🔒 fix: bind Crawlith UI Server to 127.0.0.1 by default

plugins/cli/src/commands/ui.ts

@@ -14,9 +14,11 @@ export const ui = new Command('ui')
   .description('Start the Crawlith UI Dashboard')
   .option('--site <url>', 'Site URL to display in dashboard', 'https://example.com')
   .option('--port <number>', 'Port to run server on', '23484')
+  .option('--host <address>', 'Host to bind server to', '127.0.0.1')
   .action(async (options) => {
     try {
       const port = parseInt(options.port, 10);
+      const host = options.host;
       const siteUrl = options.site;
 
       console.log(chalk.bold.cyan(`\n🚀 Starting Crawlith UI`));
@@ -29,11 +31,13 @@ export const ui = new Command('ui')
 
       await startServer({
         port,
+        host,
         staticPath: distPath,
         siteName: siteUrl
       });
 
-      const url = `http://localhost:${port}`;
+      const displayHost = host === '0.0.0.0' ? 'localhost' : host;
+      const url = `http://${displayHost}:${port}`;
       console.log(chalk.green(`\n✅ Dashboard ready at: ${chalk.underline(url)}`));
       console.log(chalk.gray('   Press Ctrl+C to stop.'));
 

plugins/server/package.json

@@ -13,7 +13,8 @@
     }
   },
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "test": "vitest run"
   },
   "dependencies": {
     "express": "^4.19.2",

plugins/server/src/index.ts

@@ -4,13 +4,14 @@ import chalk from 'chalk';
 
 export interface ServerOptions {
   port: number;
+  host?: string;
   staticPath: string;
   siteName?: string;
 }
 
 export function startServer(options: ServerOptions): Promise<void> {
   return new Promise((resolve, reject) => {
-    const { port, staticPath, siteName } = options;
+    const { port, host = '127.0.0.1', staticPath, siteName } = options;
     const resolvedStaticPath = path.resolve(staticPath);
 
     const app = express();
@@ -23,8 +24,9 @@ export function startServer(options: ServerOptions): Promise<void> {
       res.sendFile(path.join(resolvedStaticPath, 'index.html'));
     });
 
-    const server = app.listen(port, () => {
-      console.log(chalk.green(`\n✅ Crawlith UI Server started at http://localhost:${port}`));
+    const server = app.listen(port, host, () => {
+      const displayHost = host === '0.0.0.0' ? 'localhost' : host;
+      console.log(chalk.green(`\n✅ Crawlith UI Server started at http://${displayHost}:${port}`));
       if (siteName) {
         console.log(chalk.gray(`   Viewing site: ${siteName}`));
       }

plugins/server/tests/server.test.ts

@@ -0,0 +1,59 @@
+import { test, expect, vi, beforeEach } from 'vitest';
+import express from 'express';
+import { startServer } from '../src/index.js';
+
+vi.mock('express', () => {
+  const mockApp = {
+    use: vi.fn(),
+    get: vi.fn(),
+    listen: vi.fn((port, host, callback) => {
+      if (typeof host === 'function') {
+        // Handle case where host is omitted and callback is second arg
+        host();
+      } else if (callback) {
+        callback();
+      }
+      return {
+        on: vi.fn(),
+        close: vi.fn((cb) => cb && cb())
+      };
+    })
+  };
+  const expressMock: any = vi.fn(() => mockApp);
+  expressMock.static = vi.fn();
+  return {
+    default: expressMock
+  };
+});
+
+vi.mock('node:path', () => ({
+  default: {
+    resolve: vi.fn((p) => p),
+    join: vi.fn((...args) => args.join('/'))
+  }
+}));
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+test('startServer uses default host 127.0.0.1', async () => {
+  const mockApp = express();
+  await startServer({
+    port: 3000,
+    staticPath: './static'
+  });
+
+  expect(mockApp.listen).toHaveBeenCalledWith(3000, '127.0.0.1', expect.any(Function));
+});
+
+test('startServer uses provided host', async () => {
+  const mockApp = express();
+  await startServer({
+    port: 3000,
+    host: '0.0.0.0',
+    staticPath: './static'
+  });
+
+  expect(mockApp.listen).toHaveBeenCalledWith(3000, '0.0.0.0', expect.any(Function));
+});