@camstack/system 1.2.116 → 1.2.117

package/dist/builtins/local-network/local-network.addon.js

@@ -1,11 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
-const require_lan_http_bind = require("../../lan-http-bind-CZ4EBeD_.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
+const require_lan_http_bind = require("../../lan-http-bind-DmgpFP6_.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
 let node_net = require("node:net");
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
@@ -41,6 +42,111 @@ function parseLocalHostname(raw) {
 	};
 }
 //#endregion
+//#region src/builtins/local-network/ipv6-lan.ts
+/**
+* IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+* rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+* that keeps temporary GUA off the connection candidate list.
+*/
+var IFA_F_TEMPORARY = 1;
+var IFA_F_DEPRECATED = 32;
+var IFA_F_TENTATIVE = 64;
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+function ipv6Prefix64Key(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.slice(0, 4).map((g) => g.toString(16).padStart(4, "0")).join(":");
+}
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+function ipv6ToHex32(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.map((g) => g.toString(16).padStart(4, "0")).join("");
+}
+/**
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
+function parseProcIfInet6(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		const parts = trimmed.split(/\s+/);
+		const hex = parts[0]?.toLowerCase();
+		const flagsRaw = parts[4];
+		if (!hex || hex.length !== 32 || flagsRaw === void 0) continue;
+		const flags = Number.parseInt(flagsRaw, 16);
+		if (!Number.isFinite(flags)) continue;
+		out.set(hex, flags);
+	}
+	return out;
+}
+/**
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
+function shouldAdvertiseIpv6(address, flags) {
+	const a = address.toLowerCase().split("%")[0] ?? address;
+	if (a === "::" || a === "::1") return false;
+	if (a.startsWith("fe80:")) return false;
+	if (a.startsWith("ff")) return false;
+	if (flags === void 0) return true;
+	if ((flags & IFA_F_TEMPORARY) !== 0) return false;
+	if ((flags & IFA_F_DEPRECATED) !== 0) return false;
+	if ((flags & IFA_F_TENTATIVE) !== 0) return false;
+	if (flags === 0) return false;
+	return true;
+}
+function ipv6AllowlistMatches(address, allowed) {
+	if (allowed.includes(address)) return true;
+	const key = ipv6Prefix64Key(address);
+	if (key === null) return false;
+	for (const entry of allowed) {
+		if (!entry.includes(":")) continue;
+		if (ipv6Prefix64Key(entry) === key) return true;
+	}
+	return false;
+}
+function parseIpv6Groups(address) {
+	const raw = address.toLowerCase().split("%")[0];
+	if (!raw || raw.includes(".")) return null;
+	const sides = raw.split("::");
+	if (sides.length > 2) return null;
+	const parsePart = (part) => {
+		if (part === void 0 || part === "") return [];
+		const groups = part.split(":");
+		const out = [];
+		for (const g of groups) {
+			if (g === "") return null;
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			out.push(Number.parseInt(g, 16));
+		}
+		return out;
+	};
+	if (sides.length === 1) {
+		const groups = parsePart(sides[0]);
+		if (groups === null || groups.length !== 8) return null;
+		return groups;
+	}
+	const left = parsePart(sides[0]);
+	const right = parsePart(sides[1]);
+	if (left === null || right === null) return null;
+	const fill = 8 - left.length - right.length;
+	if (fill < 0) return null;
+	return [
+		...left,
+		...Array(fill).fill(0),
+		...right
+	];
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -66,6 +172,8 @@ function parseLocalHostname(raw) {
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+var ALLOWLIST_RECONCILE_INTERVAL_MS = 3600 * 1e3;
 /**
 * Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
 * `server/backend/src/boot/boot-config.ts`. Used only when neither the live
@@ -74,6 +182,8 @@ var POLL_INTERVAL_MS = 3e4;
 var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	pollTimer = null;
+	allowlistTimer = null;
+	allowlistReconcilePending = false;
 	lastSnapshotKey = "";
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
@@ -119,6 +229,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			});
 			this.ctx.logger.info("local-network: first-boot auto-seed", { meta: { addresses: seed } });
 		}
+		await this.persistReconciledAllowlist();
 		const provider = {
 			list: async () => ({
 				interfaces: this.enumerate(),
@@ -213,6 +324,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
 		this.pollTimer = setInterval(() => this.detectChanges(), POLL_INTERVAL_MS);
 		this.pollTimer.unref?.();
+		this.allowlistTimer = setInterval(() => {
+			this.persistReconciledAllowlist();
+		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
+		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStarted }, (event) => {
 			const data = event.data ?? {};
 			if (typeof data.url === "string") try {
@@ -288,6 +403,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
 		}
+		if (this.allowlistTimer) {
+			clearInterval(this.allowlistTimer);
+			this.allowlistTimer = null;
+		}
 	}
 	/**
 	* Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -421,7 +540,26 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(node_os.networkInterfaces());
+		return enumerateOsInterfaces(node_os.networkInterfaces(), readLinuxIpv6Flags());
+	}
+	/**
+	* Replace rotated IPv6 and drop addresses that no longer exist, without
+	* clearing operator extras that are still live (docker/vpn opt-in).
