default 5000)
+- `--host <host>` — host to bind to (default localhost; use `0.0.0.0` for container scenarios)
+
+**Notes:**
+- Bacon serves HTTP only. For HTTPS, use a reverse proxy like Caddy or nginx in front.
+- HTTP methods are case-sensitive and must be uppercase. Lowercase `get` will be parsed as an identifier, not an HTTP method.
 
 ## Comments
 

TODO.md

@@ -1,23 +1,8 @@
 # TODO
 
-Items found during code review with Claude Cowork (2026-05-03).
-
-## Bugs to fix
-
-All bugs from initial code review have been fixed.
-
 ## Code quality
 
-- [ ] Magic precedence number `31` in `Parser.Statements.cs` — compute as `BinaryOperators[TokenType.Is].Precedence + 1`
-- [ ] `AreEqual` returns false for structurally-identical lists/besetnings — extend to compare elements/fields
-- [ ] `BaconProcess.Closure` always captures `_global`; rename or document that nested process declarations aren't supported
-- [ ] HTTP method tokens are case-sensitive in lexer; either fold to uppercase or document explicitly
-- [ ] `BaconWebHost` always binds to localhost; consider `--host` flag for container scenarios
-- [ ] `RuntimeException` carries no source location; add `(string message, int line)` constructor
-- [ ] Magic string `"parameter"` in `Evaluator.Web.cs` should be a named constant
-- [ ] `Token.ToString()` drops `OriginalValue` for tokens with null `Value`
-- [ ] CA1859 suppressions are scattered across files; consolidate via `.editorconfig`
-- [ ] `WriteJsonResponse` mixes manual content-type with `WriteAsJsonAsync` style elsewhere
+All items from initial code review have been addressed.
 
 ## Future features
 
@@ -29,3 +14,4 @@ All bugs from initial code review have been fixed.
 - More stdlib functions
 - Package as `dotnet tool` for direct `bacon` command
 - Module system (currently `import` is a no-op)
+- HTTPS support (currently HTTP-only)

examples/runtime_error.bacon

@@ -0,0 +1,4 @@
+prosess hovedprogram() {
+    fast x er 5
+    leverer x + "hello"
+}

src/Bacon.Cli/Program.cs

@@ -10,17 +10,31 @@
 }
 
 var serve = args.Contains("--serve");
-var portArg = ParsePortArg(args);
+
+int? portArg;
+string? hostArg;
+try
+{
+    portArg = ParsePortArg(args);
+    hostArg = ParseHostArg(args);
+}
+catch (ArgumentException ex)
+{
+    Console.Error.WriteLine($"Error: {ex.Message}");
+    PrintUsage();
+    return 1;
+}
+
 var filePath = ParseFilePath(args);
 
-if (portArg.HasValue && !serve)
+if ((portArg.HasValue || hostArg != null) && !serve)
 {
-    Console.Error.WriteLine("Error: --port can only be used with --serve");
+    Console.Error.WriteLine("Error: --port and --host can only be used with --serve");
     PrintUsage();
     return 1;
 }
 
-if (filePath == null)
+if (string.IsNullOrWhiteSpace(filePath))
 {
     Console.Error.WriteLine("Error: missing file argument");
     PrintUsage();
@@ -33,7 +47,6 @@
     return 1;
 }
 
-var port = portArg ?? 5000;
 var source = await File.ReadAllTextAsync(filePath);
 
 try
@@ -44,7 +57,7 @@
     if (serve)
     {
         var host = new BaconWebHost(program);
-        await host.RunAsync(port);
+        await host.RunAsync(portArg ?? 5000, hostArg ?? "localhost");
     }
     else
     {
@@ -65,7 +78,9 @@
 }
 catch (RuntimeException ex)
 {
-    Console.Error.WriteLine($"Runtime error: {ex.Message}");
+    Console.Error.WriteLine(ex.Line.HasValue
+        ? $"Runtime error at {filePath}:{ex.Line}: {ex.Message}"
+        : $"Runtime error: {ex.Message}");
     return 1;
 }
 
@@ -84,23 +99,33 @@
     return port is < 1 or > 65535 ? throw new ArgumentException($"Invalid port value: {port} (must be 1-65535)") : port;
 }
 
