From 7a86bc178f794cb31ae92c5831e8f021b32188d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Andr=C3=A9?= <pascalandr@gmail.com>
Date: Mon, 10 Aug 2026 13:48:38 +0200
Subject: [PATCH 1/5] feat(ui): add server connectivity diagnostics

Add a shared Settings Info card for the effective CodeNomad listener mode, bind host, local and remote URLs, workspace root, and candidate network addresses. Keep the Remote Access shortcut capability-gated so the same view remains useful in Electron, Tauri, and remote web sessions without exposing mutable server arguments.

Clarify that per-workspace PID and port details belong to the OpenCode process, extend downloadable diagnostics with connectivity data and a privacy notice, and use the existing clipboard fallback for insecure remote contexts. Failed metadata requests now release the shared pending request so refresh can recover.

Add focused formatter and retry regression tests, run them in PR validation, and translate all new labels across the nine supported locales.
---
 .github/workflows/pr-build.yml                |   2 +
 .../info-settings-diagnostics.test.ts         |  55 ++++++
 .../settings/info-settings-diagnostics.ts     |  41 +++++
 .../settings/info-settings-section.tsx        | 168 ++++++++++++------
 .../ui/src/lib/i18n/messages/de/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/de/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/en/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/en/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/es/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/es/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/fr/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/fr/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/he/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/he/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/ja/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/ja/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/ne/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/ne/settings.ts   |  10 ++
 .../ui/src/lib/i18n/messages/ru/instance.ts   |   2 +-
 .../ui/src/lib/i18n/messages/ru/settings.ts   |  10 ++
 .../src/lib/i18n/messages/zh-Hans/instance.ts |   2 +-
 .../src/lib/i18n/messages/zh-Hans/settings.ts |  10 ++
 packages/ui/src/lib/server-meta.test.ts       |  35 ++++
 packages/ui/src/lib/server-meta.ts            |  10 +-
 .../src/styles/components/settings-info.css   |   2 +
 25 files changed, 355 insertions(+), 66 deletions(-)
 create mode 100644 packages/ui/src/components/settings/info-settings-diagnostics.test.ts
 create mode 100644 packages/ui/src/components/settings/info-settings-diagnostics.ts
 create mode 100644 packages/ui/src/lib/server-meta.test.ts

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 05318b3a1..86f5d91ba 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -105,11 +105,13 @@ jobs:
         run: >-
           node --import tsx --test
           packages/ui/src/components/session-list-visibility.test.ts
+          packages/ui/src/components/settings/info-settings-diagnostics.test.ts
           packages/ui/src/components/unified-picker-path.test.ts
           packages/ui/src/lib/hooks/use-app-session-capture.test.ts
           packages/ui/src/lib/hooks/use-foreground-refresh.test.ts
           packages/ui/src/lib/launch-errors.test.ts
           packages/ui/src/lib/message-selection-position.test.ts
+          packages/ui/src/lib/server-meta.test.ts
           packages/ui/src/lib/trailing-resync.test.ts
           packages/ui/src/stores/abort-created-workspace-cleanup.test.ts
           packages/ui/src/stores/app-session-reconciliation.test.ts
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
new file mode 100644
index 000000000..8c4635f45
--- /dev/null
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
@@ -0,0 +1,55 @@
+import assert from "node:assert/strict"
+import { describe, it } from "node:test"
+
+import type { ServerMeta } from "../../../../server/src/api-types"
+import { buildDiagnosticReport } from "./info-settings-diagnostics"
+
+const meta: ServerMeta = {
+  localUrl: "http://127.0.0.1:9899",
+  remoteUrl: "https://192.168.1.20:9898",
+  eventsUrl: "http://127.0.0.1:9899/api/events",
+  host: "0.0.0.0",
+  listeningMode: "all",
+  localPort: 9899,
+  remotePort: 9898,
+  hostLabel: "0.0.0.0",
+  workspaceRoot: "/home/user/projects",
+  addresses: [
+    { ip: "192.168.1.20", family: "ipv4", scope: "external", remoteUrl: "https://192.168.1.20:9898" },
+    { ip: "127.0.0.1", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.1:9898" },
+  ],
+  serverVersion: "1.2.3",
+  ui: { version: "1.2.3", source: "bundled" },
+}
+
+describe("buildDiagnosticReport", () => {
+  it("includes effective connectivity details and candidate addresses", () => {
+    const report = buildDiagnosticReport(
+      meta,
+      "Linux x86_64",
+      { host: "tauri", platform: "desktop", windowContext: "local" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(report, /Generated: 2026-08-10T12:00:00\.000Z/)
+    assert.match(report, /Listening mode: all/)
+    assert.match(report, /Bind host: 0\.0\.0\.0/)
+    assert.match(report, /Local URL: http:\/\/127\.0\.0\.1:9899/)
+    assert.match(report, /Remote URL: https:\/\/192\.168\.1\.20:9898/)
+    assert.match(report, /Candidate addresses: 2/)
+    assert.match(report, /ipv4\/external: https:\/\/192\.168\.1\.20:9898/)
+  })
+
+  it("uses explicit fallbacks when server metadata is unavailable", () => {
+    const report = buildDiagnosticReport(
+      null,
+      "Unknown",
+      { host: "web", platform: "web", windowContext: "remote" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(report, /Server version: unknown/)
+    assert.match(report, /Remote URL: none/)
+    assert.match(report, /Candidate addresses: 0/)
+  })
+})
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.ts b/packages/ui/src/components/settings/info-settings-diagnostics.ts
new file mode 100644
index 000000000..3657297c8
--- /dev/null
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.ts
@@ -0,0 +1,41 @@
+import type { ServerMeta } from "../../../../server/src/api-types"
+
+export interface DiagnosticRuntime {
+  host: string
+  platform: string
+  windowContext: string
+}
+
+export function buildDiagnosticReport(
+  meta: ServerMeta | null,
+  osDisplay: string,
+  runtime: DiagnosticRuntime,
+  generatedAt = new Date(),
+): string {
+  const lines = [
+    "CodeNomad Diagnostic Report",
+    "============================",
+    `Generated: ${generatedAt.toISOString()}`,
+    `Server version: ${meta?.serverVersion ?? "unknown"}`,
+    `UI version: ${meta?.ui?.version ?? "unknown"} (source: ${meta?.ui?.source ?? "unknown"})`,
+    `Runtime: ${runtime.host}`,
+    `Platform: ${runtime.platform}`,
+    `Window context: ${runtime.windowContext}`,
+    `OS: ${osDisplay}`,
+    `Listening mode: ${meta?.listeningMode ?? "unknown"}`,
+    `Bind host: ${meta?.host ?? "unknown"}`,
+    `Local URL: ${meta?.localUrl ?? "unknown"}`,
+    `Local port: ${meta?.localPort ?? "unknown"}`,
+    `Remote URL: ${meta?.remoteUrl ?? "none"}`,
+    `Remote port: ${meta?.remotePort ?? "none"}`,
+    `Workspace root: ${meta?.workspaceRoot ?? "unknown"}`,
+    `Candidate addresses: ${meta?.addresses.length ?? 0}`,
+  ]
+
+  for (const address of meta?.addresses ?? []) {
+    lines.push(`- ${address.family}/${address.scope}: ${address.remoteUrl}`)
+  }
+
+  lines.push("")
+  return lines.join("\n")
+}
diff --git a/packages/ui/src/components/settings/info-settings-section.tsx b/packages/ui/src/components/settings/info-settings-section.tsx
index cc1f19371..fa22a4e8c 100644
--- a/packages/ui/src/components/settings/info-settings-section.tsx
+++ b/packages/ui/src/components/settings/info-settings-section.tsx
@@ -1,9 +1,11 @@
-import { createEffect, createMemo, createResource, createSignal, onCleanup, type Component } from "solid-js"
-import { Info } from "lucide-solid"
+import { createEffect, createMemo, createResource, createSignal, For, onCleanup, Show, type Component } from "solid-js"
+import { Info, Network } from "lucide-solid"
+import { copyToClipboard } from "../../lib/clipboard"
 import { useI18n } from "../../lib/i18n"
 import { getServerMeta } from "../../lib/server-meta"
-import { runtimeEnv } from "../../lib/runtime-env"
-import type { ServerMeta } from "../../../../server/src/api-types"
+import { canOpenRemoteWindows, runtimeEnv } from "../../lib/runtime-env"
+import { openSettings } from "../../stores/settings-screen"
+import { buildDiagnosticReport } from "./info-settings-diagnostics"
 
 interface UserAgentData {
   platform?: string
@@ -62,36 +64,6 @@ async function resolveArchitecture(): Promise<string | null> {
   }
 }
 
-function buildDiagnosticReport(
-  meta: ServerMeta | null,
-  osDisplay: string,
-): string {
-  const lines: string[] = []
-  lines.push("CodeNomad Diagnostic Report")
-  lines.push("============================")
-  lines.push(`Generated: ${new Date().toISOString()}`)
-  lines.push(`Server version: ${meta?.serverVersion ?? "unknown"}`)
-  lines.push(`UI version: ${meta?.ui?.version ?? "unknown"} (source: ${meta?.ui?.source ?? "unknown"})`)
-  lines.push(`Runtime: ${runtimeEnv.host}`)
-  lines.push(`Platform: ${runtimeEnv.platform}`)
-  lines.push(`Window context: ${runtimeEnv.windowContext}`)
-  lines.push(`OS: ${osDisplay}`)
-  lines.push(`Server URL: ${meta?.localUrl ?? "unknown"}`)
-  lines.push(`Workspace root: ${meta?.workspaceRoot ?? "unknown"}`)
-  lines.push(`UI source: ${meta?.ui?.source ?? "unknown"}`)
-  lines.push("")
-  return lines.join("\n")
-}
-
-async function copyToClipboard(text: string): Promise<boolean> {
-  try {
-    await navigator.clipboard.writeText(text)
-    return true
-  } catch {
-    return false
-  }
-}
-
 function downloadTextFile(filename: string, text: string) {
   const blob = new Blob([text], { type: "text/plain;charset=utf-8" })
   const url = URL.createObjectURL(blob)
@@ -122,7 +94,16 @@ function versionNewer(current: string, latest: string): boolean | null {
 
 export const InfoSettingsSection: Component = () => {
   const { t } = useI18n()
-  const [meta, { mutate }] = createResource(() => getServerMeta())
+  const [metaLoadFailed, setMetaLoadFailed] = createSignal(false)
+  const [meta, { mutate }] = createResource(async () => {
+    setMetaLoadFailed(false)
+    try {
+      return await getServerMeta()
+    } catch {
+      setMetaLoadFailed(true)
+      return null
+    }
+  })
   const [copyFeedback, setCopyFeedback] = createSignal<"success" | "error" | null>(null)
   const [osArch, setOsArch] = createSignal<string | null>(null)
 
