IPv6 loopback binds can return an invalid server URL

[youhaowei]

Problem

Clawpatch flagged a low-priority API contract bug in server URL reporting for IPv6 loopback binds.

When the server is bound to an IPv6 loopback host, the returned URL can be formatted without the required bracketed IPv6 host syntax, producing an invalid URL for clients.

Evidence

Clawpatch run: 20260629T235052-baec0e

Finding: fnd_sig-feat-library-65745d6fa8-81f7_80e1c0882c

Relevant paths:

• apps/server/src/index.ts around applyBind
• apps/server/src/app.ts around isLoopbackHost
• apps/server/src/app.ts around createDashframeServer
• apps/server/src/app.test.ts existing bind behavior coverage

Expected fix

Normalize host formatting when constructing returned server URLs. IPv6 hosts should be bracketed, e.g. http://[::1]:PORT, while existing IPv4 and hostname behavior should remain unchanged.

Scope

Follow-up from PR #197 review. This is not introduced by the assistant read-layer changes.

[coderabbitai]

🔗 Related PRs

#47 - [codex] Loopback auth for desktop WyStack server [merged]
#110 - feat(server): secure-by-default bind-auth gate — refuse unauthenticated non-loopback bind [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!