Fix dropped stderr, bind exec server to localhost, repair typecheck

[PIsberg]

Summary

Three fixes found while analyzing the project. All 38 tests pass and the project now type-checks with zero tsc errors.

Bugs fixed

• Dropped stderr on the exec endpoint — POST/GET /<cmd> returned only proc.stdout, so commands that write to stderr (errors, usage text, tools like curl) produced a blank response in the UI. stdout+stderr are now merged into a single streaming ReadableStream, preserving streaming while surfacing errors.
• Exec server bound to all interfaces — Bun.serve defaults to 0.0.0.0. Since this server executes arbitrary CLI commands with Access-Control-Allow-Origin: *, that exposed remote command execution to the LAN. Now binds to 127.0.0.1 by default (HOST env var to override).
• tsconfig.json missing ambient types — added "types": ["bun"] so Bun/process/import.meta.main globals resolve; the project now compiles cleanly (was 12+ errors).

Other

• Reconciled bun.lock with package.json's typescript ~6.0.3 (lockfile was stale at 5.8.2).
• Added an integration test asserting the exec endpoint surfaces stderr output (locks in fix Perf improvements #1; runs in the existing bun test CI workflow).

Test plan

• bun test — 38 pass
• bunx tsc --noEmit — 0 errors
• Manual smoke: invalid flag now returns the diagnostic (previously empty); ?version=true returns the version; unknown route returns 404; server bound to 127.0.0.1.

🤖 Generated with Claude Code