@@ -171,8 +152,13 @@ export const InfoSettingsSection: Component = () => {
   onCleanup(() => clearTimeout(feedbackTimer))
 
   const handleRefresh = async () => {
-    const fresh = await getServerMeta(true)
-    mutate(fresh)
+    setMetaLoadFailed(false)
+    try {
+      const fresh = await getServerMeta(true)
+      mutate(fresh)
+    } catch {
+      setMetaLoadFailed(true)
+    }
   }
 
   const osDisplay = createMemo(() => {
@@ -182,14 +168,14 @@ export const InfoSettingsSection: Component = () => {
   })
 
   const handleCopy = async () => {
-    const report = buildDiagnosticReport(meta() ?? null, osDisplay())
+    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv)
     const ok = await copyToClipboard(report)
     if (ok) setCopyFeedback("success")
     else setCopyFeedback("error")
   }
 
   const handleDownload = () => {
-    const report = buildDiagnosticReport(meta() ?? null, osDisplay())
+    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv)
     const ts = new Date().toISOString().replace(/[:.]/g, "-")
     downloadTextFile(`codenomad-diagnostics-${ts}.txt`, report)
   }
@@ -208,10 +194,6 @@ export const InfoSettingsSection: Component = () => {
         </div>
 
         <div class="settings-info-grid">
-          <div class="settings-info-row">
-            <span class="settings-info-label">{t("settings.info.version.server")}</span>
-            <span class="settings-info-value">{meta()?.serverVersion ?? "—"}</span>
-          </div>
           <div class="settings-info-row">
             <span class="settings-info-label">{t("settings.info.version.ui")}</span>
             <span class="settings-info-value">{meta()?.ui?.version ?? "—"}</span>
@@ -234,19 +216,95 @@ export const InfoSettingsSection: Component = () => {
             <span class="settings-info-label">{t("settings.info.runtime.os")}</span>
             <span class="settings-info-value settings-info-value-muted">{osDisplay()}</span>
           </div>
-          <div class="settings-info-row">
-            <span class="settings-info-label">{t("settings.info.server.url")}</span>
-            <span class="settings-info-value settings-info-value-muted">
-              {meta()?.localUrl ?? "—"}
-            </span>
-          </div>
-          <div class="settings-info-row">
-            <span class="settings-info-label">{t("settings.info.server.root")}</span>
-            <span class="settings-info-value settings-info-value-muted">
-              {meta()?.workspaceRoot ?? "—"}
-            </span>
+        </div>
+      </div>
+
+      <div class="settings-card">
+        <div class="settings-card-header">
+          <div class="settings-card-heading-with-icon">
+            <Network class="settings-card-heading-icon" />
+            <div>
+              <h3 class="settings-card-title">{t("settings.info.connectivity.title")}</h3>
+              <p class="settings-card-subtitle">{t("settings.info.connectivity.subtitle")}</p>
+            </div>
           </div>
         </div>
+
+        <Show when={meta.loading}>
+          <div class="settings-card-message" role="status" aria-live="polite">
+            {t("remoteAccess.addresses.loading")}
+          </div>
+        </Show>
+        <Show when={metaLoadFailed()}>
+          <div class="settings-error-message" role="alert">
+            {t("settings.info.connectivity.loadFailed")}
+          </div>
+        </Show>
+        <Show when={meta()}>
+          {(serverMeta) => (
+            <>
+              <dl class="settings-info-grid">
+                <div class="settings-info-row">
+                  <dt class="settings-info-label">{t("settings.info.version.server")}</dt>
+                  <dd class="settings-info-value" dir="ltr">{serverMeta().serverVersion ?? "—"}</dd>
+                </div>
+                <div class="settings-info-row">
+                  <dt class="settings-info-label">{t("remoteAccess.sections.listeningMode.label")}</dt>
+                  <dd class="settings-info-value">
+                    {t(serverMeta().listeningMode === "all" ? "settings.info.connectivity.mode.all" : "settings.info.connectivity.mode.local")}
+                  </dd>
+                </div>
+                <div class="settings-info-row">
+                  <dt class="settings-info-label">{t("settings.info.connectivity.host")}</dt>
+                  <dd class="settings-info-value settings-info-value-muted" dir="ltr">{serverMeta().host}</dd>
+                </div>
+                <div class="settings-info-row">
+                  <dt class="settings-info-label">{t("settings.info.connectivity.localListener")}</dt>
+                  <dd class="settings-info-value settings-info-value-muted" dir="ltr">{serverMeta().localUrl}</dd>
+                </div>
+                <Show when={serverMeta().remoteUrl}>
+                  {(remoteUrl) => (
+                    <div class="settings-info-row">
+                      <dt class="settings-info-label">{t("settings.info.connectivity.remoteListener")}</dt>
+                      <dd class="settings-info-value settings-info-value-muted" dir="ltr">{remoteUrl()}</dd>
+                    </div>
+                  )}
+                </Show>
+                <div class="settings-info-row">
+                  <dt class="settings-info-label">{t("settings.info.server.root")}</dt>
+                  <dd class="settings-info-value settings-info-value-muted" dir="ltr">{serverMeta().workspaceRoot}</dd>
+                </div>
+              </dl>
+
+              <h4 class="settings-card-title">{t("remoteAccess.sections.addresses.label")}</h4>
+              <Show when={serverMeta().addresses.length > 0} fallback={<div class="settings-card-message">{t("remoteAccess.addresses.none")}</div>}>
+                <dl class="settings-info-grid">
+                  <For each={serverMeta().addresses}>{(address) => (
+                    <div class="settings-info-row">
+                      <dt class="settings-info-label">
+                        {address.family.toUpperCase()} · {t(address.scope === "external"
+                          ? "remoteAccess.address.scope.network"
+                          : address.scope === "internal"
+                            ? "remoteAccess.address.scope.internal"
+                            : "remoteAccess.address.scope.loopback")}
+                      </dt>
+                      <dd class="settings-info-value settings-info-value-muted" dir="ltr">{address.remoteUrl}</dd>
+                    </div>
+                  )}</For>
+                </dl>
+              </Show>
+              <p class="settings-help-text">{t("settings.info.connectivity.disclaimer")}</p>
+
+              <Show when={canOpenRemoteWindows()}>
+                <div class="settings-info-actions">
+                  <button type="button" class="settings-pill-button" onClick={() => openSettings("remote")}>
+                    {t("settings.nav.remote")}
+                  </button>
+                </div>
+              </Show>
+            </>
+          )}
+        </Show>
       </div>
 
       <div class="settings-card">
@@ -300,6 +358,8 @@ export const InfoSettingsSection: Component = () => {
           </div>
         </div>
 
