From 53296d485c14fc86e2e2293180e31b7a3b0871be Mon Sep 17 00:00:00 2001
From: Firefly0619sec <firefly0619sec@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:48:17 +0800
Subject: [PATCH] fix(web): bind to localhost by default

---
 src-tauri/src/web_main.rs   | 14 +++++++-------
 src-tauri/src/web_server.rs | 14 ++++++++------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/src-tauri/src/web_main.rs b/src-tauri/src/web_main.rs
index 0690eeba4..12826cdb6 100644
--- a/src-tauri/src/web_main.rs
+++ b/src-tauri/src/web_main.rs
@@ -14,8 +14,8 @@ struct Args {
     #[arg(short, long, default_value = "8080")]
     port: u16,
 
-    /// Host to bind to (0.0.0.0 for all interfaces)
-    #[arg(short = 'H', long, default_value = "0.0.0.0")]
+    /// Host to bind to (defaults to localhost; pass 0.0.0.0 to expose on the network)
+    #[arg(short = 'H', long, default_value = "127.0.0.1")]
     host: String,
 }
 
@@ -26,12 +26,12 @@ async fn main() {
     let args = Args::parse();
 
     println!("🚀 Starting Opcode Web Server...");
-    println!(
-        "📱 Will be accessible from phones at: http://{}:{}",
-        args.host, args.port
-    );
+    println!("🌐 Listening on http://{}:{}", args.host, args.port);
+    if args.host == "0.0.0.0" {
+        println!("⚠️  Bound to all interfaces without authentication - only do this on a trusted network.");
+    }
 
-    if let Err(e) = web_server::start_web_mode(Some(args.port)).await {
+    if let Err(e) = web_server::start_web_mode(Some(args.port), &args.host).await {
         eprintln!("❌ Failed to start web server: {}", e);
         std::process::exit(1);
     }
diff --git a/src-tauri/src/web_server.rs b/src-tauri/src/web_server.rs
index 01a28436f..ad851a7fd 100644
--- a/src-tauri/src/web_server.rs
+++ b/src-tauri/src/web_server.rs
@@ -767,7 +767,7 @@ async fn send_to_session(state: &AppState, session_id: &str, message: String) {
 }
 
 /// Create the web server
-pub async fn create_web_server(port: u16) -> Result<(), Box<dyn std::error::Error>> {
+pub async fn create_web_server(port: u16, host: &str) -> Result<(), Box<dyn std::error::Error>> {
     let state = AppState {
         active_sessions: Arc::new(Mutex::new(std::collections::HashMap::new())),
     };
@@ -828,9 +828,11 @@ pub async fn create_web_server(port: u16) -> Result<(), Box<dyn std::error::Erro
         .layer(cors)
         .with_state(state);
 
-    let addr = SocketAddr::from(([0, 0, 0, 0], port));
-    println!("🌐 Web server running on http://0.0.0.0:{}", port);
-    println!("📱 Access from phone: http://YOUR_PC_IP:{}", port);
+    let addr: SocketAddr = format!("{}:{}", host, port).parse()?;
+    println!("🌐 Web server running on http://{}:{}", host, port);
+    if host == "0.0.0.0" {
+        println!("📱 Accessible from other devices on your network (no authentication!)");
+    }
 
     let listener = TcpListener::bind(addr).await?;
     axum::serve(listener, app).await?;
@@ -839,9 +841,9 @@ pub async fn create_web_server(port: u16) -> Result<(), Box<dyn std::error::Erro
 }
 
 /// Start web server mode (alternative to Tauri GUI)
-pub async fn start_web_mode(port: Option<u16>) -> Result<(), Box<dyn std::error::Error>> {
+pub async fn start_web_mode(port: Option<u16>, host: &str) -> Result<(), Box<dyn std::error::Error>> {
     let port = port.unwrap_or(8080);
 
     println!("🚀 Starting Opcode in web server mode...");
-    create_web_server(port).await
+    create_web_server(port, host).await
 }