loop-task 2.1.13 → 2.1.14

package/README.md

@@ -145,6 +145,7 @@ Colors can be a name (`white`, `cyan`, `green`, `yellow`, `orange`, `pink`) or a
 | `loop-task export [file]` | Export all configs to JSON file (or stdout) |
 | `loop-task import <file>` | Import configs from file (triggers hot-reload) |
 | `loop-task api` | Show HTTP API endpoints (base URL, Swagger UI, OpenAPI spec) |
+| `loop-task http-host [address]` | Show or set the HTTP API bind host (default `0.0.0.0`; `local` to lock to loopback) |
 | `loop-task project list` | List all projects |
 | `loop-task project new <name> [--color <color>]` | Create a project |
 | `loop-task project rename <id\|name> <new-name>` | Rename a project |
@@ -215,7 +216,7 @@ Destructive actions (pause, force run, delete) prompt a confirmation before exec
 
 ### Copy & paste in the command bar
 
-The bottom command bar is a normal terminal input, so use your terminal's own clipboard gestures — they work in every terminal (including the VS Code integrated terminal, where Ctrl+C/V are captured by the editor):
+The bottom command bar is a normal terminal input, so use your terminal's own clipboard gestures, they work in every terminal (including the VS Code integrated terminal, where Ctrl+C/V are captured by the editor):
 
 - **Paste** with **Ctrl+Shift+V** (Windows/Linux), **Cmd+V** (macOS), or **right-click**. Multi-line pastes collapse to a single line.
 - **Ctrl+U** clears the command bar (select-all + delete).
@@ -395,7 +396,7 @@ docker run -v ~/.loop-cli:/root/.loop-cli loop-task new 30m -- npm test
 
 ## HTTP API
 
-The daemon exposes a REST + SSE API on `localhost:8845` (configurable via `LOOP_CLI_HTTP_PORT`). It starts automatically with the daemon — no extra flags needed.
+The daemon exposes a REST + SSE API on `localhost:8845` (configurable via `LOOP_CLI_HTTP_PORT`). It starts automatically with the daemon, no extra flags needed.
 
 ### Quick reference
 
@@ -439,8 +440,8 @@ curl http://127.0.0.1:8845/api/projects
 
 ### From the CLI/TUI
 
-- `loop-task api` — prints all API endpoints to stdout
-- Board: press **Ctrl+G** or type `api` — shows a toast with API info
+- `loop-task api`, prints all API endpoints to stdout
+- Board: press **Ctrl+G** or type `api`, shows a toast with API info
 
