@camstack/system 1.2.115 → 1.2.117

package/dist/builtins/local-network/local-network.addon.js

@@ -1,8 +1,152 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
+const require_lan_http_bind = require("../../lan-http-bind-DmgpFP6_.js");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+let node_net = require("node:net");
+//#region src/builtins/local-network/local-hostname.ts
+var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
+/**
+* Parse the operator-typed local hostname.
+*
+* Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
+* lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
+* leak into a SAN or a candidate URL.
+*/
+function parseLocalHostname(raw) {
+	const trimmed = raw.trim();
+	if (trimmed === "") return {
+		ok: true,
+		value: null
+	};
+	if (/[\s/:?#]/.test(trimmed) || trimmed.includes("\\")) return {
+		ok: false,
+		error: "Enter a DNS name such as camstack.lan, without a scheme or port."
+	};
+	const lowered = trimmed.toLowerCase();
+	if ((0, node_net.isIP)(lowered) !== 0) return {
+		ok: false,
+		error: "Use the address allowlist for IPs — this field is a DNS name."
+	};
+	if (!DNS_NAME.test(lowered)) return {
+		ok: false,
+		error: "Enter a DNS name such as camstack.lan, without a scheme or port."
+	};
+	return {
+		ok: true,
+		value: lowered
+	};
+}
+//#endregion
+//#region src/builtins/local-network/ipv6-lan.ts
+/**
+* IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+* rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+* that keeps temporary GUA off the connection candidate list.
+*/
+var IFA_F_TEMPORARY = 1;
+var IFA_F_DEPRECATED = 32;
+var IFA_F_TENTATIVE = 64;
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+function ipv6Prefix64Key(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.slice(0, 4).map((g) => g.toString(16).padStart(4, "0")).join(":");
+}
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+function ipv6ToHex32(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.map((g) => g.toString(16).padStart(4, "0")).join("");
+}
+/**
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
+function parseProcIfInet6(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		const parts = trimmed.split(/\s+/);
+		const hex = parts[0]?.toLowerCase();
+		const flagsRaw = parts[4];
+		if (!hex || hex.length !== 32 || flagsRaw === void 0) continue;
+		const flags = Number.parseInt(flagsRaw, 16);
+		if (!Number.isFinite(flags)) continue;
+		out.set(hex, flags);
+	}
+	return out;
+}
+/**
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
+function shouldAdvertiseIpv6(address, flags) {
+	const a = address.toLowerCase().split("%")[0] ?? address;
+	if (a === "::" || a === "::1") return false;
+	if (a.startsWith("fe80:")) return false;
+	if (a.startsWith("ff")) return false;
+	if (flags === void 0) return true;
+	if ((flags & IFA_F_TEMPORARY) !== 0) return false;
+	if ((flags & IFA_F_DEPRECATED) !== 0) return false;
+	if ((flags & IFA_F_TENTATIVE) !== 0) return false;
+	if (flags === 0) return false;
+	return true;
+}
+function ipv6AllowlistMatches(address, allowed) {
+	if (allowed.includes(address)) return true;
+	const key = ipv6Prefix64Key(address);
+	if (key === null) return false;
+	for (const entry of allowed) {
+		if (!entry.includes(":")) continue;
+		if (ipv6Prefix64Key(entry) === key) return true;
+	}
+	return false;
+}
+function parseIpv6Groups(address) {
+	const raw = address.toLowerCase().split("%")[0];
+	if (!raw || raw.includes(".")) return null;
+	const sides = raw.split("::");
+	if (sides.length > 2) return null;
+	const parsePart = (part) => {
+		if (part === void 0 || part === "") return [];
+		const groups = part.split(":");
+		const out = [];
+		for (const g of groups) {
+			if (g === "") return null;
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			out.push(Number.parseInt(g, 16));
+		}
+		return out;
+	};
+	if (sides.length === 1) {
+		const groups = parsePart(sides[0]);
+		if (groups === null || groups.length !== 8) return null;
+		return groups;
+	}
+	const left = parsePart(sides[0]);
+	const right = parsePart(sides[1]);
+	if (left === null || right === null) return null;
+	const fill = 8 - left.length - right.length;
+	if (fill < 0) return null;
+	return [
+		...left,
+		...Array(fill).fill(0),
+		...right
+	];
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -28,6 +172,8 @@ node_os = require_chunk.__toESM(node_os);
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+var ALLOWLIST_RECONCILE_INTERVAL_MS = 3600 * 1e3;
 /**
 * Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
 * `server/backend/src/boot/boot-config.ts`. Used only when neither the live
@@ -36,6 +182,8 @@ var POLL_INTERVAL_MS = 3e4;
 var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	pollTimer = null;
+	allowlistTimer = null;
+	allowlistReconcilePending = false;
 	lastSnapshotKey = "";
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
@@ -51,7 +199,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		super({
 			allowedAddresses: [],
 			bootSeeded: false,
-			notificationBaseUrl: ""
+			notificationBaseUrl: "",
+			httpEnabled: true,
+			httpPort: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+			localHostname: ""
 		});
 	}
 	/**