+        <div class="settings-card-message">{t("settings.info.diagnostics.privacy")}</div>
+
         <div class="settings-info-actions">
           <button
             type="button"
diff --git a/packages/ui/src/lib/i18n/messages/de/instance.ts b/packages/ui/src/lib/i18n/messages/de/instance.ts
index d3eaa2635..dc3f0fc97 100644
--- a/packages/ui/src/lib/i18n/messages/de/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/de/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "Binärpfad",
   "instanceInfo.labels.environmentVariables": "Umgebungsvariablen ({count})",
   "instanceInfo.loading": "Wird geladen...",
-  "instanceInfo.server.title": "Server",
+  "instanceInfo.server.title": "OpenCode-Prozess",
   "instanceInfo.server.port": "Port:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "Status:",
diff --git a/packages/ui/src/lib/i18n/messages/de/settings.ts b/packages/ui/src/lib/i18n/messages/de/settings.ts
index 49794fa81..f2a81c037 100644
--- a/packages/ui/src/lib/i18n/messages/de/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/de/settings.ts
@@ -463,6 +463,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Betriebssystem",
   "settings.info.server.url": "Server-URL",
   "settings.info.server.root": "Arbeitsbereich-Root",
+  "settings.info.connectivity.title": "CodeNomad-Serververbindung",
+  "settings.info.connectivity.subtitle": "Prüfen Sie die tatsächlich verwendete Listener-Konfiguration und mögliche Netzwerkadressen.",
+  "settings.info.connectivity.mode.local": "Nur lokal",
+  "settings.info.connectivity.mode.all": "Alle Netzwerkschnittstellen",
+  "settings.info.connectivity.host": "Bind-Adresse",
+  "settings.info.connectivity.localListener": "Lokaler Listener",
+  "settings.info.connectivity.remoteListener": "Remote-Listener",
+  "settings.info.connectivity.disclaimer": "Diese Adressen werden aus den Netzwerkschnittstellen abgeleitet. Firewall-, Router- oder Zertifikatseinstellungen können Verbindungen dennoch verhindern.",
+  "settings.info.connectivity.loadFailed": "Die Verbindungsdetails des CodeNomad-Servers konnten nicht geladen werden.",
+  "settings.info.diagnostics.privacy": "Prüfen Sie diesen Bericht vor dem Teilen. Er enthält lokale Pfade und Netzwerkadressen, aber niemals Passwörter oder Authentifizierungsgeheimnisse.",
   "settings.info.updates.title": "Updates",
   "settings.info.updates.subtitle": "Nach neuen CodeNomad-Releases suchen.",
   "settings.info.updates.latest": "Neueste Version",
diff --git a/packages/ui/src/lib/i18n/messages/en/instance.ts b/packages/ui/src/lib/i18n/messages/en/instance.ts
index bd4fb6990..b5230153d 100644
--- a/packages/ui/src/lib/i18n/messages/en/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/en/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "Binary Path",
   "instanceInfo.labels.environmentVariables": "Environment Variables ({count})",
   "instanceInfo.loading": "Loading...",
-  "instanceInfo.server.title": "Server",
+  "instanceInfo.server.title": "OpenCode process",
   "instanceInfo.server.port": "Port:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "Status:",
diff --git a/packages/ui/src/lib/i18n/messages/en/settings.ts b/packages/ui/src/lib/i18n/messages/en/settings.ts
index 7e79f5e06..22d32af37 100644
--- a/packages/ui/src/lib/i18n/messages/en/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/en/settings.ts
@@ -465,6 +465,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Operating system",
   "settings.info.server.url": "Server URL",
   "settings.info.server.root": "Workspace root",
+  "settings.info.connectivity.title": "CodeNomad server connectivity",
+  "settings.info.connectivity.subtitle": "Inspect the effective listener configuration and candidate network addresses.",
+  "settings.info.connectivity.mode.local": "Local only",
+  "settings.info.connectivity.mode.all": "All network interfaces",
+  "settings.info.connectivity.host": "Bind host",
+  "settings.info.connectivity.localListener": "Local listener",
+  "settings.info.connectivity.remoteListener": "Remote listener",
+  "settings.info.connectivity.disclaimer": "These addresses are derived from network interfaces. Firewall, router, and certificate settings may still prevent connections.",
+  "settings.info.connectivity.loadFailed": "Unable to load CodeNomad server connectivity details.",
+  "settings.info.diagnostics.privacy": "Review this report before sharing it. It includes local paths and network addresses, but never passwords or authentication secrets.",
   "settings.info.updates.title": "Updates",
   "settings.info.updates.subtitle": "Check for new releases of CodeNomad.",
   "settings.info.updates.latest": "Latest version",
diff --git a/packages/ui/src/lib/i18n/messages/es/instance.ts b/packages/ui/src/lib/i18n/messages/es/instance.ts
index e24672a82..d532cfad2 100644
--- a/packages/ui/src/lib/i18n/messages/es/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/es/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "Ruta del binario",
   "instanceInfo.labels.environmentVariables": "Variables de entorno ({count})",
   "instanceInfo.loading": "Cargando...",
-  "instanceInfo.server.title": "Servidor",
+  "instanceInfo.server.title": "Proceso de OpenCode",
   "instanceInfo.server.port": "Puerto:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "Estado:",
diff --git a/packages/ui/src/lib/i18n/messages/es/settings.ts b/packages/ui/src/lib/i18n/messages/es/settings.ts
index 268c30623..3aa2f220c 100644
--- a/packages/ui/src/lib/i18n/messages/es/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/es/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Sistema operativo",
   "settings.info.server.url": "URL del servidor",
   "settings.info.server.root": "Raíz del workspace",
+  "settings.info.connectivity.title": "Conectividad del servidor CodeNomad",
+  "settings.info.connectivity.subtitle": "Consulta la configuración de escucha en uso y las posibles direcciones de red.",
+  "settings.info.connectivity.mode.local": "Solo local",
+  "settings.info.connectivity.mode.all": "Todas las interfaces de red",
+  "settings.info.connectivity.host": "Host de escucha",
+  "settings.info.connectivity.localListener": "Punto de escucha local",
+  "settings.info.connectivity.remoteListener": "Punto de escucha remoto",
+  "settings.info.connectivity.disclaimer": "Estas direcciones se derivan de las interfaces de red. La configuración del firewall, del router o del certificado aún puede impedir las conexiones.",
+  "settings.info.connectivity.loadFailed": "No se pudieron cargar los detalles de conectividad del servidor CodeNomad.",
+  "settings.info.diagnostics.privacy": "Revisa este informe antes de compartirlo. Incluye rutas locales y direcciones de red, pero nunca contraseñas ni secretos de autenticación.",
   "settings.info.updates.title": "Actualizaciones",
   "settings.info.updates.subtitle": "Busca nuevas releases de CodeNomad.",
   "settings.info.updates.latest": "Última versión",
diff --git a/packages/ui/src/lib/i18n/messages/fr/instance.ts b/packages/ui/src/lib/i18n/messages/fr/instance.ts
index 51b865dc0..c5f790f09 100644
--- a/packages/ui/src/lib/i18n/messages/fr/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/fr/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "Chemin du binaire",
   "instanceInfo.labels.environmentVariables": "Variables d'environnement ({count})",
   "instanceInfo.loading": "Chargement...",
-  "instanceInfo.server.title": "Serveur",
+  "instanceInfo.server.title": "Processus OpenCode",
   "instanceInfo.server.port": "Port :",
   "instanceInfo.server.pid": "PID :",
   "instanceInfo.server.status": "Statut :",
diff --git a/packages/ui/src/lib/i18n/messages/fr/settings.ts b/packages/ui/src/lib/i18n/messages/fr/settings.ts
index 65c924f73..03426ccfe 100644
--- a/packages/ui/src/lib/i18n/messages/fr/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/fr/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Système d'exploitation",
   "settings.info.server.url": "URL du serveur",
   "settings.info.server.root": "Racine de l'espace de travail",
+  "settings.info.connectivity.title": "Connectivité du serveur CodeNomad",
+  "settings.info.connectivity.subtitle": "Consultez la configuration d’écoute actuellement utilisée et les adresses réseau possibles.",
+  "settings.info.connectivity.mode.local": "Local uniquement",
+  "settings.info.connectivity.mode.all": "Toutes les interfaces réseau",
+  "settings.info.connectivity.host": "Hôte d’écoute",
+  "settings.info.connectivity.localListener": "Point d’écoute local",
+  "settings.info.connectivity.remoteListener": "Point d’écoute distant",
+  "settings.info.connectivity.disclaimer": "Ces adresses sont dérivées des interfaces réseau. Les paramètres du pare-feu, du routeur ou des certificats peuvent malgré tout empêcher les connexions.",
+  "settings.info.connectivity.loadFailed": "Impossible de charger les informations de connectivité du serveur CodeNomad.",
+  "settings.info.diagnostics.privacy": "Vérifiez ce rapport avant de le partager. Il contient des chemins locaux et des adresses réseau, mais jamais de mots de passe ni de secrets d’authentification.",
   "settings.info.updates.title": "Mises à jour",
   "settings.info.updates.subtitle": "Recherchez les nouvelles versions de CodeNomad.",
   "settings.info.updates.latest": "Dernière version",
diff --git a/packages/ui/src/lib/i18n/messages/he/instance.ts b/packages/ui/src/lib/i18n/messages/he/instance.ts
index 3e42ff082..a7b00b3fb 100644
--- a/packages/ui/src/lib/i18n/messages/he/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/he/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "נתיב קובץ בינארי",
   "instanceInfo.labels.environmentVariables": "משתני סביבה ({count})",
   "instanceInfo.loading": "טוען...",
-  "instanceInfo.server.title": "שרת",
+  "instanceInfo.server.title": "תהליך OpenCode",
   "instanceInfo.server.port": "פורט:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "סטטוס:",
diff --git a/packages/ui/src/lib/i18n/messages/he/settings.ts b/packages/ui/src/lib/i18n/messages/he/settings.ts
index a7f9c7fb6..3443b699a 100644
--- a/packages/ui/src/lib/i18n/messages/he/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/he/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "מערכת הפעלה",
   "settings.info.server.url": "כתובת השרת",
   "settings.info.server.root": "שורש סביבת העבודה",
+  "settings.info.connectivity.title": "קישוריות שרת CodeNomad",
+  "settings.info.connectivity.subtitle": "בדיקת תצורת ההאזנה הפעילה וכתובות רשת אפשריות.",
+  "settings.info.connectivity.mode.local": "מקומי בלבד",
+  "settings.info.connectivity.mode.all": "כל ממשקי הרשת",
+  "settings.info.connectivity.host": "כתובת האזנה",
+  "settings.info.connectivity.localListener": "מאזין מקומי",
+  "settings.info.connectivity.remoteListener": "מאזין מרוחק",