+	*/
+	async persistReconciledAllowlist(interfaces = this.enumerate()) {
+		if (this.allowlistReconcilePending) return;
+		this.allowlistReconcilePending = true;
+		try {
+			const next = reconcileAllowlist(this.config.allowedAddresses, interfaces);
+			if (sameAddressSet(this.config.allowedAddresses, next)) return;
+			await this.updateGlobalSettings({
+				allowedAddresses: next,
+				bootSeeded: true
+			});
+			this.ctx.logger.info("local-network: allowlist reconciled", { meta: { addresses: next } });
+		} finally {
+			this.allowlistReconcilePending = false;
+		}
 	}
 	detectChanges() {
 		const interfaces = this.enumerate();
@@ -432,6 +570,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			key
 		} });
 		this.lastSnapshotKey = key;
+		this.persistReconciledAllowlist(interfaces);
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -480,7 +619,7 @@ function validPort(value) {
 	if (value === null) return null;
 	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
 }
-function enumerateOsInterfaces(ifaces) {
+function enumerateOsInterfaces(ifaces, ipv6Flags) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
 		if (!addrs) continue;
@@ -500,8 +639,12 @@ function enumerateOsInterfaces(ifaces) {
 	const classified = raw.map((r) => {
 		const kind = classifyKind(r.name, r.address, r.internal);
 		const reachableKind = kind === "lan" || kind === "wifi";
-		const plausible = !r.internal && reachableKind && isPlausibleAutoSeed(r.address, r.family);
-		const plausibleReason = plausible ? "" : explainNonPlausible({
+		const hex = r.family === "IPv6" ? ipv6ToHex32(r.address) : null;
+		const flags = hex !== null ? ipv6Flags?.get(hex) : void 0;
+		const rangeOk = isPlausibleAutoSeed(r.address, r.family);
+		const stableV6 = r.family !== "IPv6" || shouldAdvertiseIpv6(r.address, flags);
+		const plausible = !r.internal && reachableKind && rangeOk && stableV6;
+		const plausibleReason = plausible ? "" : r.family === "IPv6" && rangeOk && !stableV6 ? "IPv6 temporary / privacy address — rotates and is not advertised." : explainNonPlausible({
 			kind,
 			family: r.family,
 			address: r.address,
@@ -530,13 +673,14 @@ function enumerateOsInterfaces(ifaces) {
 /**
 * Filter the interface list by the operator's allowlist. Empty
 * allowlist = no-op (every interface passes); otherwise only entries
-* whose `address` matches an allowlist entry remain. Loopback always
-* survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+* whose `address` matches an allowlist entry remain. IPv6 matches the
+* allowlisted /64 so a rotated privacy address does not hide the live
+* GUA. Loopback always survives so the SDK keeps `127.0.0.1` as the
+* last-resort fallback.