+static string? ParseHostArg(string[] args)
+{
+    var index = Array.IndexOf(args, "--host");
+    if (index < 0) return null;
+
+    return index + 1 >= args.Length ? throw new ArgumentException("--host requires a value") : args[index + 1];
+}
+
 static string? ParseFilePath(string[] args)
 {
     for (var i = 0; i < args.Length; i++)
     {
-        if (!args[i].StartsWith("--"))
+        if (!args[i].StartsWith("--", StringComparison.Ordinal))
             return args[i];
-        if (args[i] == "--port")
+
+        if (args[i] is "--port" or "--host")
             i++;
     }
     return null;
 }
 
 static void PrintUsage()
 {
-    Console.Error.WriteLine("Usage: Bacon.Cli [--serve] [--port <port>] <file.bacon>");
+    Console.Error.WriteLine("Usage: Bacon.Cli [--serve] [--port <port>] [--host <host>] <file.bacon>");
     Console.Error.WriteLine();
     Console.Error.WriteLine("Options:");
     Console.Error.WriteLine("  --serve         Run as a web server");
     Console.Error.WriteLine("  --port <port>   Port to serve on (default 5000, requires --serve)");
+    Console.Error.WriteLine("  --host <host>   Host to bind to (default localhost, requires --serve)");
 }

src/Bacon.Compiler/Evaluation/BaconValue.cs

@@ -21,9 +21,12 @@ public sealed record BaconBesetningInstance(
 }
 public sealed record BaconBesetningType(BesetningDeclaration Declaration) : BaconValue;
 
-public sealed record BaconProcess(
-    ProcessDeclaration Declaration,
-    Environment Closure) : BaconValue;
+/// <summary>
+/// The environment captured at process declaration time. Currently, always _global
+/// because Bacon doesn't yet support nested process declarations. When that changes,
+/// this will capture the lexical scope at declaration site.
+/// </summary>
+public sealed record BaconProcess(ProcessDeclaration Declaration, Environment Closure) : BaconValue;
 
 public sealed record BaconBuiltinFunction(
     string Name,

src/Bacon.Compiler/Evaluation/Evaluator.Calls.cs

@@ -11,25 +11,24 @@ private BaconValue EvaluateCall(CallExpression call)
 
         return callee switch
         {
-            BaconProcess process => CallProcess(process, args),
+            BaconProcess process => CallProcess(process, args, call.Line),
             BaconBuiltinFunction builtin => builtin.Implementation(args),
-            BaconBesetningType type => InstantiateBesetning(type, args),
-            _ => throw new RuntimeException($"Cannot call value of type {TypeName(callee)}")
+            BaconBesetningType type => InstantiateBesetning(type, args, call.Line),
+            _ => throw new RuntimeException($"Cannot call value of type {TypeName(callee)}", call.Line)
         };
     }
 
-    [System.Diagnostics.CodeAnalysis.SuppressMessage("Performance", "CA1859",
-        Justification = "We do not need to modify the list just read it")]
     private static BaconBesetningInstance InstantiateBesetning(
         BaconBesetningType type,
-        IReadOnlyList<BaconValue> args)
+        IReadOnlyList<BaconValue> args,
+        int line)
     {
         var decl = type.Declaration;
 
         if (args.Count != decl.Fields.Count)
         {
             throw new RuntimeException(
-                $"'{decl.Name}' expected {decl.Fields.Count} arguments, got {args.Count}");
+                $"'{decl.Name}' expected {decl.Fields.Count} arguments, got {args.Count}", line);
         }
 
         var fields = new Dictionary<string, BaconValue>();
@@ -41,16 +40,14 @@ private static BaconBesetningInstance InstantiateBesetning(
         return new BaconBesetningInstance(type, fields);
     }
 
-    [System.Diagnostics.CodeAnalysis.SuppressMessage("Performance", "CA1859",
-        Justification = "We do not need to modify the list just read it")]
-    private BaconValue CallProcess(BaconProcess process, IReadOnlyList<BaconValue> args)
+    private BaconValue CallProcess(BaconProcess process, IReadOnlyList<BaconValue> args, int line)
     {
         var decl = process.Declaration;
 
         if (args.Count != decl.Parameters.Count)
         {
             throw new RuntimeException(
-                $"'{decl.Name}' expected {decl.Parameters.Count} arguments, got {args.Count}");
+                $"'{decl.Name}' expected {decl.Parameters.Count} arguments, got {args.Count}", line);
         }
 
         var callEnv = new Environment(parent: process.Closure);