+  "settings.info.connectivity.disclaimer": "כתובות אלה נגזרות מממשקי הרשת. הגדרות חומת האש, הנתב או התעודה הדיגיטלית עדיין עשויות למנוע חיבורים.",
+  "settings.info.connectivity.loadFailed": "לא ניתן לטעון את פרטי הקישוריות של שרת CodeNomad.",
+  "settings.info.diagnostics.privacy": "יש לבדוק את הדוח לפני השיתוף. הוא כולל נתיבים מקומיים וכתובות רשת, אך לעולם לא סיסמאות או סודות אימות.",
   "settings.info.updates.title": "עדכונים",
   "settings.info.updates.subtitle": "בדוק אם יש גרסאות חדשות של CodeNomad.",
   "settings.info.updates.latest": "הגרסה האחרונה",
diff --git a/packages/ui/src/lib/i18n/messages/ja/instance.ts b/packages/ui/src/lib/i18n/messages/ja/instance.ts
index 51952de54..25bd2e9b4 100644
--- a/packages/ui/src/lib/i18n/messages/ja/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/ja/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "バイナリのパス",
   "instanceInfo.labels.environmentVariables": "環境変数 ({count})",
   "instanceInfo.loading": "読み込み中...",
-  "instanceInfo.server.title": "サーバー",
+  "instanceInfo.server.title": "OpenCode プロセス",
   "instanceInfo.server.port": "ポート:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "状態:",
diff --git a/packages/ui/src/lib/i18n/messages/ja/settings.ts b/packages/ui/src/lib/i18n/messages/ja/settings.ts
index 6b266a108..67af9bdec 100644
--- a/packages/ui/src/lib/i18n/messages/ja/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ja/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "オペレーティングシステム",
   "settings.info.server.url": "サーバー URL",
   "settings.info.server.root": "ワークスペースルート",
+  "settings.info.connectivity.title": "CodeNomad サーバー接続",
+  "settings.info.connectivity.subtitle": "有効なリスナー設定と候補のネットワークアドレスを確認します。",
+  "settings.info.connectivity.mode.local": "ローカルのみ",
+  "settings.info.connectivity.mode.all": "すべてのネットワークインターフェース",
+  "settings.info.connectivity.host": "バインドホスト",
+  "settings.info.connectivity.localListener": "ローカルリスナー",
+  "settings.info.connectivity.remoteListener": "リモートリスナー",
+  "settings.info.connectivity.disclaimer": "これらのアドレスはネットワークインターフェースから算出されます。ファイアウォール、ルーター、証明書の設定によって接続できない場合があります。",
+  "settings.info.connectivity.loadFailed": "CodeNomad サーバーの接続情報を読み込めませんでした。",
+  "settings.info.diagnostics.privacy": "共有する前にこのレポートを確認してください。ローカルパスとネットワークアドレスは含まれますが、パスワードや認証シークレットは含まれません。",
   "settings.info.updates.title": "更新",
   "settings.info.updates.subtitle": "CodeNomad の新しいリリースを確認します。",
   "settings.info.updates.latest": "最新バージョン",
diff --git a/packages/ui/src/lib/i18n/messages/ne/instance.ts b/packages/ui/src/lib/i18n/messages/ne/instance.ts
index 5bb3f3e0a..d5309b58b 100644
--- a/packages/ui/src/lib/i18n/messages/ne/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/ne/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "बाइनरी मार्ग",
   "instanceInfo.labels.environmentVariables": "वातावरण चरहरू ({count})",
   "instanceInfo.loading": "लोड हुँदैछ...",
-  "instanceInfo.server.title": "सर्भर",
+  "instanceInfo.server.title": "OpenCode प्रक्रिया",
   "instanceInfo.server.port": "पोर्ट:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "स्थिति:",
diff --git a/packages/ui/src/lib/i18n/messages/ne/settings.ts b/packages/ui/src/lib/i18n/messages/ne/settings.ts
index cbfbb0953..2931206e2 100644
--- a/packages/ui/src/lib/i18n/messages/ne/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ne/settings.ts
@@ -463,6 +463,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "अपरेटिङ सिस्टम",
   "settings.info.server.url": "सर्भर URL",
   "settings.info.server.root": "कार्यस्थानको मूल",
+  "settings.info.connectivity.title": "CodeNomad सर्भर जडान",
+  "settings.info.connectivity.subtitle": "वास्तवमा लागू भएको लिस्नर कन्फिगरेसन र सम्भावित नेटवर्क ठेगानाहरू हेर्नुहोस्।",
+  "settings.info.connectivity.mode.local": "स्थानीय मात्र",
+  "settings.info.connectivity.mode.all": "सबै नेटवर्क इन्टरफेसहरू",
+  "settings.info.connectivity.host": "बाइन्ड होस्ट",
+  "settings.info.connectivity.localListener": "स्थानीय लिस्नर",
+  "settings.info.connectivity.remoteListener": "रिमोट लिस्नर",
+  "settings.info.connectivity.disclaimer": "यी ठेगानाहरू नेटवर्क इन्टरफेसबाट निकालिएका हुन्। फायरवाल, राउटर वा प्रमाणपत्र सेटिङहरूले अझै पनि जडान रोक्न सक्छन्।",
+  "settings.info.connectivity.loadFailed": "CodeNomad सर्भर जडान विवरण लोड गर्न सकिएन।",
+  "settings.info.diagnostics.privacy": "साझा गर्नुअघि यो रिपोर्ट जाँच गर्नुहोस्। यसमा स्थानीय पथ र नेटवर्क ठेगानाहरू समावेश छन्, तर पासवर्ड वा प्रमाणीकरणसम्बन्धी गोप्य जानकारी कहिल्यै समावेश हुँदैन।",
   "settings.info.updates.title": "अपडेटहरू",
   "settings.info.updates.subtitle": "CodeNomad को नयाँ रिलिजहरू जाँच गर्नुहोस्।",
   "settings.info.updates.latest": "भर्खरको संस्करण",
diff --git a/packages/ui/src/lib/i18n/messages/ru/instance.ts b/packages/ui/src/lib/i18n/messages/ru/instance.ts
index 80437e052..7f2d1e7f6 100644
--- a/packages/ui/src/lib/i18n/messages/ru/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/ru/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "Путь к бинарнику",
   "instanceInfo.labels.environmentVariables": "Переменные окружения ({count})",
   "instanceInfo.loading": "Загрузка…",
-  "instanceInfo.server.title": "Сервер",
+  "instanceInfo.server.title": "Процесс OpenCode",
   "instanceInfo.server.port": "Порт:",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "Статус:",
diff --git a/packages/ui/src/lib/i18n/messages/ru/settings.ts b/packages/ui/src/lib/i18n/messages/ru/settings.ts
index d364ab5a6..13f073150 100644
--- a/packages/ui/src/lib/i18n/messages/ru/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ru/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Операционная система",
   "settings.info.server.url": "URL сервера",
   "settings.info.server.root": "Корень рабочей области",
+  "settings.info.connectivity.title": "Подключение к серверу CodeNomad",
+  "settings.info.connectivity.subtitle": "Просмотрите фактическую конфигурацию прослушивания и возможные сетевые адреса.",
+  "settings.info.connectivity.mode.local": "Только локально",
+  "settings.info.connectivity.mode.all": "Все сетевые интерфейсы",
+  "settings.info.connectivity.host": "Адрес привязки",
+  "settings.info.connectivity.localListener": "Локальная точка подключения",
+  "settings.info.connectivity.remoteListener": "Удалённая точка подключения",
+  "settings.info.connectivity.disclaimer": "Эти адреса определяются по сетевым интерфейсам. Настройки брандмауэра, маршрутизатора или сертификата всё равно могут препятствовать подключению.",
+  "settings.info.connectivity.loadFailed": "Не удалось загрузить сведения о подключении к серверу CodeNomad.",
+  "settings.info.diagnostics.privacy": "Проверьте отчёт перед отправкой. Он содержит локальные пути и сетевые адреса, но не содержит паролей или секретов аутентификации.",
   "settings.info.updates.title": "Обновления",
   "settings.info.updates.subtitle": "Проверяйте новые релизы CodeNomad.",
   "settings.info.updates.latest": "Последняя версия",
diff --git a/packages/ui/src/lib/i18n/messages/zh-Hans/instance.ts b/packages/ui/src/lib/i18n/messages/zh-Hans/instance.ts
index 6a29f2029..9ce29f522 100644
--- a/packages/ui/src/lib/i18n/messages/zh-Hans/instance.ts
+++ b/packages/ui/src/lib/i18n/messages/zh-Hans/instance.ts
@@ -12,7 +12,7 @@ export const instanceMessages = {
   "instanceInfo.labels.binaryPath": "可执行文件路径",
   "instanceInfo.labels.environmentVariables": "环境变量（{count}）",
   "instanceInfo.loading": "正在加载...",
-  "instanceInfo.server.title": "服务器",
+  "instanceInfo.server.title": "OpenCode 进程",
   "instanceInfo.server.port": "端口：",
   "instanceInfo.server.pid": "PID:",
   "instanceInfo.server.status": "状态：",
diff --git a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
index 1eed86ce0..25a429610 100644
--- a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
@@ -464,6 +464,16 @@ export const settingsMessages = {
   "settings.info.runtime.os": "操作系统",
   "settings.info.server.url": "服务器 URL",
   "settings.info.server.root": "工作区根目录",
+  "settings.info.connectivity.title": "CodeNomad 服务器连接",
+  "settings.info.connectivity.subtitle": "查看实际生效的监听配置和候选网络地址。",
+  "settings.info.connectivity.mode.local": "仅本机",
+  "settings.info.connectivity.mode.all": "所有网络接口",
+  "settings.info.connectivity.host": "绑定主机",
+  "settings.info.connectivity.localListener": "本地监听地址",
+  "settings.info.connectivity.remoteListener": "远程监听地址",
+  "settings.info.connectivity.disclaimer": "这些地址根据网络接口生成。防火墙、路由器或证书设置仍可能阻止连接。",
+  "settings.info.connectivity.loadFailed": "无法加载 CodeNomad 服务器连接信息。",
+  "settings.info.diagnostics.privacy": "分享前请检查此报告。报告包含本地路径和网络地址，但绝不包含密码或认证机密信息。",
   "settings.info.updates.title": "更新",
   "settings.info.updates.subtitle": "检查 CodeNomad 的新版本。",
   "settings.info.updates.latest": "最新版本",
diff --git a/packages/ui/src/lib/server-meta.test.ts b/packages/ui/src/lib/server-meta.test.ts
new file mode 100644
index 000000000..4b5338888
--- /dev/null
+++ b/packages/ui/src/lib/server-meta.test.ts
@@ -0,0 +1,35 @@
+import assert from "node:assert/strict"
+import { it } from "node:test"
+
+import type { ServerMeta } from "../../../server/src/api-types"
+import { serverApi } from "./api-client"
+import { getServerMeta } from "./server-meta"
+
+it("allows a metadata retry after a failed request", async () => {
+  const originalFetch = serverApi.fetchServerMeta
+  let attempts = 0
+  const recoveredMeta: ServerMeta = {
+    localUrl: "http://127.0.0.1:9899",
+    eventsUrl: "http://127.0.0.1:9899/api/events",
+    host: "127.0.0.1",
+    listeningMode: "local",
+    localPort: 9899,
+    hostLabel: "localhost",
+    workspaceRoot: "/workspace",
+    addresses: [],
+  }
+
+  serverApi.fetchServerMeta = async () => {
+    attempts += 1
+    if (attempts === 1) throw new Error("offline")
+    return recoveredMeta
+  }
+
+  try {
+    await assert.rejects(getServerMeta(true), /offline/)
+    assert.equal(await getServerMeta(true), recoveredMeta)
+    assert.equal(attempts, 2)
+  } finally {
+    serverApi.fetchServerMeta = originalFetch
+  }
+})
diff --git a/packages/ui/src/lib/server-meta.ts b/packages/ui/src/lib/server-meta.ts
index 9dbcacbf0..c9e1f48bd 100644
--- a/packages/ui/src/lib/server-meta.ts
+++ b/packages/ui/src/lib/server-meta.ts
@@ -11,10 +11,14 @@ export async function getServerMeta(forceRefresh = false): Promise<ServerMeta> {
   if (pendingMeta) {
     return pendingMeta
   }
-  pendingMeta = serverApi.fetchServerMeta().then((meta) => {
+  const request = serverApi.fetchServerMeta().then((meta) => {
     cachedMeta = meta
-    pendingMeta = null
     return meta
   })
-  return pendingMeta
+  pendingMeta = request
+  try {
+    return await request
+  } finally {
+    if (pendingMeta === request) pendingMeta = null
+  }
 }
diff --git a/packages/ui/src/styles/components/settings-info.css b/packages/ui/src/styles/components/settings-info.css
index 37cab87bb..832aa41d4 100644
--- a/packages/ui/src/styles/components/settings-info.css
+++ b/packages/ui/src/styles/components/settings-info.css
@@ -19,6 +19,7 @@
 }
 