@@ -78,6 +229,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			});
 			this.ctx.logger.info("local-network: first-boot auto-seed", { meta: { addresses: seed } });
 		}
+		await this.persistReconciledAllowlist();
 		const provider = {
 			list: async () => ({
 				interfaces: this.enumerate(),
@@ -97,8 +249,15 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					source: localPort.source
 				} });
 				await this.reconcileMeshEndpoint();
+				const httpState = require_lan_http_bind.readLanHttpState();
 				return {
-					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint),
+					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+						enabled: this.config.httpEnabled !== false,
+						listening: httpState.listening,
+						httpPort: this.resolvedHttpPort(),
+						httpsPort: localPort.port,
+						localHostname: this.config.localHostname || null
+					}),
 					localPort
 				};
 			},
@@ -133,11 +292,42 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					dropped: addresses.length - cleaned.length
 				} });
 				return { success: true };
+			},
+			getTlsStatus: async () => this.snapshotTls(false),
+			regenerateCertificate: async (_input) => {
+				if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
+				await require_lan_http_bind.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
+				return this.snapshotTls(true);
+			},
+			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
+				const valid = require_lan_http_bind.validateUploadedTls(certPem, keyPem);
+				if (!valid.ok) throw new Error(valid.error);
+				const dir = (0, node_path.join)(this.tlsDataDir(), "tls");
+				await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
+				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
+				if (caPem && caPem.trim() !== "") await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
+				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "uploaded");
+				return this.snapshotTls(true);
+			},
+			downloadCa: async () => {
+				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+			},
+			revertToGeneratedCertificate: async () => {
+				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "generated");
+				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
+				await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans });
+				return this.snapshotTls(true);
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
 		this.pollTimer = setInterval(() => this.detectChanges(), POLL_INTERVAL_MS);
 		this.pollTimer.unref?.();
+		this.allowlistTimer = setInterval(() => {
+			this.persistReconciledAllowlist();
+		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
+		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStarted }, (event) => {
 			const data = event.data ?? {};
 			if (typeof data.url === "string") try {
@@ -156,16 +346,67 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			} : null);
 		});
 		this.ctx.logger.info("local-network initialized", { meta: { interfaceCount: this.enumerate().length } });
+		try {
+			await this.applyLanAccessFromSettings();
+		} catch (err) {
+			this.ctx.logger.warn("local-network: LAN HTTP not applied at boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 		return [{
 			capability: require_dist.localNetworkCapability,
 			provider
 		}];
 	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "local-access",
+			title: "LAN HTTP",
+			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			columns: 1,
+			fields: [
+				this.field({
+					type: "boolean",
+					key: "httpEnabled",
+					label: "Enable HTTP on the LAN",
+					style: "switch",
+					default: true
+				}),
+				this.field({
+					type: "number",
+					key: "httpPort",
+					label: "HTTP port",
+					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					min: 1,
+					max: 65535,
+					step: 1,
+					default: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+					showWhen: {
+						field: "httpEnabled",
+						equals: true
+					}
+				}),
+				this.field({
+					type: "text",
+					key: "localHostname",
+					label: "Local hostname",
+					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					maxLength: 253,
+					placeholder: "camstack.lan"
+				})
+			]
+		}] });
+	}
+	async onConfigChanged() {
+		await this.applyLanAccessFromSettings();
+	}
 	async onShutdown() {
 		if (this.pollTimer) {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
 		}
+		if (this.allowlistTimer) {
+			clearInterval(this.allowlistTimer);
+			this.allowlistTimer = null;
+		}
 	}
 	/**
 	* Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -229,6 +470,42 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			}
 		}
 	}
+	resolvedHttpPort() {
+		const port = this.config.httpPort;
+		return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
+	}
+	tlsDataDir() {
+		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
+	}
+	snapshotTls(restartRequired) {
+		const status = require_lan_http_bind.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+		return {
+			...status,
+			sans: [...status.sans]
+		};
+	}
+	/**
+	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
+	* keep the leaf SAN in sync with `localHostname`. This is the settings
+	* side-effect path — there is no second persist API.