 ### Response format
 
@@ -451,7 +452,24 @@ All responses use a consistent JSON envelope:
 {"ok": false, "error": {"message": "..."}}  // error (400/404/405/500)
 ```
 
-The API binds to `127.0.0.1` only — it is not reachable from the network. If the port is already in use, the daemon skips the HTTP server and continues with IPC only.
+If the port is already in use, the daemon skips the HTTP server and continues with IPC only.
+
+### Network access (remote / VMs)
+
+The HTTP API (8845) and MCP server (8846) bind to **`0.0.0.0` (all interfaces) by default**, so a daemon on a VM or homelab box is reachable f,  other machines out of the box — connect over SSH, [Tailscale](https://tailscale.com), or your LAN. `loop-task http-host` governs the bind for both.
+
+> **The HTTP API is unauthenticated.** Anything that can reach the bound port can create and trigger loops, i.e. run commands on the host. Because the default is `0.0.0.0`, **securing access is your responsibility at the network layer**: run the box behind a VPN (Tailscale), reach it only via an SSH tunnel, and/or block the port at the cloud firewall so it isn't exposed to the public internet.
+
+Change the bind host at any time (persisted in daemon settings, not an env var, and the daemon **rebinds live**, no restart):
+
+```bash
+loop-task http-host                 # show the current bind host + reachable URL
+loop-task http-host local           # 127.0.0.1, loopback only (lock it down)
+loop-task http-host 100.99.155.102  # bind a single interface (e.g. a Tailscale IP)
+loop-task http-host all             # 0.0.0.0, all interfaces (the default)
+```
+
+**Locking it down:** if the box isn't behind a firewall/VPN you trust, either set `loop-task http-host local` and reach it through an SSH tunnel (`ssh -L 8845:127.0.0.1:8845 <host>`), or expose it tailnet-only with `tailscale serve --bg 8845` (HTTPS at `https://<node>.<tailnet>.ts.net`, restrict further with Tailscale ACLs; never `tailscale funnel`).
 
 ## Development
 
@@ -481,11 +499,11 @@ pnpm run build       # tsc -p tsconfig.build.json
 
 ### Testing the board in a browser (ttyd)
 
-> **Agents: Do NOT use ttyd unless the user explicitly asks you to check the CLI in a browser.** It is never the default. Do not start a ttyd server on your own for "manual pass" tasks or visual QA — those are for the human. Reach for ttyd only when the user says "check the board in the browser", "use ttyd", or similar.
+> **Agents: Do NOT use ttyd unless the user explicitly asks you to check the CLI in a browser.** It is never the default. Do not start a ttyd server on your own for "manual pass" tasks or visual QA, those are for the human. Reach for ttyd only when the user says "check the board in the browser", "use ttyd", or similar.
 
-The board is an interactive TUI, so it needs a real terminal — you can't drive it from a piped/captured shell (and neither can an AI agent). [`ttyd`](https://github.com/tsl0922/ttyd) shares a terminal over HTTP, which makes the board reachable from a browser and scriptable by browser-automation agents — but only when explicitly requested.
+The board is an interactive TUI, so it needs a real terminal, you can't drive it from a piped/captured shell (and neither can an AI agent). [`ttyd`](https://github.com/tsl0922/ttyd) shares a terminal over HTTP, which makes the board reachable from a browser and scriptable by browser-automation agents, but only when explicitly requested.
 
-Install ttyd (see the [ttyd README](https://github.com/tsl0922/ttyd#installation) — e.g. `winget install tsl0922.ttyd`, `brew install ttyd`, or `apt install ttyd`), then serve the board from an interactive terminal:
+Install ttyd (see the [ttyd README](https://github.com/tsl0922/ttyd#installation), e.g. `winget install tsl0922.ttyd`, `brew install ttyd`, or `apt install ttyd`), then serve the board from an interactive terminal:
 
 ```bash
 # Point -w at the repo (absolute path) and run the dev board:
@@ -497,7 +515,7 @@ ttyd -W -w "C:\Projects\Personal\loop-cli" -p 7681 node dist/entry.js
 
 Open `http://localhost:7681` in a browser and use the board as normal. `-W` makes it writable so keystrokes reach the TUI. Handy for demos, for testing on a machine without a good local terminal, and for letting an AI agent drive the board (navigate, send keys, screenshot; ttyd renders via xterm.js on a `<canvas>`, so read state from screenshots, not page text).
 
-> **Windows note:** always pass `-w "<absolute repo path>"`. Without it, ttyd gives the spawned command no valid working directory and it fails with `CreateProcessW failed with error 267` — for *every* command (`pnpm`, `npx`, `node` all fail the same way; it is not a `.cmd`-shim issue). On macOS/Linux `-w` is optional but harmless. Start ttyd from a real interactive terminal; a detached/console-less launch can crash its ConPTY on Windows.
+> **Windows note:** always pass `-w "<absolute repo path>"`. Without it, ttyd gives the spawned command no valid working directory and it fails with `CreateProcessW failed with error 267`, for *every* command (`pnpm`, `npx`, `node` all fail the same way; it is not a `.cmd`-shim issue). On macOS/Linux `-w` is optional but harmless. Start ttyd from a real interactive terminal; a detached/console-less launch can crash its ConPTY on Windows.
 