 .settings-info-label {
+  margin: 0;
   font-size: var(--font-size-sm);
   font-weight: var(--font-weight-medium);
   color: var(--text-secondary);
@@ -26,6 +27,7 @@
 }
 
 .settings-info-value {
+  margin: 0;
   font-size: var(--font-size-sm);
   color: var(--text-primary);
   text-align: end;

From 5d2218319b991e287a6d2e7aa79ec8d02ddcc2c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Andr=C3=A9?= <pascalandr@gmail.com>
Date: Mon, 10 Aug 2026 14:10:55 +0200
Subject: [PATCH 2/5] fix(ui): address connectivity review findings

Distinguish concrete bind hosts from wildcard all-interface listeners and remove unreachable loopback candidates from both the connectivity card and exported diagnostics. Add the specific-interface label to every supported locale and cover the concrete-host case.

Harden the shared insecure-context clipboard fallback by keeping its temporary textarea read-only, cleaning it up on every exit path, and restoring keyboard focus. Add focused success and failure cleanup tests to PR validation.

Validated with root typechecks, the UI production build, six focused tests, locale parity checks, and git diff --check.
---
 .github/workflows/pr-build.yml                |  1 +
 .../info-settings-diagnostics.test.ts         | 13 ++++
 .../settings/info-settings-diagnostics.ts     | 21 ++++--
 .../settings/info-settings-section.tsx        | 12 ++--
 packages/ui/src/lib/clipboard.test.ts         | 71 +++++++++++++++++++
 packages/ui/src/lib/clipboard.ts              | 20 ++++--
 .../ui/src/lib/i18n/messages/de/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/en/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/es/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/fr/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/he/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/ja/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/ne/settings.ts   |  1 +
 .../ui/src/lib/i18n/messages/ru/settings.ts   |  1 +
 .../src/lib/i18n/messages/zh-Hans/settings.ts |  1 +
 15 files changed, 135 insertions(+), 12 deletions(-)
 create mode 100644 packages/ui/src/lib/clipboard.test.ts

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 86f5d91ba..0bd62a781 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -110,6 +110,7 @@ jobs:
           packages/ui/src/lib/hooks/use-app-session-capture.test.ts
           packages/ui/src/lib/hooks/use-foreground-refresh.test.ts
           packages/ui/src/lib/launch-errors.test.ts
+          packages/ui/src/lib/clipboard.test.ts
           packages/ui/src/lib/message-selection-position.test.ts
           packages/ui/src/lib/server-meta.test.ts
           packages/ui/src/lib/trailing-resync.test.ts
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
index 8c4635f45..1bda26f43 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
@@ -52,4 +52,17 @@ describe("buildDiagnosticReport", () => {
     assert.match(report, /Remote URL: none/)
     assert.match(report, /Candidate addresses: 0/)
   })
+
+  it("identifies a specific interface and omits its unreachable loopback candidate", () => {
+    const report = buildDiagnosticReport(
+      { ...meta, host: "192.168.1.20", addresses: meta.addresses },
+      "Linux x86_64",
+      { host: "electron", platform: "desktop", windowContext: "local" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(report, /Listening mode: specific/)
+    assert.match(report, /Candidate addresses: 1/)
+    assert.doesNotMatch(report, /https:\/\/127\.0\.0\.1:9898/)
+  })
 })
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.ts b/packages/ui/src/components/settings/info-settings-diagnostics.ts
index 3657297c8..9880f27eb 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.ts
@@ -1,4 +1,4 @@
-import type { ServerMeta } from "../../../../server/src/api-types"
+import type { NetworkAddress, ServerMeta } from "../../../../server/src/api-types"
 
 export interface DiagnosticRuntime {
   host: string
@@ -6,12 +6,25 @@ export interface DiagnosticRuntime {
   windowContext: string
 }
 
+export type DiagnosticListeningMode = ServerMeta["listeningMode"] | "specific"
+
+export function getDiagnosticListeningMode(meta: ServerMeta): DiagnosticListeningMode {
+  if (meta.listeningMode === "all" && meta.host !== "0.0.0.0" && meta.host !== "::") return "specific"
+  return meta.listeningMode
+}
+
+export function getDiagnosticAddresses(meta: ServerMeta): NetworkAddress[] {
+  if (getDiagnosticListeningMode(meta) !== "specific") return meta.addresses
+  return meta.addresses.filter((address) => address.scope !== "loopback")
+}
+
 export function buildDiagnosticReport(
   meta: ServerMeta | null,
   osDisplay: string,
   runtime: DiagnosticRuntime,
   generatedAt = new Date(),
 ): string {
+  const addresses = meta ? getDiagnosticAddresses(meta) : []
   const lines = [
     "CodeNomad Diagnostic Report",
     "============================",
@@ -22,17 +35,17 @@ export function buildDiagnosticReport(
     `Platform: ${runtime.platform}`,
     `Window context: ${runtime.windowContext}`,
     `OS: ${osDisplay}`,
-    `Listening mode: ${meta?.listeningMode ?? "unknown"}`,
+    `Listening mode: ${meta ? getDiagnosticListeningMode(meta) : "unknown"}`,
     `Bind host: ${meta?.host ?? "unknown"}`,
     `Local URL: ${meta?.localUrl ?? "unknown"}`,
     `Local port: ${meta?.localPort ?? "unknown"}`,
     `Remote URL: ${meta?.remoteUrl ?? "none"}`,
     `Remote port: ${meta?.remotePort ?? "none"}`,
     `Workspace root: ${meta?.workspaceRoot ?? "unknown"}`,
-    `Candidate addresses: ${meta?.addresses.length ?? 0}`,
+    `Candidate addresses: ${addresses.length}`,
   ]
 
-  for (const address of meta?.addresses ?? []) {
+  for (const address of addresses) {
     lines.push(`- ${address.family}/${address.scope}: ${address.remoteUrl}`)
   }
 
diff --git a/packages/ui/src/components/settings/info-settings-section.tsx b/packages/ui/src/components/settings/info-settings-section.tsx
index fa22a4e8c..08197ebd2 100644
--- a/packages/ui/src/components/settings/info-settings-section.tsx
+++ b/packages/ui/src/components/settings/info-settings-section.tsx
@@ -5,7 +5,7 @@ import { useI18n } from "../../lib/i18n"
 import { getServerMeta } from "../../lib/server-meta"
 import { canOpenRemoteWindows, runtimeEnv } from "../../lib/runtime-env"
 import { openSettings } from "../../stores/settings-screen"
-import { buildDiagnosticReport } from "./info-settings-diagnostics"
+import { buildDiagnosticReport, getDiagnosticAddresses, getDiagnosticListeningMode } from "./info-settings-diagnostics"
 
 interface UserAgentData {
   platform?: string
@@ -251,7 +251,11 @@ export const InfoSettingsSection: Component = () => {
                 <div class="settings-info-row">
                   <dt class="settings-info-label">{t("remoteAccess.sections.listeningMode.label")}</dt>
                   <dd class="settings-info-value">
-                    {t(serverMeta().listeningMode === "all" ? "settings.info.connectivity.mode.all" : "settings.info.connectivity.mode.local")}
+                    {t(getDiagnosticListeningMode(serverMeta()) === "specific"
+                      ? "settings.info.connectivity.mode.specific"
+                      : getDiagnosticListeningMode(serverMeta()) === "all"
+                        ? "settings.info.connectivity.mode.all"
+                        : "settings.info.connectivity.mode.local")}
                   </dd>
                 </div>
                 <div class="settings-info-row">
@@ -277,9 +281,9 @@ export const InfoSettingsSection: Component = () => {
               </dl>
 
               <h4 class="settings-card-title">{t("remoteAccess.sections.addresses.label")}</h4>
-              <Show when={serverMeta().addresses.length > 0} fallback={<div class="settings-card-message">{t("remoteAccess.addresses.none")}</div>}>
+              <Show when={getDiagnosticAddresses(serverMeta()).length > 0} fallback={<div class="settings-card-message">{t("remoteAccess.addresses.none")}</div>}>
                 <dl class="settings-info-grid">
-                  <For each={serverMeta().addresses}>{(address) => (
+                  <For each={getDiagnosticAddresses(serverMeta())}>{(address) => (
                     <div class="settings-info-row">
                       <dt class="settings-info-label">
                         {address.family.toUpperCase()} · {t(address.scope === "external"
diff --git a/packages/ui/src/lib/clipboard.test.ts b/packages/ui/src/lib/clipboard.test.ts
new file mode 100644
index 000000000..159b3a7b4
--- /dev/null
+++ b/packages/ui/src/lib/clipboard.test.ts
@@ -0,0 +1,71 @@
+import assert from "node:assert/strict"
+import { describe, it } from "node:test"
+
+import { copyToClipboard } from "./clipboard"
+
+describe("copyToClipboard fallback", () => {
+  it("restores focus and removes its temporary textarea", async () => {
+    const state = installClipboardFallbackDom(() => true)
+    try {
+      assert.equal(await copyToClipboard("diagnostics"), true)
+      assert.equal(state.textArea.readOnly, true)
+      assert.equal(state.removed(), true)
+      assert.equal(state.focusRestored(), true)
+    } finally {
+      state.restore()
+    }
+  })
+
+  it("cleans up when the fallback copy throws", async () => {
+    const state = installClipboardFallbackDom(() => {
+      throw new Error("copy failed")
+    })
+    try {
+      assert.equal(await copyToClipboard("diagnostics"), false)
+      assert.equal(state.removed(), true)
+      assert.equal(state.focusRestored(), true)
+    } finally {
+      state.restore()
+    }
+  })
+})
+
+function installClipboardFallbackDom(execCommand: () => boolean) {
+  const navigatorDescriptor = Object.getOwnPropertyDescriptor(globalThis, "navigator")
+  const documentDescriptor = Object.getOwnPropertyDescriptor(globalThis, "document")
+  let removed = false
+  let focusRestored = false
+  const textArea = {
+    value: "",
+    readOnly: false,
+    style: {} as CSSStyleDeclaration,
+    focus() {},
+    select() {},
+    remove() { removed = true },
+  }
+  const activeElement = { focus() { focusRestored = true } }
+  const documentMock = {
+    activeElement,
+    createElement: () => textArea,
+    body: { appendChild() {} },
+    execCommand,
+  }
+
+  Object.defineProperty(globalThis, "navigator", { configurable: true, value: {} })
+  Object.defineProperty(globalThis, "document", { configurable: true, value: documentMock })
+
+  return {
+    textArea,
+    removed: () => removed,
+    focusRestored: () => focusRestored,
+    restore() {
+      restoreGlobal("navigator", navigatorDescriptor)
+      restoreGlobal("document", documentDescriptor)
+    },
+  }
+}
+
+function restoreGlobal(name: "navigator" | "document", descriptor?: PropertyDescriptor) {
+  if (descriptor) Object.defineProperty(globalThis, name, descriptor)
+  else Reflect.deleteProperty(globalThis, name)
+}
diff --git a/packages/ui/src/lib/clipboard.ts b/packages/ui/src/lib/clipboard.ts
index 4fbd4b745..61defe99c 100644
--- a/packages/ui/src/lib/clipboard.ts
+++ b/packages/ui/src/lib/clipboard.ts
@@ -26,6 +26,8 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   }
 
   // Fallback for non-secure contexts (HTTP) using document.execCommand
+  let textArea: HTMLTextAreaElement | undefined
+  const activeElement = typeof document !== "undefined" ? document.activeElement as HTMLElement | null : null
   try {
     if (typeof document === "undefined") {
       log.error("Document not available for clipboard fallback")
@@ -33,8 +35,9 @@ export async function copyToClipboard(text: string): Promise<boolean> {
     }
 
     // Create temporary textarea element
-    const textArea = document.createElement("textarea")
+    textArea = document.createElement("textarea")
     textArea.value = text
+    textArea.readOnly = true
     textArea.style.position = "fixed"
     textArea.style.left = "-9999px"
     textArea.style.top = "-9999px"
@@ -45,8 +48,6 @@ export async function copyToClipboard(text: string): Promise<boolean> {
     textArea.select()
 