+	*/
+	async applyLanAccessFromSettings() {
+		const parsed = parseLocalHostname(this.config.localHostname ?? "");
+		if (!parsed.ok) throw new Error(parsed.error);
+		const hostname = parsed.value ?? "";
+		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
+		const httpPort = this.resolvedHttpPort();
+		if (this.config.httpEnabled !== false && httpPort === httpsPort) throw new Error(`HTTP port ${httpPort} cannot equal the HTTPS listen port`);
+		await require_lan_http_bind.applyLanHttp({
+			enabled: this.config.httpEnabled !== false,
+			port: httpPort,
+			host: "0.0.0.0"
+		});
+		if (hostname !== "") {
+			require_lan_http_bind.writeExtraSans(this.tlsDataDir(), [hostname]);
+			if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "generated") await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+		} else require_lan_http_bind.writeExtraSans(this.tlsDataDir(), []);
+	}
 	/**
 	* The port this hub is actually listening on, plus the provenance of the
 	* number. The boot loader merges the `CAMSTACK_PORT` env override into the
@@ -263,7 +540,26 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(node_os.networkInterfaces());
+		return enumerateOsInterfaces(node_os.networkInterfaces(), readLinuxIpv6Flags());
+	}
+	/**
+	* Replace rotated IPv6 and drop addresses that no longer exist, without
+	* clearing operator extras that are still live (docker/vpn opt-in).
+	*/
+	async persistReconciledAllowlist(interfaces = this.enumerate()) {
+		if (this.allowlistReconcilePending) return;
+		this.allowlistReconcilePending = true;
+		try {
+			const next = reconcileAllowlist(this.config.allowedAddresses, interfaces);
+			if (sameAddressSet(this.config.allowedAddresses, next)) return;
+			await this.updateGlobalSettings({
+				allowedAddresses: next,
+				bootSeeded: true
+			});
+			this.ctx.logger.info("local-network: allowlist reconciled", { meta: { addresses: next } });
+		} finally {
+			this.allowlistReconcilePending = false;
+		}
 	}
 	detectChanges() {
 		const interfaces = this.enumerate();
@@ -274,6 +570,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			key
 		} });
 		this.lastSnapshotKey = key;
+		this.persistReconciledAllowlist(interfaces);
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -322,7 +619,7 @@ function validPort(value) {
 	if (value === null) return null;
 	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
 }
-function enumerateOsInterfaces(ifaces) {
+function enumerateOsInterfaces(ifaces, ipv6Flags) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
 		if (!addrs) continue;
@@ -342,8 +639,12 @@ function enumerateOsInterfaces(ifaces) {
 	const classified = raw.map((r) => {
 		const kind = classifyKind(r.name, r.address, r.internal);
 		const reachableKind = kind === "lan" || kind === "wifi";