 ## License
 

package/dist/cli.js

@@ -336,6 +336,51 @@ program
     console.log(`  OpenAPI:    ${baseUrl}/api/openapi.json`);
     console.log(`  Events:     ${baseUrl}/api/events (SSE)`);
 });
+program
+    .command("http-host")
+    .description("Show or set the network interface the HTTP API + MCP server bind to (default 0.0.0.0)")
+    .argument("[address]", "IP to bind — or 'local' (127.0.0.1) / 'all' (0.0.0.0)")
+    .action(async (address) => {
+    const { ensureDaemon } = await import("./daemon/spawner/index.js");
+    const { sendRequest } = await import("./client/ipc.js");
+    const port = process.env.LOOP_CLI_HTTP_PORT ?? String(HTTP_API_PORT);
+    try {
+        ensureDaemon();
+        if (!address) {
+            const res = await sendRequest({ type: "settings-get" });
+            const host = res.type === "ok" ? res.data.httpApiHost : HTTP_API_HOST;
+            const shown = host === "0.0.0.0" ? "<this-machine-ip>" : host;
+            const mcpPort = process.env.LOOP_CLI_MCP_PORT ?? "8846";
+            console.log(`API bind host: ${host}`);
+            console.log(`  HTTP API: http://${shown}:${port}`);
+            console.log(`  MCP SSE:  http://${shown}:${mcpPort}/sse`);
+            return;
+        }
+        const normalized = address === "local" || address === "localhost"
+            ? "127.0.0.1"
+            : address === "all" || address === "any"
+                ? "0.0.0.0"
+                : address;
+        const res = await sendRequest({ type: "settings-set", settings: { httpApiHost: normalized } });
+        if (res.type !== "ok") {
+            console.error(res.type === "error" ? res.message : "Failed to update setting");
+            process.exit(1);
+        }
+        console.log(`HTTP API + MCP server now binding to ${normalized}`);
+        if (normalized !== "127.0.0.1") {
+            console.log("");
+            console.log("Note: the API is unauthenticated — anything that can reach this");
+            console.log("interface can create and trigger loops. Secure access at the network");
+            console.log("layer (SSH/Tailscale/firewall). Use `loop-task http-host local` for");
+            console.log("loopback-only.");
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(t("cli.error", { message }));
+        process.exit(1);
+    }
+});
 program
     .command("mcp")
     .description("Show MCP server info and how to connect an MCP client")

package/dist/daemon/http/openapi.js

@@ -5,7 +5,7 @@ export function buildOpenApiSpec() {
         info: {
             title: "loop-task HTTP API",
             version: "1.0.0",
-            description: "REST + SSE API for managing loops, tasks, projects, and logs. All endpoints are localhost-only (127.0.0.1).",
+            description: "REST + SSE API for managing loops, tasks, projects, and logs. Binds to all interfaces (0.0.0.0) by default so it is reachable remotely; the bind host is configurable via `loop-task http-host`. The API is unauthenticated, secure access at the network layer (SSH/Tailscale/firewall), or restrict the bind to 127.0.0.1.",
         },
         servers: [
             { url: `http://${HTTP_API_HOST}:${HTTP_API_PORT}`, description: "Local daemon" },