 */
 function applyAllowlist(interfaces, allowed) {
 	if (allowed.length === 0) return interfaces;
-	const set = new Set(allowed);
-	return interfaces.filter((i) => i.kind === "loopback" || set.has(i.address));
+	return interfaces.filter((i) => i.kind === "loopback" || ipv6AllowlistMatches(i.address, allowed) || allowed.includes(i.address));
 }
 /**
 * Rank interfaces and pick the auto-selected outbound one. See the
@@ -595,6 +739,13 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		if (iface.address.startsWith("169.254.")) continue;
 		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
 	}
+	if (!ipv4Only) for (const iface of interfaces) {
+		if (iface.internal || iface.family !== "IPv6") continue;
+		if (iface.kind === "loopback") continue;
+		if (iface.address.toLowerCase().startsWith("fe80:")) continue;
+		if (!iface.plausible) continue;
+		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
+	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
 		baseUrl: `https://${publicHostname}`,
@@ -613,15 +764,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		plausibleReason: "",
 		priority: 150
 	});
-	if (!ipv4Only) {
-		let v6prio = 200;
-		for (const iface of interfaces) {
-			if (iface.internal || iface.family !== "IPv6") continue;
-			if (iface.kind === "loopback") continue;
-			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, v6prio++);
-		}
-	}
 	if (includeLoopback) out.push({
 		label: "Loopback",
 		baseUrl: `${scheme}://127.0.0.1:${port}`,
@@ -639,16 +781,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 *
 *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
 *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
-*     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
-*     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
-*     temporary addresses get included by default; the operator can
-*     prune them from the Network Addresses tab if the rotating IPs
-*     become a nuisance.
+*     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+*     Privacy-extension temporary addresses are skipped when Linux flags
+*     mark them non-permanent (`plausible === false`).
 *
 * Skips docker/vpn/loopback/other entirely — those stay opt-in.
 */
 function autoSeedAllowlist(interfaces) {
-	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family)).map((i) => i.address))];
+	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family) && (i.family !== "IPv6" || i.plausible)).map((i) => i.address))];
 }
 /**
 * Per-interface tooltip text surfaced on the "Unlikely usable" badge.
@@ -737,7 +877,33 @@ function formatKind(kind) {
 		case "other": return "Other";
 	}
 }
+/**
+* Rewrite a persisted allowlist against the live interface set:
+* current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+* extras (docker/vpn). Empty stays empty — that is "unrestricted".
+*/
+function reconcileAllowlist(current, interfaces) {
+	if (current.length === 0) return [];
+	const live = new Set(interfaces.map((i) => i.address));
+	const seed = autoSeedAllowlist(interfaces);
+	const seedSet = new Set(seed);
+	const extras = current.filter((a) => live.has(a) && !seedSet.has(a) && !a.includes(":"));
+	return [...new Set([...seed, ...extras])];
+}
+function sameAddressSet(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((addr) => set.has(addr));
+}
+function readLinuxIpv6Flags() {
+	try {
+		return parseProcIfInet6((0, node_fs.readFileSync)("/proc/net/if_inet6", "utf8"));
+	} catch {
+		return;
+	}
+}
 //#endregion
+exports.ALLOWLIST_RECONCILE_INTERVAL_MS = ALLOWLIST_RECONCILE_INTERVAL_MS;
 exports.LocalNetworkAddon = LocalNetworkAddon;
 exports.applyAllowlist = applyAllowlist;
 exports.autoSeedAllowlist = autoSeedAllowlist;
@@ -745,7 +911,11 @@ exports.buildEndpoints = buildEndpoints;
 exports.classifyKind = classifyKind;
 exports.enumerateOsInterfaces = enumerateOsInterfaces;
 exports.explainNonPlausible = explainNonPlausible;
+exports.ipv6Prefix64Key = ipv6Prefix64Key;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
+exports.parseProcIfInet6 = parseProcIfInet6;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
+exports.reconcileAllowlist = reconcileAllowlist;
 exports.resolveAdvertisedPort = resolveAdvertisedPort;
+exports.shouldAdvertiseIpv6 = shouldAdvertiseIpv6;

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,9 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
-import { a as readLanHttpState, c as readTlsAccessStatus, d as writeTlsMode, f as validateUploadedTls, h as reissueTlsLeaf, l as readTlsMode, n as applyLanHttp, p as ensureTlsCert, s as readExtraSans, t as DEFAULT_LAN_HTTP_PORT, u as writeExtraSans } from "../../lan-http-bind-BDJm4d-K.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
+import { c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, l as readTlsAccessStatus, m as ensureTlsCert, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode } from "../../lan-http-bind-jKrj6OjQ.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
+import { readFileSync } from "node:fs";
 import { isIP } from "node:net";
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
@@ -38,6 +39,111 @@ function parseLocalHostname(raw) {
 	};
 }
 //#endregion
+//#region src/builtins/local-network/ipv6-lan.ts
+/**
+* IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+* rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+* that keeps temporary GUA off the connection candidate list.