     const success = document.execCommand("copy")
-    document.body.removeChild(textArea)
-
     if (success) {
       log.info("Copied text using execCommand fallback")
       return true
@@ -57,5 +58,16 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   } catch (error) {
     log.error("Clipboard fallback failed:", error)
     return false
+  } finally {
+    try {
+      textArea?.remove()
+    } catch (error) {
+      log.warn("Failed to remove clipboard fallback element:", error)
+    }
+    try {
+      activeElement?.focus()
+    } catch (error) {
+      log.warn("Failed to restore focus after clipboard fallback:", error)
+    }
   }
-}
\ No newline at end of file
+}
diff --git a/packages/ui/src/lib/i18n/messages/de/settings.ts b/packages/ui/src/lib/i18n/messages/de/settings.ts
index f2a81c037..2f5425fed 100644
--- a/packages/ui/src/lib/i18n/messages/de/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/de/settings.ts
@@ -467,6 +467,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "Prüfen Sie die tatsächlich verwendete Listener-Konfiguration und mögliche Netzwerkadressen.",
   "settings.info.connectivity.mode.local": "Nur lokal",
   "settings.info.connectivity.mode.all": "Alle Netzwerkschnittstellen",
+  "settings.info.connectivity.mode.specific": "Bestimmte Netzwerkschnittstelle",
   "settings.info.connectivity.host": "Bind-Adresse",
   "settings.info.connectivity.localListener": "Lokaler Listener",
   "settings.info.connectivity.remoteListener": "Remote-Listener",
diff --git a/packages/ui/src/lib/i18n/messages/en/settings.ts b/packages/ui/src/lib/i18n/messages/en/settings.ts
index 22d32af37..07b825d6f 100644
--- a/packages/ui/src/lib/i18n/messages/en/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/en/settings.ts
@@ -469,6 +469,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "Inspect the effective listener configuration and candidate network addresses.",
   "settings.info.connectivity.mode.local": "Local only",
   "settings.info.connectivity.mode.all": "All network interfaces",
+  "settings.info.connectivity.mode.specific": "Specific network interface",
   "settings.info.connectivity.host": "Bind host",
   "settings.info.connectivity.localListener": "Local listener",
   "settings.info.connectivity.remoteListener": "Remote listener",
diff --git a/packages/ui/src/lib/i18n/messages/es/settings.ts b/packages/ui/src/lib/i18n/messages/es/settings.ts
index 3aa2f220c..f6d2d3254 100644
--- a/packages/ui/src/lib/i18n/messages/es/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/es/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "Consulta la configuración de escucha en uso y las posibles direcciones de red.",
   "settings.info.connectivity.mode.local": "Solo local",
   "settings.info.connectivity.mode.all": "Todas las interfaces de red",
+  "settings.info.connectivity.mode.specific": "Interfaz de red específica",
   "settings.info.connectivity.host": "Host de escucha",
   "settings.info.connectivity.localListener": "Punto de escucha local",
   "settings.info.connectivity.remoteListener": "Punto de escucha remoto",
diff --git a/packages/ui/src/lib/i18n/messages/fr/settings.ts b/packages/ui/src/lib/i18n/messages/fr/settings.ts
index 03426ccfe..50a225cff 100644
--- a/packages/ui/src/lib/i18n/messages/fr/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/fr/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "Consultez la configuration d’écoute actuellement utilisée et les adresses réseau possibles.",
   "settings.info.connectivity.mode.local": "Local uniquement",
   "settings.info.connectivity.mode.all": "Toutes les interfaces réseau",
+  "settings.info.connectivity.mode.specific": "Interface réseau spécifique",
   "settings.info.connectivity.host": "Hôte d’écoute",
   "settings.info.connectivity.localListener": "Point d’écoute local",
   "settings.info.connectivity.remoteListener": "Point d’écoute distant",
diff --git a/packages/ui/src/lib/i18n/messages/he/settings.ts b/packages/ui/src/lib/i18n/messages/he/settings.ts
index 3443b699a..f368b5f1a 100644
--- a/packages/ui/src/lib/i18n/messages/he/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/he/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "בדיקת תצורת ההאזנה הפעילה וכתובות רשת אפשריות.",
   "settings.info.connectivity.mode.local": "מקומי בלבד",
   "settings.info.connectivity.mode.all": "כל ממשקי הרשת",
+  "settings.info.connectivity.mode.specific": "ממשק רשת מסוים",
   "settings.info.connectivity.host": "כתובת האזנה",
   "settings.info.connectivity.localListener": "מאזין מקומי",
   "settings.info.connectivity.remoteListener": "מאזין מרוחק",
diff --git a/packages/ui/src/lib/i18n/messages/ja/settings.ts b/packages/ui/src/lib/i18n/messages/ja/settings.ts
index 67af9bdec..fc1d77176 100644
--- a/packages/ui/src/lib/i18n/messages/ja/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ja/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "有効なリスナー設定と候補のネットワークアドレスを確認します。",
   "settings.info.connectivity.mode.local": "ローカルのみ",
   "settings.info.connectivity.mode.all": "すべてのネットワークインターフェース",
+  "settings.info.connectivity.mode.specific": "特定のネットワークインターフェース",
   "settings.info.connectivity.host": "バインドホスト",
   "settings.info.connectivity.localListener": "ローカルリスナー",
   "settings.info.connectivity.remoteListener": "リモートリスナー",
diff --git a/packages/ui/src/lib/i18n/messages/ne/settings.ts b/packages/ui/src/lib/i18n/messages/ne/settings.ts
index 2931206e2..85f5707e8 100644
--- a/packages/ui/src/lib/i18n/messages/ne/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ne/settings.ts
@@ -467,6 +467,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "वास्तवमा लागू भएको लिस्नर कन्फिगरेसन र सम्भावित नेटवर्क ठेगानाहरू हेर्नुहोस्।",
   "settings.info.connectivity.mode.local": "स्थानीय मात्र",
   "settings.info.connectivity.mode.all": "सबै नेटवर्क इन्टरफेसहरू",
+  "settings.info.connectivity.mode.specific": "विशिष्ट नेटवर्क इन्टरफेस",
   "settings.info.connectivity.host": "बाइन्ड होस्ट",
   "settings.info.connectivity.localListener": "स्थानीय लिस्नर",
   "settings.info.connectivity.remoteListener": "रिमोट लिस्नर",
diff --git a/packages/ui/src/lib/i18n/messages/ru/settings.ts b/packages/ui/src/lib/i18n/messages/ru/settings.ts
index 13f073150..e30708265 100644
--- a/packages/ui/src/lib/i18n/messages/ru/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ru/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "Просмотрите фактическую конфигурацию прослушивания и возможные сетевые адреса.",
   "settings.info.connectivity.mode.local": "Только локально",
   "settings.info.connectivity.mode.all": "Все сетевые интерфейсы",
+  "settings.info.connectivity.mode.specific": "Определённый сетевой интерфейс",
   "settings.info.connectivity.host": "Адрес привязки",
   "settings.info.connectivity.localListener": "Локальная точка подключения",
   "settings.info.connectivity.remoteListener": "Удалённая точка подключения",
diff --git a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
index 25a429610..21e956f45 100644
--- a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
@@ -468,6 +468,7 @@ export const settingsMessages = {
   "settings.info.connectivity.subtitle": "查看实际生效的监听配置和候选网络地址。",
   "settings.info.connectivity.mode.local": "仅本机",
   "settings.info.connectivity.mode.all": "所有网络接口",
+  "settings.info.connectivity.mode.specific": "指定网络接口",
   "settings.info.connectivity.host": "绑定主机",
   "settings.info.connectivity.localListener": "本地监听地址",
   "settings.info.connectivity.remoteListener": "远程监听地址",

From 1c4aa7e9fa2a9d1bfbc1c54228248f0cb2f19111 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Andr=C3=A9?= <pascalandr@gmail.com>
Date: Mon, 10 Aug 2026 14:31:49 +0200
Subject: [PATCH 3/5] fix(server): report concrete and IPv6 listeners
 accurately

Centralize wildcard, loopback, and URL-host handling so concrete loopback bindings advertise only the address that is actually listening. Preserve exact loopback hosts for plugin URLs and make HTTPS respect the configured host rather than silently rebinding to 127.0.0.1.

Add IPv6 interface enumeration and bracketed URL generation for compact, expanded wildcard, loopback, and concrete addresses. Generated certificates now treat IPv6 values as IP SANs, while metadata, CORS, and UI diagnostics share consistent listener semantics.

Cover host classification, concrete candidates, IPv6 wildcard enumeration, plugin URLs, certificate SANs, and defensive UI filtering. Server/UI typechecks, the UI build, 26 focused tests, and git diff checks pass; the full local server suite has one unrelated default-branch assertion failure in git-worktrees.test.ts.
---
 packages/server/src/index.ts                  | 30 +++++------
 .../__tests__/listener-base-url.test.ts       | 29 ++++++++++
 .../__tests__/network-addresses.test.ts       | 34 ++++++++++++
 .../src/server/__tests__/network-host.test.ts | 27 ++++++++++
 .../src/server/__tests__/tls-ipv6.test.ts     | 23 ++++++++
 packages/server/src/server/http-server.ts     |  7 ++-
 .../server/src/server/listener-base-url.ts    | 13 +++--
 .../server/src/server/network-addresses.ts    | 54 +++++--------------
 packages/server/src/server/network-host.ts    | 31 +++++++++++
 packages/server/src/server/routes/meta.ts     |  7 +--
 packages/server/src/server/tls.ts             | 32 +++++------
 .../info-settings-diagnostics.test.ts         | 52 ++++++++++++++++++
 .../settings/info-settings-diagnostics.ts     | 19 +++++--
 13 files changed, 265 insertions(+), 93 deletions(-)
 create mode 100644 packages/server/src/server/__tests__/network-host.test.ts
 create mode 100644 packages/server/src/server/__tests__/tls-ipv6.test.ts
 create mode 100644 packages/server/src/server/network-host.ts

diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index 3993ed7a6..887a40800 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -24,6 +24,7 @@ import { resolveHttpsOptions } from "./server/tls"
 import { RemoteProxySessionManager } from "./server/remote-proxy"
 import { resolveNetworkAddresses, resolveRemoteAddresses } from "./server/network-addresses"
 import { resolvePluginBaseUrl } from "./server/listener-base-url"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./server/network-host"
 import { startDevReleaseMonitor } from "./releases/dev-release-monitor"
 import { SpeechService } from "./speech/service"
 import { SideCarManager } from "./sidecars/manager"
@@ -310,8 +311,6 @@ async function main() {
 
   const eventBus = new EventBus(eventLogger)
 
-  const isLoopbackHost = (host: string) => host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
-
   const configLocation = resolveConfigLocation(options.configPath)
   const configDir = configLocation.baseDir
 
@@ -447,8 +446,6 @@ async function main() {
       })
     : null
 
-  const remoteAccessEnabled = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
-
   const clientConnectionManager = new ClientConnectionManager(logger.child({ component: "client-connections" }))
   const pluginChannel = new PluginChannelManager(logger.child({ component: "plugin-channel" }))
   const remoteProxySessionManager = new RemoteProxySessionManager({
@@ -469,10 +466,9 @@ async function main() {
   const httpBindPort = httpPortExplicit ? options.httpPort : 0
 