package/dist/daemon/index.js

@@ -32,14 +32,16 @@ async function main() {
     }
     const httpPort = parseInt(process.env.LOOP_CLI_HTTP_PORT ?? "", 10);
     const resolvedHttpPort = Number.isNaN(httpPort) ? undefined : httpPort;
+    let currentHttpHost = settingsManager.get().httpApiHost;
     if (settingsManager.get().httpApiEnabled) {
         try {
-            await httpServer.listen(resolvedHttpPort);
+            await httpServer.listen(resolvedHttpPort, currentHttpHost);
         }
         catch (err) {
             daemonLog(`HTTP API server failed to start: ${String(err)}`);
         }
     }
+    mcpServer.setHost(currentHttpHost);
     if (mcpEnabled) {
         try {
             await mcpServer.start();
@@ -49,26 +51,45 @@ async function main() {
         }
     }
     settingsManager.onChange((settings) => {
+        const newHost = settings.httpApiHost;
+        const hostChanged = newHost !== currentHttpHost;
+        // HTTP API (8845)
         if (settings.httpApiEnabled && !httpServer["isListening"]) {
-            httpServer.listen(resolvedHttpPort).catch((err) => {
+            httpServer.listen(resolvedHttpPort, newHost).catch((err) => {
                 daemonLog(`HTTP API server failed to restart: ${String(err)}`);
             });
         }
+        else if (settings.httpApiEnabled && httpServer["isListening"] && hostChanged) {
+            httpServer.restart(resolvedHttpPort, newHost).catch((err) => {
+                daemonLog(`HTTP API server failed to rebind to ${newHost}: ${String(err)}`);
+            });
+        }
         else if (!settings.httpApiEnabled && httpServer["isListening"]) {
             httpServer.close().catch((err) => {
                 daemonLog(`HTTP API server failed to stop: ${String(err)}`);
             });
         }
+        // MCP SSE (8846) — shares the same bind host as the HTTP API.
+        mcpServer.setHost(newHost);
         if (settings.mcpApiEnabled && !mcpServer.isListening) {
             mcpServer.start().catch((err) => {
                 daemonLog(`MCP server failed to restart: ${String(err)}`);
             });
         }
+        else if (settings.mcpApiEnabled && mcpServer.isListening && hostChanged) {
+            mcpServer
+                .close()
+                .then(() => mcpServer.start())
+                .catch((err) => {
+                daemonLog(`MCP server failed to rebind to ${newHost}: ${String(err)}`);
+            });
+        }
         else if (!settings.mcpApiEnabled && mcpServer.isListening) {
             mcpServer.close().catch((err) => {
                 daemonLog(`MCP server failed to stop: ${String(err)}`);
             });
         }
+        currentHttpHost = newHost;
     });
     manager.init();
     writeDaemonPid(process.pid);

package/dist/daemon/mcp/server.js

@@ -14,8 +14,13 @@ export class McpApiServer {
         this.activeTransport = null;
         this.httpServer = null;
         this._isListening = false;
+        this.host = "127.0.0.1";
         this.transportType = transport ?? "sse";
     }
+    /** Set the bind host for the SSE transport (takes effect on next start). */
+    setHost(host) {
+        this.host = host;
+    }
     createServer() {
         const server = new McpServer({ name: "loop-task", version: "1.0.0" }, { capabilities: { tools: {} } });
         registerMcpTools(server, { manager: this.manager, taskManager: this.taskManager, projectManager: this.projectManager });
@@ -136,8 +141,8 @@ export class McpApiServer {
                 }
                 resolve();
             });
-            this.httpServer.listen(port, "127.0.0.1", () => {
-                daemonLog(`MCP SSE server listening on 127.0.0.1:${port}`);
+            this.httpServer.listen(port, this.host, () => {
+                daemonLog(`MCP SSE server listening on ${this.host}:${port}`);
                 this._isListening = true;
                 resolve();
             });

package/dist/daemon/settings-manager.js

@@ -1,7 +1,15 @@
 import fs from "node:fs";
 import { settingsJson } from "../shared/config/paths.js";
 import { daemonLog } from "./daemon-log.js";
-const DEFAULTS = { httpApiEnabled: true, mcpApiEnabled: true };
+const DEFAULTS = {
+    httpApiEnabled: true,
+    mcpApiEnabled: true,
+    // Binds to all interfaces by default: the daemon is meant to be reachable
+    // (e.g. over SSH/Tailscale/LAN). The API is unauthenticated, so securing
+    // access is the operator's job at the network layer; restrict the bind with
+    // `loop-task http-host <ip|local>` when you want loopback-only.
+    httpApiHost: "0.0.0.0",
+};
 export class SettingsManager {
     constructor() {
         this.settings = { ...DEFAULTS };