+*/
+var IFA_F_TEMPORARY = 1;
+var IFA_F_DEPRECATED = 32;
+var IFA_F_TENTATIVE = 64;
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+function ipv6Prefix64Key(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.slice(0, 4).map((g) => g.toString(16).padStart(4, "0")).join(":");
+}
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+function ipv6ToHex32(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.map((g) => g.toString(16).padStart(4, "0")).join("");
+}
+/**
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
+function parseProcIfInet6(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		const parts = trimmed.split(/\s+/);
+		const hex = parts[0]?.toLowerCase();
+		const flagsRaw = parts[4];
+		if (!hex || hex.length !== 32 || flagsRaw === void 0) continue;
+		const flags = Number.parseInt(flagsRaw, 16);
+		if (!Number.isFinite(flags)) continue;
+		out.set(hex, flags);
+	}
+	return out;
+}
+/**
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
+function shouldAdvertiseIpv6(address, flags) {
+	const a = address.toLowerCase().split("%")[0] ?? address;
+	if (a === "::" || a === "::1") return false;
+	if (a.startsWith("fe80:")) return false;
+	if (a.startsWith("ff")) return false;
+	if (flags === void 0) return true;
+	if ((flags & IFA_F_TEMPORARY) !== 0) return false;
+	if ((flags & IFA_F_DEPRECATED) !== 0) return false;
+	if ((flags & IFA_F_TENTATIVE) !== 0) return false;
+	if (flags === 0) return false;
+	return true;
+}
+function ipv6AllowlistMatches(address, allowed) {
+	if (allowed.includes(address)) return true;
+	const key = ipv6Prefix64Key(address);
+	if (key === null) return false;
+	for (const entry of allowed) {
+		if (!entry.includes(":")) continue;
+		if (ipv6Prefix64Key(entry) === key) return true;
+	}
+	return false;
+}
+function parseIpv6Groups(address) {
+	const raw = address.toLowerCase().split("%")[0];
+	if (!raw || raw.includes(".")) return null;
+	const sides = raw.split("::");
+	if (sides.length > 2) return null;
+	const parsePart = (part) => {
+		if (part === void 0 || part === "") return [];
+		const groups = part.split(":");
+		const out = [];
+		for (const g of groups) {
+			if (g === "") return null;
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			out.push(Number.parseInt(g, 16));
+		}
+		return out;
+	};
+	if (sides.length === 1) {
+		const groups = parsePart(sides[0]);
+		if (groups === null || groups.length !== 8) return null;
+		return groups;
+	}
+	const left = parsePart(sides[0]);
+	const right = parsePart(sides[1]);
+	if (left === null || right === null) return null;
+	const fill = 8 - left.length - right.length;
+	if (fill < 0) return null;
+	return [
+		...left,
+		...Array(fill).fill(0),
+		...right
+	];
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -63,6 +169,8 @@ function parseLocalHostname(raw) {
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+var ALLOWLIST_RECONCILE_INTERVAL_MS = 3600 * 1e3;
 /**
 * Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
 * `server/backend/src/boot/boot-config.ts`. Used only when neither the live
@@ -71,6 +179,8 @@ var POLL_INTERVAL_MS = 3e4;
 var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends BaseAddon {
 	pollTimer = null;
+	allowlistTimer = null;
+	allowlistReconcilePending = false;
 	lastSnapshotKey = "";
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
@@ -116,6 +226,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			});
 			this.ctx.logger.info("local-network: first-boot auto-seed", { meta: { addresses: seed } });
 		}
+		await this.persistReconciledAllowlist();
 		const provider = {
 			list: async () => ({
 				interfaces: this.enumerate(),
@@ -210,6 +321,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