   // Listener binding rules:
-  // - Remote access enabled: HTTP listens on loopback, HTTPS on all IPs (host=0.0.0.0 / LAN IP).
-  // - Remote access disabled: both listen on loopback.
-  // - HTTP-only mode: respect --host (used for dev/testing).
-  const httpsBindHost = remoteAccessEnabled ? options.host : "127.0.0.1"
+  // - HTTP listens on loopback when HTTPS is also enabled.
+  // - HTTPS and HTTP-only modes respect --host.
+  const httpsBindHost = options.host
   const httpBindHost = options.http ? (options.https ? "127.0.0.1" : options.host) : "127.0.0.1"
 
   const servers: Array<ReturnType<typeof createHttpServer>> = []
@@ -553,19 +549,17 @@ async function main() {
   let remoteUrl: string | undefined
   let remoteAddresses = [] as ReturnType<typeof resolveNetworkAddresses>
   if (remoteStart) {
-    const wantsAll = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
     let remoteHost = options.host
-    if (wantsAll) {
-      if (options.host === "0.0.0.0") {
-        const resolved = resolveRemoteAddresses({ host: options.host, protocol: remoteProtocol, port: remoteStart.port })
-        remoteAddresses = resolved.userVisible
-        remoteUrl = resolved.primaryRemoteUrl ?? `${remoteProtocol}://localhost:${remoteStart.port}`
-      }
-    } else {
+    if (isWildcardHost(options.host)) {
+      const resolved = resolveRemoteAddresses({ host: options.host, protocol: remoteProtocol, port: remoteStart.port })
+      remoteAddresses = resolved.userVisible
+      const loopbackHost = options.host === "0.0.0.0" ? "127.0.0.1" : "::1"
+      remoteUrl = resolved.primaryRemoteUrl ?? `${remoteProtocol}://${formatHostForUrl(loopbackHost)}:${remoteStart.port}`
+    } else if (options.host === "127.0.0.1") {
       remoteHost = "localhost"
     }
     if (!remoteUrl) {
-      remoteUrl = `${remoteProtocol}://${remoteHost}:${remoteStart.port}`
+      remoteUrl = `${remoteProtocol}://${formatHostForUrl(remoteHost)}:${remoteStart.port}`
     }
   }
 
@@ -583,7 +577,7 @@ async function main() {
   serverMeta.remoteUrl = remoteUrl
   serverMeta.remotePort = remoteStart?.port
   serverMeta.host = options.host
-  serverMeta.listeningMode = options.host === "0.0.0.0" || !isLoopbackHost(options.host) ? "all" : "local"
+  serverMeta.listeningMode = isWildcardHost(options.host) || !isLoopbackHost(options.host) ? "all" : "local"
 
   if (serverMeta.remotePort && remoteUrl) {
     serverMeta.addresses = remoteAddresses.length
diff --git a/packages/server/src/server/__tests__/listener-base-url.test.ts b/packages/server/src/server/__tests__/listener-base-url.test.ts
index f742e68e6..191b30cec 100644
--- a/packages/server/src/server/__tests__/listener-base-url.test.ts
+++ b/packages/server/src/server/__tests__/listener-base-url.test.ts
@@ -44,4 +44,33 @@ describe("resolvePluginBaseUrl", () => {
       "http://127.0.0.1:9899",
     )
   })
+
+  it("uses the exact concrete loopback bind host", () => {
+    assert.equal(
+      resolvePluginBaseUrl({
+        httpsStart: { protocol: "https", bindHost: "127.0.0.2", port: 9898 },
+        remoteUrl: "https://127.0.0.2:9898",
+      }),
+      "https://127.0.0.2:9898",
+    )
+  })
+
+  it("uses bracketed IPv6 loopback for IPv6 wildcard listeners", () => {
+    assert.equal(
+      resolvePluginBaseUrl({
+        httpsStart: { protocol: "https", bindHost: "0:0:0:0:0:0:0:0", port: 9898 },
+        remoteUrl: "https://[2001:db8::20]:9898",
+      }),
+      "https://[::1]:9898",
+    )
+  })
+
+  it("formats concrete IPv6 fallback listeners", () => {
+    assert.equal(
+      resolvePluginBaseUrl({
+        httpsStart: { protocol: "https", bindHost: "2001:db8::20", port: 9898 },
+      }),
+      "https://[2001:db8::20]:9898",
+    )
+  })
 })
diff --git a/packages/server/src/server/__tests__/network-addresses.test.ts b/packages/server/src/server/__tests__/network-addresses.test.ts
index a6d477670..d388701af 100644
--- a/packages/server/src/server/__tests__/network-addresses.test.ts
+++ b/packages/server/src/server/__tests__/network-addresses.test.ts
@@ -23,6 +23,40 @@ describe("resolveNetworkAddresses", () => {
       )
     })
   })
+
+  it("advertises only a concrete IPv4 bind host", () => {
+    const result = resolveNetworkAddresses({ host: "127.0.0.2", protocol: "https", port: 9898 })
+
+    assert.deepEqual(result, [
+      { ip: "127.0.0.2", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.2:9898" },
+    ])
+  })
+
+  it("formats concrete IPv6 bind hosts as valid URLs", () => {
+    const result = resolveNetworkAddresses({ host: "::1", protocol: "https", port: 9898 })
+
+    assert.deepEqual(result, [
+      { ip: "::1", family: "ipv6", scope: "loopback", remoteUrl: "https://[::1]:9898" },
+    ])
+  })
+
+  it("enumerates matching IPv6 interfaces for compact and expanded wildcards", () => {
+    const addresses = [
+      { address: "2001:db8::20", family: "IPv6", internal: false },
+      { address: "::1", family: 6, internal: true },
+      { address: "192.168.1.20", family: "IPv4", internal: false },
+    ]
+
+    usingMockedNetworkInterfaces(addresses, () => {
+      for (const host of ["::", "0:0:0:0:0:0:0:0"]) {
+        const result = resolveNetworkAddresses({ host, protocol: "https", port: 9898 })
+        assert.deepEqual(result, [
+          { ip: "2001:db8::20", family: "ipv6", scope: "external", remoteUrl: "https://[2001:db8::20]:9898" },
+          { ip: "::1", family: "ipv6", scope: "loopback", remoteUrl: "https://[::1]:9898" },
+        ])
+      }
+    })
+  })
 })
 
 describe("resolveRemoteAddresses", () => {
diff --git a/packages/server/src/server/__tests__/network-host.test.ts b/packages/server/src/server/__tests__/network-host.test.ts
new file mode 100644
index 000000000..c9610e392
--- /dev/null
+++ b/packages/server/src/server/__tests__/network-host.test.ts
@@ -0,0 +1,27 @@
+import assert from "node:assert/strict"
+import { describe, it } from "node:test"
+
+import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "../network-host"
+
+describe("network host helpers", () => {
+  it("recognizes IPv4 and IPv6 wildcard forms", () => {
+    assert.equal(isWildcardHost("0.0.0.0"), true)
+    assert.equal(isWildcardHost("::"), true)
+    assert.equal(isWildcardHost("0:0:0:0:0:0:0:0"), true)
+    assert.equal(isWildcardHost("::1"), false)
+  })
+
+  it("recognizes concrete IPv4 and IPv6 loopback forms", () => {
+    assert.equal(isLoopbackHost("localhost"), true)
+    assert.equal(isLoopbackHost("127.0.0.2"), true)
+    assert.equal(isLoopbackHost("::1"), true)
+    assert.equal(isLoopbackHost("0:0:0:0:0:0:0:1"), true)
+    assert.equal(isLoopbackHost("2001:db8::1"), false)
+  })
+
+  it("brackets IPv6 literals for URLs", () => {
+    assert.equal(formatHostForUrl("192.168.1.20"), "192.168.1.20")
+    assert.equal(formatHostForUrl("::1"), "[::1]")
+    assert.equal(formatHostForUrl("[2001:db8::20]"), "[2001:db8::20]")
+  })
+})
diff --git a/packages/server/src/server/__tests__/tls-ipv6.test.ts b/packages/server/src/server/__tests__/tls-ipv6.test.ts
new file mode 100644
index 000000000..e094de676
--- /dev/null
+++ b/packages/server/src/server/__tests__/tls-ipv6.test.ts
@@ -0,0 +1,23 @@
+import assert from "node:assert/strict"
+import crypto from "node:crypto"
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { it } from "node:test"
+
+import type { Logger } from "../../logger"
+import { resolveHttpsOptions } from "../tls"
+
+it("generates a certificate with a concrete IPv6 address SAN", () => {
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "codenomad-tls-ipv6-"))
+  const logger = { info() {}, warn() {}, error() {}, child() { return logger } } as unknown as Logger
+
+  try {
+    const resolved = resolveHttpsOptions({ enabled: true, configDir, host: "2001:db8::20", logger })
+    assert.ok(resolved)
+    const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert)
+    assert.match(certificate.subjectAltName ?? "", /IP Address:2001:DB8:0:0:0:0:0:20/i)
+  } finally {
+    fs.rmSync(configDir, { recursive: true, force: true })
+  }
+})
diff --git a/packages/server/src/server/http-server.ts b/packages/server/src/server/http-server.ts
index 44e855b27..8ada497b4 100644
--- a/packages/server/src/server/http-server.ts
+++ b/packages/server/src/server/http-server.ts
@@ -47,6 +47,7 @@ import type { SideCarManager } from "../sidecars/manager"
 import type { PreviewManager } from "../previews/manager"
 import type { RemoteProxySessionManager } from "./remote-proxy"
 import { createOpenCodeUpdateService } from "../opencode-update/service"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./network-host"
 
 interface HttpServerDeps {
   bindHost: string
@@ -137,8 +138,6 @@ export function createHttpServer(deps: HttpServerDeps) {
   })
 
   const allowedDevOrigins = new Set(["http://localhost:3000", "http://127.0.0.1:3000"])
-  const isLoopbackHost = (host: string) => host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
-
   const getSelfOrigins = (): Set<string> => {
     const origins = new Set<string>()
     const candidates: Array<string | undefined> = [deps.serverMeta.localUrl, deps.serverMeta.remoteUrl]
@@ -179,7 +178,7 @@ export function createHttpServer(deps: HttpServerDeps) {
        }
 
        // When we bind to a non-loopback host (e.g., 0.0.0.0 or LAN IP), allow cross-origin UI access.
-       if (deps.bindHost === "0.0.0.0" || !isLoopbackHost(deps.bindHost)) {
+       if (isWildcardHost(deps.bindHost) || !isLoopbackHost(deps.bindHost)) {
          cb(null, true)
          return
        }
@@ -380,7 +379,7 @@ export function createHttpServer(deps: HttpServerDeps) {
         }
       }
 
-      const displayHost = deps.bindHost === "127.0.0.1" ? "localhost" : deps.bindHost
+      const displayHost = deps.bindHost === "127.0.0.1" ? "localhost" : formatHostForUrl(deps.bindHost)
       const serverUrl = `${deps.protocol}://${displayHost}:${actualPort}`
 
       deps.logger.info({ port: actualPort, host: deps.bindHost, protocol: deps.protocol }, "HTTP server listening")
diff --git a/packages/server/src/server/listener-base-url.ts b/packages/server/src/server/listener-base-url.ts
index 6e68b0a01..b7c1ff497 100644
--- a/packages/server/src/server/listener-base-url.ts
+++ b/packages/server/src/server/listener-base-url.ts
@@ -1,3 +1,6 @@
+import { isIP } from "node:net"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, stripHostBrackets } from "./network-host"
+
 export interface StartedListenerBaseUrlInput {
   protocol: "http" | "https"
   bindHost: string
@@ -13,7 +16,11 @@ export interface ResolvePluginBaseUrlInput {
 export function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {
   const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))
   if (loopbackListener) {
-    return `${loopbackListener.protocol}://127.0.0.1:${loopbackListener.port}`
+    const bindHost = stripHostBrackets(loopbackListener.bindHost)
+    const loopbackHost = isWildcardHost(bindHost)
+      ? isIP(bindHost) === 6 ? "::1" : "127.0.0.1"
+      : bindHost
+    return `${loopbackListener.protocol}://${formatHostForUrl(loopbackHost)}:${loopbackListener.port}`
   }
 
   if (input.remoteUrl) {
@@ -25,9 +32,9 @@ export function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {
     throw new Error("No listeners started")
   }
 
