@neuralnomads/codenomad-dev 0.20.0-dev-20260909-855d2ee7 → 0.20.0-dev-20260911-ea37f97b

package/dist/server/__tests__/network-host.test.js

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "../network-host";
+describe("network host helpers", () => {
+    it("recognizes IPv4 and IPv6 wildcard forms", () => {
+        assert.equal(isWildcardHost("0.0.0.0"), true);
+        assert.equal(isWildcardHost("::"), true);
+        assert.equal(isWildcardHost("0:0:0:0:0:0:0:0"), true);
+        assert.equal(isWildcardHost("::ffff:0:0"), true);
+        assert.equal(isWildcardHost("::1"), false);
+    });
+    it("recognizes concrete IPv4 and IPv6 loopback forms", () => {
+        assert.equal(isLoopbackHost("localhost"), true);
+        assert.equal(isLoopbackHost("127.0.0.2"), true);
+        assert.equal(isLoopbackHost("::1"), true);
+        assert.equal(isLoopbackHost("::0001"), true);
+        assert.equal(isLoopbackHost("0:0:0:0:0:0:0:1"), true);
+        assert.equal(isLoopbackHost("0:0:0:0:0:0:0:0001"), true);
+        assert.equal(isLoopbackHost("::ffff:7f00:1"), true);
+        assert.equal(isLoopbackHost("2001:db8::1"), false);
+    });
+    it("brackets IPv6 literals for URLs", () => {
+        assert.equal(formatHostForUrl("192.168.1.20"), "192.168.1.20");
+        assert.equal(formatHostForUrl("::1"), "[::1]");
+        assert.equal(formatHostForUrl("[2001:db8::20]"), "[2001:db8::20]");
+    });
+    it("normalizes IPv4-mapped addresses and internationalized DNS names", () => {
+        assert.equal(normalizeNetworkHost("::ffff:0:0"), "0.0.0.0");
+        assert.equal(normalizeNetworkHost("::ffff:7f00:1"), "127.0.0.1");
+        assert.equal(normalizeNetworkHost("::ffff:192.168.1.20"), "192.168.1.20");
+        assert.equal(normalizeNetworkHost("münchen.local"), "xn--mnchen-3ya.local");
+    });
+});
+//# sourceMappingURL=network-host.test.js.map

package/dist/server/__tests__/network-host.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-host.test.js","sourceRoot":"","sources":["../../../src/server/__tests__/network-host.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAExG,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,CAAA;QACzE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import assert from \"node:assert/strict\"\nimport { describe, it } from \"node:test\"\n\nimport { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from \"../network-host\"\n\ndescribe(\"network host helpers\", () => {\n  it(\"recognizes IPv4 and IPv6 wildcard forms\", () => {\n    assert.equal(isWildcardHost(\"0.0.0.0\"), true)\n    assert.equal(isWildcardHost(\"::\"), true)\n    assert.equal(isWildcardHost(\"0:0:0:0:0:0:0:0\"), true)\n    assert.equal(isWildcardHost(\"::ffff:0:0\"), true)\n    assert.equal(isWildcardHost(\"::1\"), false)\n  })\n\n  it(\"recognizes concrete IPv4 and IPv6 loopback forms\", () => {\n    assert.equal(isLoopbackHost(\"localhost\"), true)\n    assert.equal(isLoopbackHost(\"127.0.0.2\"), true)\n    assert.equal(isLoopbackHost(\"::1\"), true)\n    assert.equal(isLoopbackHost(\"::0001\"), true)\n    assert.equal(isLoopbackHost(\"0:0:0:0:0:0:0:1\"), true)\n    assert.equal(isLoopbackHost(\"0:0:0:0:0:0:0:0001\"), true)\n    assert.equal(isLoopbackHost(\"::ffff:7f00:1\"), true)\n    assert.equal(isLoopbackHost(\"2001:db8::1\"), false)\n  })\n\n  it(\"brackets IPv6 literals for URLs\", () => {\n    assert.equal(formatHostForUrl(\"192.168.1.20\"), \"192.168.1.20\")\n    assert.equal(formatHostForUrl(\"::1\"), \"[::1]\")\n    assert.equal(formatHostForUrl(\"[2001:db8::20]\"), \"[2001:db8::20]\")\n  })\n\n  it(\"normalizes IPv4-mapped addresses and internationalized DNS names\", () => {\n    assert.equal(normalizeNetworkHost(\"::ffff:0:0\"), \"0.0.0.0\")\n    assert.equal(normalizeNetworkHost(\"::ffff:7f00:1\"), \"127.0.0.1\")\n    assert.equal(normalizeNetworkHost(\"::ffff:192.168.1.20\"), \"192.168.1.20\")\n    assert.equal(normalizeNetworkHost(\"münchen.local\"), \"xn--mnchen-3ya.local\")\n  })\n})\n"]}