 		this.pollTimer = setInterval(() => this.detectChanges(), POLL_INTERVAL_MS);
 		this.pollTimer.unref?.();
+		this.allowlistTimer = setInterval(() => {
+			this.persistReconciledAllowlist();
+		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
+		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStarted }, (event) => {
 			const data = event.data ?? {};
 			if (typeof data.url === "string") try {
@@ -285,6 +400,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
 		}
+		if (this.allowlistTimer) {
+			clearInterval(this.allowlistTimer);
+			this.allowlistTimer = null;
+		}
 	}
 	/**
 	* Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -418,7 +537,26 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(os.networkInterfaces());
+		return enumerateOsInterfaces(os.networkInterfaces(), readLinuxIpv6Flags());
+	}
+	/**
+	* Replace rotated IPv6 and drop addresses that no longer exist, without
+	* clearing operator extras that are still live (docker/vpn opt-in).
+	*/
+	async persistReconciledAllowlist(interfaces = this.enumerate()) {
+		if (this.allowlistReconcilePending) return;
+		this.allowlistReconcilePending = true;
+		try {
+			const next = reconcileAllowlist(this.config.allowedAddresses, interfaces);
+			if (sameAddressSet(this.config.allowedAddresses, next)) return;
+			await this.updateGlobalSettings({
+				allowedAddresses: next,
+				bootSeeded: true
+			});
+			this.ctx.logger.info("local-network: allowlist reconciled", { meta: { addresses: next } });
+		} finally {
+			this.allowlistReconcilePending = false;
+		}
 	}
 	detectChanges() {
 		const interfaces = this.enumerate();
@@ -429,6 +567,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			key
 		} });
 		this.lastSnapshotKey = key;
+		this.persistReconciledAllowlist(interfaces);
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -477,7 +616,7 @@ function validPort(value) {
 	if (value === null) return null;
 	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
 }
-function enumerateOsInterfaces(ifaces) {
+function enumerateOsInterfaces(ifaces, ipv6Flags) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
 		if (!addrs) continue;
@@ -497,8 +636,12 @@ function enumerateOsInterfaces(ifaces) {
 	const classified = raw.map((r) => {
 		const kind = classifyKind(r.name, r.address, r.internal);
 		const reachableKind = kind === "lan" || kind === "wifi";
-		const plausible = !r.internal && reachableKind && isPlausibleAutoSeed(r.address, r.family);
-		const plausibleReason = plausible ? "" : explainNonPlausible({
+		const hex = r.family === "IPv6" ? ipv6ToHex32(r.address) : null;
+		const flags = hex !== null ? ipv6Flags?.get(hex) : void 0;
+		const rangeOk = isPlausibleAutoSeed(r.address, r.family);
+		const stableV6 = r.family !== "IPv6" || shouldAdvertiseIpv6(r.address, flags);
+		const plausible = !r.internal && reachableKind && rangeOk && stableV6;
+		const plausibleReason = plausible ? "" : r.family === "IPv6" && rangeOk && !stableV6 ? "IPv6 temporary / privacy address — rotates and is not advertised." : explainNonPlausible({
 			kind,
 			family: r.family,
 			address: r.address,
@@ -527,13 +670,14 @@ function enumerateOsInterfaces(ifaces) {
 /**
 * Filter the interface list by the operator's allowlist. Empty
 * allowlist = no-op (every interface passes); otherwise only entries
-* whose `address` matches an allowlist entry remain. Loopback always
-* survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+* whose `address` matches an allowlist entry remain. IPv6 matches the
+* allowlisted /64 so a rotated privacy address does not hide the live
+* GUA. Loopback always survives so the SDK keeps `127.0.0.1` as the
+* last-resort fallback.
