fix(convert): review-serve listens on loopback only

skills/convert-site/scripts/review-serve.mjs

@@ -278,7 +278,7 @@ async function serveForeground({ dir, port }) {
       if (err.code === 'EADDRINUSE') fail(inUse(port, lsofListener(port) ?? { pid: 'unknown', command: 'unknown command' }));
       else fail(new UsageError(`cannot listen on port ${port}: ${err.message}`));
     });
-    server.listen(port, done);
+    server.listen(port, '127.0.0.1', done);
   });
   const stop = () => server.close(() => process.exit(0));
   process.once('SIGTERM', stop);

test/convert/review-serve.test.mjs

@@ -5,7 +5,7 @@ import { createServer } from 'node:http';
 import { createServer as createNetServer } from 'node:net';
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { gzipSync } from 'node:zlib';
-import { tmpdir } from 'node:os';
+import { networkInterfaces, tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { startFixture } from '../fixture/serve.mjs';
 import { compileSource, fillDestination } from '../../skills/convert-site/scripts/lib/review-routes.mjs';
@@ -194,6 +194,19 @@ test('serves dist/, applies vercel.json redirects and rewrites, proxies other or
   }
 });
 
+test('listens on loopback only, not on the machine\'s network addresses', async (t) => {
+  const external = Object.values(networkInterfaces()).flat().find((a) => a.family === 'IPv4' && !a.internal);
+  if (!external) return t.skip('no non-loopback IPv4 address on this machine');
+  const port = await freePort();
+  const { child } = await serve(['--dir', site, '--port', String(port)]);
+  try {
+    assert.equal((await fetch(`http://127.0.0.1:${port}/`)).status, 200);
+    await assert.rejects(fetch(`http://${external.address}:${port}/`));
+  } finally {
+    child.kill('SIGTERM');
+  }
+});
+
 test('a port held by another process exits 2 naming the pid instead of binding another interface', async () => {
   const holder = createNetServer();
   await new Promise((done) => holder.listen(0, '127.0.0.1', done));