feat: add --host to bind the desk beyond loopback for remote review

[ymansurozer]

What

Adds a --host <addr> flag (with GALLEY_HOST env fallback) that binds the desk HTTP server to a given address, for remote-dev workflows — desk + agent on a tailnet-only server, reviewer's browser on another device — without a wrapper or proxy. The absolute default stays 127.0.0.1 (loopback-only): zero behavior change unless opted in.

How it composes with #51 (the origin lock)

The #51 Host/Origin guard is extended, never defeated:

• A loopback bind trusts exactly the loopback authorities it always has (127.0.0.1/localhost/[::1]) — a foreign Host and DNS-rebinding still 403.
• A non-loopback bind adds the machine's os.hostname(), the bound address (for a specific bind), and any GALLEY_ALLOWED_HOSTS (comma-separated) to the trusted set. So Host: devbox:41010 passes on a host named devbox, while Host: evil.example:41010 still 403s. GALLEY_ALLOWED_HOSTS covers names the hostname/address don't — e.g. a tailnet MagicDNS FQDN, which differs from the short hostname.

The derivation lives in a pure, exported resolveBinding(host, hostname, allowedHostsEnv) so the URL/authority logic is unit-tested without binding exotic addresses.

Two URLs

• Browser URL (printed + opened): hostname-based when bound non-loopback (http://devbox:41010/).
• Desk-lock URL (consumed by the same-machine agent subcommands await/comment/reload/status/stop): stays loopback-reachable (127.0.0.1) for loopback/wildcard binds, so the agent side is unaffected. A specific non-loopback bind — unreachable over loopback — uses that exact address for both. IPv6 literals are bracket-wrapped.

Binding beyond loopback prints a security warning: the desk API is unauthenticated (runs the configured editor command, mutates the git index, reads any repo file), so it should be exposed only on a fully trusted network.

Docs

README gets a "Reviewing on a remote machine" section with the honest security warning; the --host/GALLEY_HOST/GALLEY_ALLOWED_HOSTS flags are in --help, and src/spec.ts notes the lock URL stays loopback-reachable (per the CLAUDE.md rule to update the spec on flag changes).

Tests

• Pure resolveBinding: loopback default (widens nothing, both URLs loopback), wildcard (hostname browser URL + loopback lock), specific IP + specific name, IPv6 bracketing, GALLEY_ALLOWED_HOSTS merge.
• Integration: default bind still 403s the machine hostname (guards the "no widening" property); --host 0.0.0.0 accepts the hostname authority and loopback while a foreign Host still 403s; GALLEY_ALLOWED_HOSTS members pass and non-members 403.

All repo checks green locally: pnpm check, pnpm lint, pnpm test (209), pnpm build, pnpm smoke, pnpm perf-smoke.

🤖 Generated with Claude Code