-		const plausible = !r.internal && reachableKind && isPlausibleAutoSeed(r.address, r.family);
-		const plausibleReason = plausible ? "" : explainNonPlausible({
+		const hex = r.family === "IPv6" ? ipv6ToHex32(r.address) : null;
+		const flags = hex !== null ? ipv6Flags?.get(hex) : void 0;
+		const rangeOk = isPlausibleAutoSeed(r.address, r.family);
+		const stableV6 = r.family !== "IPv6" || shouldAdvertiseIpv6(r.address, flags);
+		const plausible = !r.internal && reachableKind && rangeOk && stableV6;
+		const plausibleReason = plausible ? "" : r.family === "IPv6" && rangeOk && !stableV6 ? "IPv6 temporary / privacy address — rotates and is not advertised." : explainNonPlausible({
 			kind,
 			family: r.family,
 			address: r.address,
@@ -372,13 +673,14 @@ function enumerateOsInterfaces(ifaces) {
 /**
 * Filter the interface list by the operator's allowlist. Empty
 * allowlist = no-op (every interface passes); otherwise only entries
-* whose `address` matches an allowlist entry remain. Loopback always
-* survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+* whose `address` matches an allowlist entry remain. IPv6 matches the
+* allowlisted /64 so a rotated privacy address does not hide the live
+* GUA. Loopback always survives so the SDK keeps `127.0.0.1` as the
+* last-resort fallback.
 */
 function applyAllowlist(interfaces, allowed) {
 	if (allowed.length === 0) return interfaces;
-	const set = new Set(allowed);
-	return interfaces.filter((i) => i.kind === "loopback" || set.has(i.address));
+	return interfaces.filter((i) => i.kind === "loopback" || ipv6AllowlistMatches(i.address, allowed) || allowed.includes(i.address));
 }
 /**
 * Rank interfaces and pick the auto-selected outbound one. See the
@@ -402,31 +704,13 @@ function pickPreferred(interfaces) {
 		return prefixLen(b.netmask) - prefixLen(a.netmask);
 	})[0] ?? null;
 }
-/**
-* Build the ordered candidate URL list. Priority schema:
-*   0       — preferred LAN IPv4
-*   10+     — other LAN IPv4
-*   100     — public tunnel hostname (always HTTPS)
-*   150     — mesh endpoint (Tailscale MagicDNS / 100.x, always HTTPS)
-*   200+    — LAN IPv6
-*   1000    — loopback (last resort)
-*
-* The mesh endpoint ranks just below a true public funnel (a Funnel is
-* reachable by ANY client; the mesh needs the peer on the same tailnet)
-* but above the IPv6 / loopback fallbacks — giving remote, mesh-joined
-* clients a working candidate when no public tunnel is up.
-*
-* `scheme` controls LAN + loopback URLs. Browsers running over HTTPS
-* block `http://` candidates as mixed content, so callers loaded over
-* HTTPS should pass `scheme: 'https'` even when probing a LAN IP — the
-* hub's cert manager already issues a SAN-multi cert covering local
-* interfaces. The public tunnel + mesh endpoint always emit `https://`
-* (the tunnel edge / the hub itself terminates TLS).
