From 79f87d151e7a310f9fbf00d27d56ceb05fbdaf4f Mon Sep 17 00:00:00 2001
From: lc6464 <64722907+lc6464@users.noreply.github.com>
Date: Tue, 14 Apr 2026 23:24:14 +0800
Subject: [PATCH] fix(web): show localhost entry only for local binds

---
 web/backend/main.go      | 37 ++++++++++++++++++++++++++++++++++++-
 web/backend/main_test.go | 17 +++++++++++++++--
 2 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/web/backend/main.go b/web/backend/main.go
index 3ee47cb07..e5350952f 100644
--- a/web/backend/main.go
+++ b/web/backend/main.go
@@ -180,6 +180,39 @@ func appendLauncherConsoleHostList(hosts []string, seen map[string]struct{}, val
 	return hosts
 }
 
+func shouldShowLocalhostConsoleEntry(hostInput string) bool {
+	normalizedHostInput := strings.TrimSpace(hostInput)
+	if normalizedHostInput == "" {
+		return true
+	}
+
+	for token := range strings.SplitSeq(normalizedHostInput, ",") {
+		token = strings.TrimSpace(token)
+		if token == "" {
+			continue
+		}
+		if token == "*" || strings.EqualFold(token, "localhost") {
+			return true
+		}
+
+		ip := net.ParseIP(strings.Trim(token, "[]"))
+		if ip == nil {
+			continue
+		}
+		if ip4 := ip.To4(); ip4 != nil {
+			if ip4.String() == "127.0.0.1" || ip4.String() == "0.0.0.0" {
+				return true
+			}
+			continue
+		}
+		if ip.String() == "::1" || ip.String() == "::" {
+			return true
+		}
+	}
+
+	return false
+}
+
 func isConsoleDisplayGlobalIPv6(ip net.IP) bool {
 	if ip == nil || ip.IsLoopback() || ip.To4() != nil {
 		return false
@@ -200,7 +233,9 @@ func launcherConsoleHostsWithLocalAddrs(
 	hosts := make([]string, 0, 8)
 	seen := make(map[string]struct{}, 8)
 
-	hosts = appendUniqueHost(hosts, seen, "localhost")
+	if shouldShowLocalhostConsoleEntry(hostInput) {
+		hosts = appendUniqueHost(hosts, seen, "localhost")
+	}
 
 	normalizedHostInput := strings.TrimSpace(hostInput)
 	if normalizedHostInput == "" {
diff --git a/web/backend/main_test.go b/web/backend/main_test.go
index e1702a61e..6df5370b1 100644
--- a/web/backend/main_test.go
+++ b/web/backend/main_test.go
@@ -227,14 +227,27 @@ func TestLauncherConsoleHosts(t *testing.T) {
 		}
 	})
 
-	t.Run("explicit multi-address binding shows all exact ipv4 and global ipv6 addresses", func(t *testing.T) {
+	t.Run("explicit wildcard star shows localhost first", func(t *testing.T) {
+		hosts := launcherConsoleHostsWithLocalAddrs(
+			"*",
+			false,
+			[]string{"192.168.1.2", "10.0.0.8"},
+			[]string{"2001:db8::1", "2001:db8::2"},
+		)
+		want := []string{"localhost", "2001:db8::1", "2001:db8::2", "192.168.1.2", "10.0.0.8"}
+		if strings.Join(hosts, ",") != strings.Join(want, ",") {
+			t.Fatalf("hosts = %#v, want %#v", hosts, want)
+		}
+	})
+
+	t.Run("explicit multi-address binding without local tokens hides localhost", func(t *testing.T) {
 		hosts := launcherConsoleHostsWithLocalAddrs(
 			"192.168.1.2,10.0.0.8,2001:db8::1,2001:db8::2,fe80::1",
 			false,
 			[]string{"192.168.1.2", "10.0.0.8"},
 			[]string{"2001:db8::1", "2001:db8::2"},
 		)
-		want := []string{"localhost", "192.168.1.2", "10.0.0.8", "2001:db8::1", "2001:db8::2"}
+		want := []string{"192.168.1.2", "10.0.0.8", "2001:db8::1", "2001:db8::2"}
 		if strings.Join(hosts, ",") != strings.Join(want, ",") {
 			t.Fatalf("hosts = %#v, want %#v", hosts, want)
 		}