{"record":{"id":"b911bb488cb8aa90","repo":"Hmbown/CodeWhale","slug":"codewhale-web-is-loopback-only-and-must-bind-to-12","errorCode":null,"errorMessage":"Codewhale web is loopback-only and must bind to 127.0.0.1","messagePattern":"Codewhale web is loopback-only and must bind to 127\\.0\\.0\\.1","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":2580,"sourceCode":"                if args.mcp {\n                    mcp_server::run_mcp_server(workspace).await\n                } else if http_selected {\n                    let (mut config, config_profile) =\n                        load_config_from_cli_with_effective_profile(&cli)?;\n                    initialize_cloud_facts(&config);\n                    let explicit_route_override =\n                        crate::config::explicit_launch_provider_override().is_some()\n                            || crate::config::explicit_launch_model_override().is_some();\n                    apply_selected_fleet_operator_for_launch(\n                        &mut config,\n                        &workspace,\n                        explicit_route_override,\n                        false,\n                    )?;\n                    let cors_origins = resolve_cors_origins(&config, &args.cors_origin);\n                    let bind_host = resolve_serve_bind_host(args.mobile, args.host);\n                    if args.web && bind_host.host != \"127.0.0.1\" {\n                        bail!(\"Codewhale web is loopback-only and must bind to 127.0.0.1\");\n                    }\n                    runtime_api::run_http_server(\n                        config,\n                        workspace,\n                        std::sync::Arc::clone(&plugin_discovery),\n                        runtime_api::RuntimeApiOptions {\n                            host: bind_host.host,\n                            port: args.port,\n                            workers: args.workers.clamp(1, 8),\n                            cors_origins,\n                            auth_token: args.auth_token,\n                            insecure_no_auth: args.insecure_no_auth,\n                            mobile: args.mobile,\n                            web: args.web,\n                            show_qr: args.qr,\n                            config_path: cli.config.clone(),\n                            config_profile,\n                        },","sourceCodeStart":2562,"sourceCodeEnd":2598,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/lib.rs#L2562-L2598","documentation":"The `serve` command with `--web` refuses any bind host other than 127.0.0.1 because the web UI is loopback-only. resolve_serve_bind_host computes the bind address; if args.web is set and the host is not 127.0.0.1, the command bails before starting the HTTP server. This prevents exposing the web interface (and its access to the runtime API) to other network interfaces.","triggerScenarios":"Running `codewhale serve --web --host 0.0.0.0` (or any non-loopback host, or --mobile combined with a host that resolves non-loopback).","commonSituations":"Trying to expose the Codewhale web UI on a LAN address, running in a container and binding 0.0.0.0, or using --mobile which changes the default host resolution.","solutions":["Bind to the loopback interface: omit --host or pass --host 127.0.0.1.","If remote access is needed, put a reverse proxy (ssh -L tunnel, nginx with auth) in front and keep the server on 127.0.0.1.","Drop --web if you only need the HTTP API bound to a non-loopback address, after confirming that is intended.","Check whether --mobile is implicitly altering the resolved host; set an explicit --host 127.0.0.1."],"exampleFix":"// before\ncodewhale serve --web --host 0.0.0.0\n// after\ncodewhale serve --web --host 127.0.0.1   # or forward a port: ssh -L 8080:127.0.0.1:8080 host","handlingStrategy":"validation","validationCode":"// shell\nif [ \"$HOST\" != \"127.0.0.1\" ] && [[ $ARGS == *\"--web\"* ]]; then echo 'web is loopback-only'; exit 1; fi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never combine --web with --host other than 127.0.0.1; use an SSH tunnel or authenticated reverse proxy for remote access.","In containers, keep --web on loopback and publish the port via the container runtime.","Remember --mobile can change host resolution; set an explicit --host 127.0.0.1 when using --web."],"tags":["cli","network","security","bind-address"],"backgroundTag":"invalid-config-value","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}