package/dist/server/__tests__/tls-ipv6.test.js

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, it } from "node:test";
+import { resolveHttpsOptions } from "../tls";
+const logger = { info() { }, warn() { }, error() { }, child() { return logger; } };
+describe("generated IPv6 certificates", () => {
+    it("includes a concrete IPv6 address SAN", () => withTempConfig((configDir) => {
+        const resolved = resolveHttpsOptions({ enabled: true, configDir, host: "2001:db8::20", logger });
+        assert.ok(resolved);
+        const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert);
+        assert.match(certificate.subjectAltName ?? "", /IP Address:2001:DB8:0:0:0:0:0:20/i);
+    }));
+    it("includes IPv6 loopback for a fresh wildcard certificate", () => withTempConfig((configDir) => {
+        const resolved = resolveHttpsOptions({ enabled: true, configDir, host: "::", logger });
+        assert.ok(resolved);
+        const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert);
+        assert.equal(certificate.checkIP("::1"), "::1");
+    }));
+    it("rotates a reused certificate when required host and configured SANs change", () => withTempConfig((configDir) => {
+        const initial = resolveHttpsOptions({ enabled: true, configDir, host: "127.0.0.1", logger });
+        assert.ok(initial);
+        const initialCertificate = new crypto.X509Certificate(initial.httpsOptions.cert);
+        const rotated = resolveHttpsOptions({ enabled: true, configDir, host: "::", tlsSANs: "diagnostics.local", logger });
+        assert.ok(rotated);
+        const rotatedCertificate = new crypto.X509Certificate(rotated.httpsOptions.cert);
+        assert.notEqual(rotatedCertificate.fingerprint256, initialCertificate.fingerprint256);
+        assert.equal(rotatedCertificate.checkIP("::1"), "::1");
+        assert.equal(rotatedCertificate.checkHost("diagnostics.local"), "diagnostics.local");
+    }));
+    it("reuses certificates for normalized IDN and scoped IPv6 SAN values", () => withTempConfig((configDir) => {
+        const first = resolveHttpsOptions({ enabled: true, configDir, host: "münchen.local", tlsSANs: "fe80::1%12", logger });
+        assert.ok(first);
+        const firstCertificate = new crypto.X509Certificate(first.httpsOptions.cert);
+        const reused = resolveHttpsOptions({ enabled: true, configDir, host: "münchen.local", tlsSANs: "fe80::1%12", logger });
+        assert.ok(reused);
+        const reusedCertificate = new crypto.X509Certificate(reused.httpsOptions.cert);
+        assert.equal(reusedCertificate.fingerprint256, firstCertificate.fingerprint256);
+        assert.equal(reusedCertificate.checkHost("xn--mnchen-3ya.local"), "xn--mnchen-3ya.local");
+        assert.equal(reusedCertificate.checkIP("fe80::1"), "fe80::1");
+    }));
+});
+function withTempConfig(callback) {
+    const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "codenomad-tls-ipv6-"));
+    try {
+        callback(configDir);
+    }
+    finally {
+        fs.rmSync(configDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=tls-ipv6.test.js.map

