[AUTOMATION] fix(clawpatch): restrict guard daemon to loopback

[michiosw]

Where We Are

Guard accepts any --addr or KONTEXT_ADDR value today. If someone starts it on 0.0.0.0:4765, the unauthenticated dashboard and API become reachable off-machine.

Where We Want To Go

Guard should stay local-only by default. The daemon must reject non-loopback bind addresses before it starts listening.

How do we get there

Add loopback-only address validation in runDaemon and cover accepted and rejected addresses with focused CLI tests. Verified with go test ./..., go vet ./..., npm exec --yes --package pnpm@10.0.0 -- pnpm install --frozen-lockfile, npm exec --yes --package pnpm@10.0.0 -- pnpm --dir web/guard-dashboard typecheck, and git diff --check.

[michiosw]

• [AUTOMATION] fix(clawpatch): restrict guard daemon to loopback #245 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR restricts the Guard daemon bind address to local-only values. The main changes are:

• Adds daemon address validation after CLI flag parsing.
• Allows localhost and loopback IP bind addresses.
• Rejects wildcard, non-loopback, hostless, and malformed daemon addresses.
• Adds focused unit tests for accepted and rejected address values.

Confidence Score: 4/5

This is close, but the localhost validation gap should be fixed before merging.

• The new guard blocks direct wildcard and non-loopback literals.

• localhost still passes without proving it resolves only to loopback addresses.

• That can leave the unauthenticated daemon reachable off-machine on systems with unusual resolver configuration.

• internal/guard/cli/cli.go

Security Review

• Loopback validation bypass in internal/guard/cli.validateDaemonAddr: localhost is accepted without resolving or normalizing before the daemon binds.

Important Files Changed

Filename	Overview
internal/guard/cli/cli.go	Adds daemon bind-address validation before startup continues.
internal/guard/cli/cli_test.go	Adds unit coverage for accepted loopback and rejected non-loopback daemon addresses.

_{Reviews (1): Last reviewed commit: "fix(clawpatch): restrict guard daemon to..." | Re-trigger Greptile}

[greptile-apps]

Resolve localhost before accepting

This branch accepts localhost without checking what address it resolves to, then runDaemon passes the original host string to ListenAndServe. If a local resolver or hosts file maps localhost to a non-loopback interface, kontext guard start --addr localhost:4765 passes this guard and can still expose the unauthenticated dashboard/API off-machine. Resolve localhost and verify the resolved bind addresses are loopback, or normalize it to a known loopback literal before listening.