 */
 function applyAllowlist(interfaces, allowed) {
 	if (allowed.length === 0) return interfaces;
-	const set = new Set(allowed);
-	return interfaces.filter((i) => i.kind === "loopback" || set.has(i.address));
+	return interfaces.filter((i) => i.kind === "loopback" || ipv6AllowlistMatches(i.address, allowed) || allowed.includes(i.address));
 }
 /**
 * Rank interfaces and pick the auto-selected outbound one. See the
@@ -592,6 +736,13 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		if (iface.address.startsWith("169.254.")) continue;
 		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
 	}
+	if (!ipv4Only) for (const iface of interfaces) {
+		if (iface.internal || iface.family !== "IPv6") continue;
+		if (iface.kind === "loopback") continue;
+		if (iface.address.toLowerCase().startsWith("fe80:")) continue;
+		if (!iface.plausible) continue;
+		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
+	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
 		baseUrl: `https://${publicHostname}`,
@@ -610,15 +761,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		plausibleReason: "",
 		priority: 150
 	});
-	if (!ipv4Only) {
-		let v6prio = 200;
-		for (const iface of interfaces) {
-			if (iface.internal || iface.family !== "IPv6") continue;
-			if (iface.kind === "loopback") continue;
-			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, v6prio++);
-		}
-	}
 	if (includeLoopback) out.push({
 		label: "Loopback",
 		baseUrl: `${scheme}://127.0.0.1:${port}`,
@@ -636,16 +778,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 *
 *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
 *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
-*     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
-*     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
-*     temporary addresses get included by default; the operator can
-*     prune them from the Network Addresses tab if the rotating IPs
-*     become a nuisance.
+*     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+*     Privacy-extension temporary addresses are skipped when Linux flags
+*     mark them non-permanent (`plausible === false`).
 *
 * Skips docker/vpn/loopback/other entirely — those stay opt-in.
 */
 function autoSeedAllowlist(interfaces) {
-	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family)).map((i) => i.address))];
+	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family) && (i.family !== "IPv6" || i.plausible)).map((i) => i.address))];
 }
 /**
 * Per-interface tooltip text surfaced on the "Unlikely usable" badge.
@@ -734,5 +874,30 @@ function formatKind(kind) {
 		case "other": return "Other";
 	}
 }
+/**
+* Rewrite a persisted allowlist against the live interface set:
+* current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+* extras (docker/vpn). Empty stays empty — that is "unrestricted".
+*/
+function reconcileAllowlist(current, interfaces) {
+	if (current.length === 0) return [];
+	const live = new Set(interfaces.map((i) => i.address));
+	const seed = autoSeedAllowlist(interfaces);
+	const seedSet = new Set(seed);
+	const extras = current.filter((a) => live.has(a) && !seedSet.has(a) && !a.includes(":"));
+	return [...new Set([...seed, ...extras])];
+}
+function sameAddressSet(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((addr) => set.has(addr));
+}
+function readLinuxIpv6Flags() {
+	try {
+		return parseProcIfInet6(readFileSync("/proc/net/if_inet6", "utf8"));
+	} catch {
+		return;
+	}
+}
 //#endregion
-export { LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, isPlausibleAutoSeed, pickPreferred, prefixLen, resolveAdvertisedPort };
+export { ALLOWLIST_RECONCILE_INTERVAL_MS, LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, ipv6Prefix64Key, isPlausibleAutoSeed, parseProcIfInet6, pickPreferred, prefixLen, reconcileAllowlist, resolveAdvertisedPort, shouldAdvertiseIpv6 };