package/dist/server/__tests__/tls-ipv6.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-ipv6.test.js","sourceRoot":"","sources":["../../../src/server/__tests__/tls-ipv6.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAGxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAE5C,MAAM,MAAM,GAAG,EAAE,IAAI,KAAI,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE,KAAK,KAAK,OAAO,MAAM,CAAA,CAAC,CAAC,EAAuB,CAAA;AAEnG,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,EAAE;QAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAA;QAChG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;QACnB,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAC1E,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAA;IACrF,CAAC,CAAC,CAAC,CAAA;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACtF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;QACnB,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAC1E,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAC,CAAA;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,EAAE;QAClH,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAA;QACnH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhF,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,cAAc,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAA;QACrF,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAA;IACtF,CAAC,CAAC,CAAC,CAAA;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,EAAE;QACzG,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;QACrH,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;QAChB,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;QACtH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;QACjB,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAE9E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,CAAA;QACzF,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAC,CAAA;AACL,CAAC,CAAC,CAAA;AAEF,SAAS,cAAc,CAAC,QAAqC;IAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,QAAQ,CAAC,SAAS,CAAC,CAAA;IACrB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;AACH,CAAC","sourcesContent":["import assert from \"node:assert/strict\"\nimport crypto from \"node:crypto\"\nimport fs from \"node:fs\"\nimport os from \"node:os\"\nimport path from \"node:path\"\nimport { describe, it } from \"node:test\"\n\nimport type { Logger } from \"../../logger\"\nimport { resolveHttpsOptions } from \"../tls\"\n\nconst logger = { info() {}, warn() {}, error() {}, child() { return logger } } as unknown as Logger\n\ndescribe(\"generated IPv6 certificates\", () => {\n  it(\"includes a concrete IPv6 address SAN\", () => withTempConfig((configDir) => {\n    const resolved = resolveHttpsOptions({ enabled: true, configDir, host: \"2001:db8::20\", logger })\n    assert.ok(resolved)\n    const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert)\n    assert.match(certificate.subjectAltName ?? \"\", /IP Address:2001:DB8:0:0:0:0:0:20/i)\n  }))\n\n  it(\"includes IPv6 loopback for a fresh wildcard certificate\", () => withTempConfig((configDir) => {\n    const resolved = resolveHttpsOptions({ enabled: true, configDir, host: \"::\", logger })\n    assert.ok(resolved)\n    const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert)\n    assert.equal(certificate.checkIP(\"::1\"), \"::1\")\n  }))\n\n  it(\"rotates a reused certificate when required host and configured SANs change\", () => withTempConfig((configDir) => {\n    const initial = resolveHttpsOptions({ enabled: true, configDir, host: \"127.0.0.1\", logger })\n    assert.ok(initial)\n    const initialCertificate = new crypto.X509Certificate(initial.httpsOptions.cert)\n\n    const rotated = resolveHttpsOptions({ enabled: true, configDir, host: \"::\", tlsSANs: \"diagnostics.local\", logger })\n    assert.ok(rotated)\n    const rotatedCertificate = new crypto.X509Certificate(rotated.httpsOptions.cert)\n\n    assert.notEqual(rotatedCertificate.fingerprint256, initialCertificate.fingerprint256)\n    assert.equal(rotatedCertificate.checkIP(\"::1\"), \"::1\")\n    assert.equal(rotatedCertificate.checkHost(\"diagnostics.local\"), \"diagnostics.local\")\n  }))\n\n  it(\"reuses certificates for normalized IDN and scoped IPv6 SAN values\", () => withTempConfig((configDir) => {\n    const first = resolveHttpsOptions({ enabled: true, configDir, host: \"münchen.local\", tlsSANs: \"fe80::1%12\", logger })\n    assert.ok(first)\n    const firstCertificate = new crypto.X509Certificate(first.httpsOptions.cert)\n\n    const reused = resolveHttpsOptions({ enabled: true, configDir, host: \"münchen.local\", tlsSANs: \"fe80::1%12\", logger })\n    assert.ok(reused)\n    const reusedCertificate = new crypto.X509Certificate(reused.httpsOptions.cert)\n\n    assert.equal(reusedCertificate.fingerprint256, firstCertificate.fingerprint256)\n    assert.equal(reusedCertificate.checkHost(\"xn--mnchen-3ya.local\"), \"xn--mnchen-3ya.local\")\n    assert.equal(reusedCertificate.checkIP(\"fe80::1\"), \"fe80::1\")\n  }))\n})\n\nfunction withTempConfig(callback: (configDir: string) => void) {\n  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), \"codenomad-tls-ipv6-\"))\n  try {\n    callback(configDir)\n  } finally {\n    fs.rmSync(configDir, { recursive: true, force: true })\n  }\n}\n"]}

