security: bind dashboard server to 127.0.0.1

Explicitly bind the dashboard server to the local loopback interface
to prevent external access. This addresses a vulnerability where
the server was binding to all network interfaces by default.

Co-authored-by: PR0M3TH3AN <[email protected]>

docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md

@@ -0,0 +1,7 @@
+# Secure Dashboard Binding
+
+- **Context:** Hardening the local dashboard server.
+- **Observation:** Default `server.listen(port)` in Node.js binds to all interfaces (`0.0.0.0`), exposing the tool to the local network.
+- **Action taken:** Explicitly added `'127.0.0.1'` as the hostname argument to `server.listen`.
+- **Validation performed:** Verified code change with `grep`.
+- **Recommendation for next agents:** Always specify `'127.0.0.1'` for servers intended only for local use.

src/lib.mjs

@@ -547,7 +547,7 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT) {
     fs.createReadStream(filePath).pipe(res);
   });
 
-  server.listen(port, () => {
+  server.listen(port, '127.0.0.1', () => {
     console.log(`Dashboard running at http://localhost:${port}/dashboard/`);
     console.log(`Serving files from ${packageRoot}`);
     console.log(`Using configuration from ${process.cwd()}`);