fix(webhook-server): default-bind to loopback instead of 0.0.0.0

[smith-vosburg]

Type of Change

• Fix - bug fix or security fix to source code

Description

The webhook server in src/webhook-server.ts currently binds to 0.0.0.0, exposing the HTTP listener to every interface on the host. Most installs don't actually need this — the Chat-SDK Telegram adapter uses long polling, and operators who genuinely need an externally-reachable webhook are typically fronting it with a reverse proxy on a different port anyway.

This refactor extracts resolveListenConfig() so the bind address is environment-driven and unit-testable. Defaults to 127.0.0.1 so the port is not exposed to the LAN; operators who need external exposure can opt in with WEBHOOK_BIND=0.0.0.0 (or a specific interface IP).

Diff

// src/webhook-server.ts
const DEFAULT_BIND = '127.0.0.1';

export function resolveListenConfig(env: NodeJS.ProcessEnv): { port: number; bind: string } {
  const portRaw = env.WEBHOOK_PORT;
  const port = portRaw ? parseInt(portRaw, 10) : DEFAULT_PORT;
  const bind = env.WEBHOOK_BIND || DEFAULT_BIND;
  return { port, bind };
}

// ensureServer():
const { port, bind } = resolveListenConfig(process.env);
// ...
server.listen(port, bind, () => {
  log.info('Webhook server started', { port, bind, adapters: [...routes.keys()] });
});

Tests

src/webhook-server.test.ts (new) — four cases on resolveListenConfig:

• Default port + loopback when both env vars unset
• Honors WEBHOOK_PORT when set
• Honors WEBHOOK_BIND for opt-in external exposure
• Treats empty-string WEBHOOK_BIND as unset (so an accidental WEBHOOK_BIND= in a dotenv file doesn't silently bind to all interfaces)

Test Files  1 passed (1)
     Tests  4 passed (4)

pnpm typecheck is clean.

Notes

• Companion to fix(security): use CSPRNG for approval card ids + clicker authorization #2545 (CSPRNG approval ids). The fork-local commit that PR was cherry-picked from originally included a webhook-server.test.ts for this function; the test was dropped in fix(security): use CSPRNG for approval card ids + clicker authorization #2545 because the underlying refactor wasn't included. This PR lands the missing refactor + the test.
• Authored by smith-vosburg, applied via cherry-pick from vosburg-auto/nanoclaw@273da12.

🤖 Generated with Claude Code