package/dist/server/http-server.js

@@ -3,7 +3,7 @@ import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import replyFrom from "@fastify/reply-from";
 import fs from "fs";
-import { connect as connectTcp } from "net";
+import { connect as connectTcp, isIP } from "net";
 import path from "path";
 import { connect as connectTls } from "tls";
 import { fetch } from "undici";
@@ -16,6 +16,7 @@ import { registerMetaRoutes } from "./routes/meta";
 import { registerEventRoutes } from "./routes/events";
 import { registerStorageRoutes } from "./routes/storage";
 import { registerYoloRoutes } from "./routes/yolo";
+import { registerSessionPruningRoutes } from "./routes/session-pruning";
 import { registerWorktreeRoutes } from "./routes/worktrees";
 import { registerSpeechRoutes } from "./routes/speech";
 import { registerOpenCodeUpdateRoutes } from "./routes/opencode-update";
@@ -31,6 +32,7 @@ import { createOpenCodeUpdateService } from "../opencode-update/service";
 import { WorktreeDeletionFence } from "../workspaces/worktree-session-evacuation";
 import { isAutomationPluginRequest, registerAutomationPluginRoute } from "./routes/automation-plugin";
 import { DeveloperCdp } from "../developer-cdp";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, stripHostBrackets } from "./network-host";
 export function shouldRetryPreferredPort(error, autoPortRequested, platform = process.platform) {
     if (!autoPortRequested)
         return false;
@@ -86,7 +88,6 @@ export function createHttpServer(deps) {
         done();
     });
     const allowedDevOrigins = new Set(["http://localhost:3000", "http://127.0.0.1:3000"]);
-    const isLoopbackHost = (host) => host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
     const getSelfOrigins = () => {
         const origins = new Set();
         const candidates = [deps.serverMeta.localUrl, deps.serverMeta.remoteUrl];
@@ -130,7 +131,7 @@ export function createHttpServer(deps) {
                 return;
             }
             // When we bind to a non-loopback host (e.g., 0.0.0.0 or LAN IP), allow cross-origin UI access.
-            if (deps.bindHost === "0.0.0.0" || !isLoopbackHost(deps.bindHost)) {
+            if (isWildcardHost(deps.bindHost) || !isLoopbackHost(deps.bindHost)) {
                 cb(null, true);
                 return;
             }
@@ -265,6 +266,7 @@ export function createHttpServer(deps) {
         logger: proxyLogger,
     });
     registerYoloRoutes(app, { yoloManager: deps.yoloManager });
+    registerSessionPruningRoutes(app, { workspaceManager: deps.workspaceManager, worktreeDeletionFence });
     registerInstanceProxyRoutes(app, { workspaceManager: deps.workspaceManager, logger: proxyLogger, worktreeDeletionFence });
     if (deps.uiDevServerUrl) {
         setupDevProxy(app, deps.uiDevServerUrl, deps.authManager, deps.previewManager, proxyLogger);
@@ -276,7 +278,8 @@ export function createHttpServer(deps) {
         instance: app,
         start: async () => {
             const attemptListen = async (requestedPort) => {
-                const addressInfo = await app.listen({ port: requestedPort, host: deps.bindHost });
+                const dualStackWildcard = isWildcardHost(deps.bindHost) && isIP(stripHostBrackets(deps.bindHost)) === 6;
+                const addressInfo = await app.listen({ port: requestedPort, host: deps.bindHost, ...(dualStackWildcard ? { ipv6Only: false } : {}) });
                 return { addressInfo, requestedPort };
             };
             const autoPortRequested = deps.bindPort === 0;
@@ -308,7 +311,7 @@ export function createHttpServer(deps) {
                     actualPort = address.port;
                 }
             }
-            const displayHost = deps.bindHost === "127.0.0.1" ? "localhost" : deps.bindHost;
+            const displayHost = deps.bindHost === "127.0.0.1" ? "localhost" : formatHostForUrl(deps.bindHost);
             const serverUrl = `${deps.protocol}://${displayHost}:${actualPort}`;
             deps.logger.info({ port: actualPort, host: deps.bindHost, protocol: deps.protocol }, "HTTP server listening");
             return { port: actualPort, url: serverUrl, displayHost };
@@ -1096,7 +1099,6 @@ function isAllowedInstanceApiRoute(method, pathname) {
         ["GET", /^\/api\/session(?:\/active)?$/],
         ["POST", /^\/api\/session(?:\/import)?$/],
         ["GET", /^\/api\/session\/[^/]+(?:\/message(?:\/[^/]+)?)?$/],
-        ["PATCH", /^\/api\/session\/[^/]+\/message\/[^/]+$/],
         ["GET", /^\/api\/session\/[^/]+\/inbox$/],
         ["GET", /^\/api\/session\/[^/]+\/(?:permission|form)$/],
         ["DELETE", /^\/api\/session\/[^/]+$/],