fix: harden workflow config rpc target routing

src/wf_transport_rpc_http/app.py

@@ -25,16 +25,18 @@ from .models import (
 )
 
 
-def create_rpc_app(server: WorkflowServer) -> jsonrpc.API:
+def create_rpc_app(server: WorkflowServer, *, rpc_path: str = "/rpc") -> jsonrpc.API:
     """Build a JSON-RPC HTTP app over an existing WorkflowServer.
 
     Transport code owns only JSON-RPC envelope handling. Workflow semantics stay
     behind server.api, so this package remains swappable with WebSocket/MCP
     transports later.
     """
+    if not rpc_path.startswith("/"):
+        raise ValueError("rpc_path must start with '/'")
 
     app = jsonrpc.API()
-    entrypoint = jsonrpc.Entrypoint("/rpc")
+    entrypoint = jsonrpc.Entrypoint(rpc_path)
 
     @app.get("/healthz")
     async def healthz() -> dict[str, str]:

src/wf_transport_rpc_http/cli.py

@@ -30,13 +30,24 @@ def serve(
         "--store-root",
         help="Override filesystem workflow store root.",
     ),
-    host: str | None = typer.Option(None, "--host"),
-    port: int | None = typer.Option(None, "--port", min=1, max=65535),
+    host: str | None = typer.Option(
+        None,
+        "--host",
+        help="Override RPC bind host; defaults to config or 127.0.0.1.",
+    ),
+    port: int | None = typer.Option(
+        None,
+        "--port",
+        min=1,
+        max=65535,
+        help="Override RPC bind port; defaults to config or 8765.",
+    ),
 ) -> None:
     """Serve the local/static WorkflowApi over JSON-RPC HTTP."""
     resolved_store_root = store_root
     resolved_host = host
     resolved_port = port
+    resolved_rpc_path = "/rpc"
     if config is not None:
         workflow_config = load_workflow_config(config)
         store = workflow_config.server.store
@@ -56,13 +67,14 @@ def serve(
         if rpc_transport is not None:
             resolved_host = host or rpc_transport.host
             resolved_port = port or rpc_transport.port
+            resolved_rpc_path = rpc_transport.path
     if resolved_store_root is None:
         raise typer.BadParameter(
             "--store-root is required when --config is not supplied"
         )
 
     server = build_local_static_workflow_server(resolved_store_root)
-    rpc_app = create_rpc_app(server)
+    rpc_app = create_rpc_app(server, rpc_path=resolved_rpc_path)
     uvicorn.run(
         rpc_app,
         host=resolved_host or "127.0.0.1",