package/dist/features/commands/commands.js

@@ -10,7 +10,6 @@ function globalCommands() {
         { label: t('cmd.toggleMcp'), value: 'toggle-mcp', hint: '', tier: COMMAND_TIER_GLOBAL, category: COMMAND_CATEGORY_GLOBAL },
         { label: t('cmd.export'), value: 'export', hint: '', tier: COMMAND_TIER_GLOBAL, category: COMMAND_CATEGORY_GLOBAL, shortcut: 'ctrl+x' },
         { label: t('cmd.import'), value: 'import', hint: '', tier: COMMAND_TIER_GLOBAL, category: COMMAND_CATEGORY_GLOBAL, shortcut: 'ctrl+i' },
-        { label: t('cmd.status'), value: 'status', hint: '', tier: COMMAND_TIER_GLOBAL, category: COMMAND_CATEGORY_GLOBAL, shortcut: 'ctrl+y' },
     ];
 }
 function loopFilterCommands() {

package/dist/features/commands/useCommandHandlers.js

@@ -160,7 +160,6 @@ export function useCommandHandlers(context) {
                 pushToast("error", t("board.toastMcpToggleError", { message: e.message }));
             }
         },
-        status: () => { pushToast("info", `Command "status" coming soon`); },
         export: () => {
             exportService.exportConfig()
                 .then(({ json, filePath }) => setExportModal({ json, filePath, error: null }))

package/dist/features/commands/useGlobalShortcuts.js

@@ -48,7 +48,6 @@ export function useGlobalShortcuts(context) {
                 b: () => handleCommand("debug"),
                 x: () => handleCommand("export"),
                 i: () => handleCommand("import"),
-                y: () => handleCommand("status"),
             };
             const filterShortcuts = {
                 s: () => handleCommand("search"),

package/dist/shared/i18n/en.json

@@ -297,7 +297,7 @@
     "codeEditor.fieldHint": "press enter to open editor",
     "codeEditor.copied": "Copied!",
     "codeEditor.cleared": "Cleared",
-    "codeEditor.clipboardEmpty": "Clipboard empty — right-click to paste",
+    "codeEditor.clipboardEmpty": "Clipboard empty, right-click to paste",
     "codeEditor.commandsTitle": "Parallel Commands",
     "codeEditor.commandsHint": "tab: next . shift+tab: prev . ctrl+s: save all . esc: cancel",
     "codeEditor.commandLabel": "Command",
@@ -531,7 +531,6 @@
     "board.toastMcpEnabled": "MCP server enabled",
     "board.toastMcpDisabled": "MCP server disabled",
     "board.toastMcpToggleError": "Failed to toggle MCP: {message}",
-    "cmd.status": "Daemon status info (Soon...)",
     "cmd.filterStatus": "Filter by status",
     "cmd.sort": "Order sort by field",
     "cmd.project": "Filter by project",
@@ -550,7 +549,7 @@
     "export.modalTitle": "Export Loops JSON",
     "export.filePath": "Saved to: {path}",
     "export.error": "Export failed: {message}",
-    "export.truncated": "[truncated — {total} lines]",
+    "export.truncated": "[truncated, {total} lines]",
     "export.hint": "up/down:scroll  c:copy  esc:close",
     "cmd.quit": "Exit loop-task",
     "cmd.save": "Save changes",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loop-task",
-  "version": "2.1.13",
+  "version": "2.1.14",
   "description": "Loop engineering toolkit. Run any command on a cadence, in the background, managed from a terminal board. Schedule tests, builds, syncs, or agent prompts.",
   "type": "module",
   "bin": {