-*/
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
+	const httpLan = lanHttp?.enabled === true && lanHttp.listening === true;
+	const lanScheme = httpLan ? "http" : scheme;
+	const lanPort = httpLan ? lanHttp.httpPort : port;
 	const emit = (iface, kind, label, baseUrl, pri) => {
 		out.push({
 			label,
@@ -438,13 +722,29 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 			priority: pri
 		});
 	};
-	if (preferred) emit(preferred, "lan-ipv4", `${formatKind(preferred.kind)} — ${preferred.name}`, `${scheme}://${preferred.address}:${port}`, priority++);
+	if (httpLan && lanHttp.localHostname) out.push({
+		label: "Local name",
+		baseUrl: `${lanScheme}://${lanHttp.localHostname}:${lanPort}`,
+		kind: "lan-ipv4",
+		interfaceKind: "lan",
+		plausible: true,
+		plausibleReason: "",
+		priority: priority++
+	});
+	if (preferred) emit(preferred, "lan-ipv4", `${formatKind(preferred.kind)} — ${preferred.name}`, `${lanScheme}://${preferred.address}:${lanPort}`, priority++);
 	for (const iface of interfaces) {
 		if (iface.internal || iface.family !== "IPv4") continue;
 		if (iface.kind === "loopback") continue;
 		if (preferred && iface.name === preferred.name && iface.address === preferred.address) continue;
 		if (iface.address.startsWith("169.254.")) continue;
-		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${scheme}://${iface.address}:${port}`, 10 + priority++);
+		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
+	}
+	if (!ipv4Only) for (const iface of interfaces) {
+		if (iface.internal || iface.family !== "IPv6") continue;
+		if (iface.kind === "loopback") continue;
+		if (iface.address.toLowerCase().startsWith("fe80:")) continue;
+		if (!iface.plausible) continue;
+		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
@@ -464,15 +764,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		plausibleReason: "",
 		priority: 150
 	});
-	if (!ipv4Only) {
-		let v6prio = 200;
-		for (const iface of interfaces) {
-			if (iface.internal || iface.family !== "IPv6") continue;
-			if (iface.kind === "loopback") continue;
-			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${scheme}://[${iface.address}]:${port}`, v6prio++);
-		}
-	}
 	if (includeLoopback) out.push({
 		label: "Loopback",
 		baseUrl: `${scheme}://127.0.0.1:${port}`,
@@ -490,16 +781,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 *
 *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
 *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
-*     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
-*     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
-*     temporary addresses get included by default; the operator can
-*     prune them from the Network Addresses tab if the rotating IPs
-*     become a nuisance.
+*     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+*     Privacy-extension temporary addresses are skipped when Linux flags
+*     mark them non-permanent (`plausible === false`).
 *
 * Skips docker/vpn/loopback/other entirely — those stay opt-in.
 */
 function autoSeedAllowlist(interfaces) {
-	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family)).map((i) => i.address))];
+	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family) && (i.family !== "IPv6" || i.plausible)).map((i) => i.address))];
 }
 /**
 * Per-interface tooltip text surfaced on the "Unlikely usable" badge.
@@ -588,7 +877,33 @@ function formatKind(kind) {
 		case "other": return "Other";
 	}
 }
+/**
+* Rewrite a persisted allowlist against the live interface set:
+* current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+* extras (docker/vpn). Empty stays empty — that is "unrestricted".
+*/
+function reconcileAllowlist(current, interfaces) {
+	if (current.length === 0) return [];
+	const live = new Set(interfaces.map((i) => i.address));
+	const seed = autoSeedAllowlist(interfaces);
+	const seedSet = new Set(seed);
+	const extras = current.filter((a) => live.has(a) && !seedSet.has(a) && !a.includes(":"));
+	return [...new Set([...seed, ...extras])];
+}
+function sameAddressSet(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((addr) => set.has(addr));
+}
+function readLinuxIpv6Flags() {
+	try {
+		return parseProcIfInet6((0, node_fs.readFileSync)("/proc/net/if_inet6", "utf8"));
+	} catch {
+		return;
+	}
+}
 //#endregion
+exports.ALLOWLIST_RECONCILE_INTERVAL_MS = ALLOWLIST_RECONCILE_INTERVAL_MS;
 exports.LocalNetworkAddon = LocalNetworkAddon;
 exports.applyAllowlist = applyAllowlist;
 exports.autoSeedAllowlist = autoSeedAllowlist;
@@ -596,7 +911,11 @@ exports.buildEndpoints = buildEndpoints;
 exports.classifyKind = classifyKind;
 exports.enumerateOsInterfaces = enumerateOsInterfaces;
 exports.explainNonPlausible = explainNonPlausible;
+exports.ipv6Prefix64Key = ipv6Prefix64Key;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
+exports.parseProcIfInet6 = parseProcIfInet6;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
+exports.reconcileAllowlist = reconcileAllowlist;
 exports.resolveAdvertisedPort = resolveAdvertisedPort;
+exports.shouldAdvertiseIpv6 = shouldAdvertiseIpv6;