-  return `${fallbackListener.protocol}://${fallbackListener.bindHost}:${fallbackListener.port}`
+  return `${fallbackListener.protocol}://${formatHostForUrl(fallbackListener.bindHost)}:${fallbackListener.port}`
 }
 
 function acceptsLoopback(bindHost: string): boolean {
-  return bindHost === "0.0.0.0" || bindHost === "::" || bindHost === "localhost" || bindHost === "::1" || bindHost.startsWith("127.")
+  return bindHost === "localhost" || isWildcardHost(bindHost) || isLoopbackHost(bindHost)
 }
diff --git a/packages/server/src/server/network-addresses.ts b/packages/server/src/server/network-addresses.ts
index 8491fc82a..d29f1876e 100644
--- a/packages/server/src/server/network-addresses.ts
+++ b/packages/server/src/server/network-addresses.ts
@@ -1,5 +1,7 @@
 import os from "os"
+import { isIP } from "node:net"
 import type { NetworkAddress } from "../api-types"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./network-host"
 
 export interface ResolvedRemoteAddresses {
   all: NetworkAddress[]
@@ -18,45 +20,27 @@ export function resolveNetworkAddresses(args: {
   const results: NetworkAddress[] = []
 
   const addAddress = (ip: string, scope: NetworkAddress["scope"]) => {
-    if (!ip || ip === "0.0.0.0") return
-    const key = `ipv4-${ip}`
+    const ipVersion = isIP(ip)
+    if (!ipVersion || isWildcardHost(ip)) return
+    const family = ipVersion === 6 ? "ipv6" : "ipv4"
+    const key = `${family}-${ip.toLowerCase()}`
     if (seen.has(key)) return
     seen.add(key)
-    results.push({ ip, family: "ipv4", scope, remoteUrl: `${protocol}://${ip}:${port}` })
+    results.push({ ip, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(ip)}:${port}` })
   }
 
-  const normalizeFamily = (value: string | number) => {
-    if (typeof value === "string") {
-      const lowered = value.toLowerCase()
-      if (lowered === "ipv4") {
-        return "ipv4" as const
-      }
-    }
-    if (value === 4) return "ipv4" as const
-    return null
-  }
-
-  if (host === "0.0.0.0") {
-    // Enumerate system interfaces (IPv4 only)
+  if (isWildcardHost(host)) {
+    const wildcardVersion = isIP(host)
     for (const entries of Object.values(interfaces)) {
       if (!entries) continue
       for (const entry of entries) {
-        const family = normalizeFamily(entry.family)
-        if (!family) continue
-        if (!entry.address || entry.address === "0.0.0.0") continue
+        if (isIP(entry.address) !== wildcardVersion) continue
         const scope: NetworkAddress["scope"] = entry.internal ? "loopback" : "external"
         addAddress(entry.address, scope)
       }
     }
-  }
-
-  // Always include loopback address
-  addAddress("127.0.0.1", "loopback")
-
-  // Include explicitly configured host if it was IPv4
-  if (isIPv4Address(host) && host !== "0.0.0.0") {
-    const isLoopback = host.startsWith("127.")
-    addAddress(host, isLoopback ? "loopback" : "external")
+  } else if (isIP(host)) {
+    addAddress(host, isLoopbackHost(host) ? "loopback" : "external")
   }
 
   const scopeWeight: Record<NetworkAddress["scope"], number> = { external: 0, internal: 1, loopback: 2 }
@@ -111,18 +95,6 @@ function isPrivateIPv4(ip: string): boolean {
 }
 
 function parseIPv4(value: string): number[] | null {
-  if (!isIPv4Address(value)) return null
+  if (isIP(value) !== 4) return null
   return value.split(".").map((part) => Number(part))
 }
-
-function isIPv4Address(value: string | undefined): value is string {
-  if (!value) return false
-  const parts = value.split(".")
-  if (parts.length !== 4) return false
-  return parts.every((part) => {
-    if (part.length === 0 || part.length > 3) return false
-    if (!/^[0-9]+$/.test(part)) return false
-    const num = Number(part)
-    return Number.isInteger(num) && num >= 0 && num <= 255
-  })
-}
diff --git a/packages/server/src/server/network-host.ts b/packages/server/src/server/network-host.ts
new file mode 100644
index 000000000..767344c91
--- /dev/null
+++ b/packages/server/src/server/network-host.ts
@@ -0,0 +1,31 @@
+import { isIP } from "node:net"
+
+export function stripHostBrackets(host: string): string {
+  const trimmed = host.trim()
+  return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed
+}
+
+export function isWildcardHost(host: string): boolean {
+  const value = stripHostBrackets(host).toLowerCase()
+  if (value === "0.0.0.0") return true
+  return isIP(value) === 6 && value.split(":").every((segment) => segment === "" || /^0+$/.test(segment))
+}
+
+export function isLoopbackHost(host: string): boolean {
+  const value = stripHostBrackets(host).toLowerCase()
+  if (value === "localhost") return true
+  if (isIP(value) === 4) return value.startsWith("127.")
+  if (isIP(value) !== 6) return false
+
+  const mappedIpv4 = value.match(/(?:^|:)ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1]
+  if (mappedIpv4) return isLoopbackHost(mappedIpv4)
+
+  const segments = value.split(":")
+  const last = segments.pop()
+  return last === "1" && segments.every((segment) => segment === "" || /^0+$/.test(segment))
+}
+
+export function formatHostForUrl(host: string): string {
+  const value = stripHostBrackets(host)
+  return isIP(value) === 6 ? `[${value}]` : value
+}
diff --git a/packages/server/src/server/routes/meta.ts b/packages/server/src/server/routes/meta.ts
index 65adda5f4..e65405172 100644
--- a/packages/server/src/server/routes/meta.ts
+++ b/packages/server/src/server/routes/meta.ts
@@ -1,5 +1,6 @@
 import { FastifyInstance } from "fastify"
 import { ServerMeta } from "../../api-types"
+import { isLoopbackHost, isWildcardHost } from "../network-host"
  
 
 interface RouteDeps {
@@ -18,7 +19,7 @@ function buildMetaResponse(meta: ServerMeta): ServerMeta {
     ...meta,
     localPort,
     remotePort: remote?.port,
-    listeningMode: meta.host === "0.0.0.0" || !isLoopbackHost(meta.host) ? "all" : "local",
+    listeningMode: isWildcardHost(meta.host) || !isLoopbackHost(meta.host) ? "all" : "local",
   }
 }
 
@@ -49,8 +50,4 @@ function resolveRemote(meta: ServerMeta): { protocol: "http" | "https"; port: nu
   }
 }
 
-function isLoopbackHost(host: string): boolean {
-  return host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
-}
-
 // NetworkAddress shape is resolved in ../network-addresses
diff --git a/packages/server/src/server/tls.ts b/packages/server/src/server/tls.ts
index 3a8661b04..7188003b0 100644
--- a/packages/server/src/server/tls.ts
+++ b/packages/server/src/server/tls.ts
@@ -2,7 +2,9 @@ import crypto from "crypto"
 import fs from "fs"
 import path from "path"
 import { createRequire } from "module"
+import { isIP } from "node:net"
 import type { Logger } from "../logger"
+import { isWildcardHost, stripHostBrackets } from "./network-host"
 
 const require = createRequire(import.meta.url)
 
@@ -219,7 +221,7 @@ function generateServerCertificate(args: {
 }
 
 function pickCommonName(host: string): string {
-  if (!host || host === "0.0.0.0") {
+  if (!host || isWildcardHost(host)) {
     return "localhost"
   }
   if (host === "127.0.0.1") {
@@ -235,19 +237,21 @@ function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: num
   dns.add("localhost")
   ips.add("127.0.0.1")
 
-  if (host && host !== "0.0.0.0") {
-    if (isIPv4(host)) {
-      ips.add(host)
+  const normalizedHost = stripHostBrackets(host)
+  if (normalizedHost && !isWildcardHost(normalizedHost)) {
+    if (isIP(normalizedHost)) {
+      ips.add(normalizedHost)
     } else {
-      dns.add(host)
+      dns.add(normalizedHost)
     }
   }
 
   for (const token of splitList(tlsSANs)) {
-    if (isIPv4(token)) {
-      ips.add(token)
-    } else if (token) {
-      dns.add(token)
+    const normalizedToken = stripHostBrackets(token)
+    if (isIP(normalizedToken)) {
+      ips.add(normalizedToken)
+    } else if (normalizedToken) {
+      dns.add(normalizedToken)
     }
   }
 
@@ -271,13 +275,3 @@ function splitList(input: string | undefined): string[] {
     .map((part) => part.trim())
     .filter(Boolean)
 }
-
-function isIPv4(value: string): boolean {
-  const parts = value.split(".")
-  if (parts.length !== 4) return false
-  return parts.every((part) => {
-    if (!/^[0-9]+$/.test(part)) return false
-    const num = Number(part)
-    return Number.isInteger(num) && num >= 0 && num <= 255
-  })
-}
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
index 1bda26f43..e27c34b9b 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
@@ -65,4 +65,56 @@ describe("buildDiagnosticReport", () => {
     assert.match(report, /Candidate addresses: 1/)
     assert.doesNotMatch(report, /https:\/\/127\.0\.0\.1:9898/)
   })
+
+  it("retains only the configured concrete loopback address", () => {
+    const report = buildDiagnosticReport(
+      {
+        ...meta,
+        host: "127.0.0.2",
+        listeningMode: "local",
+        remoteUrl: "https://127.0.0.2:9898",
+        addresses: [
+          { ip: "127.0.0.1", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.1:9898" },
+          { ip: "127.0.0.2", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.2:9898" },
+        ],
+      },
+      "Windows x64",
+      { host: "electron", platform: "desktop", windowContext: "local" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(report, /Listening mode: local/)
+    assert.match(report, /Candidate addresses: 1/)
+    assert.match(report, /https:\/\/127\.0\.0\.2:9898/)
+    assert.doesNotMatch(report, /https:\/\/127\.0\.0\.1:9898/)
+  })
+
+  it("recognizes expanded IPv6 wildcards and concrete IPv6 loopback binds", () => {
+    const wildcard = buildDiagnosticReport(
+      { ...meta, host: "0:0:0:0:0:0:0:0", addresses: [] },
+      "Linux arm64",
+      { host: "tauri", platform: "desktop", windowContext: "local" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+    const loopback = buildDiagnosticReport(
+      {
+        ...meta,
+        host: "::1",
+        listeningMode: "local",
+        remoteUrl: "https://[::1]:9898",
+        addresses: [
+          { ip: "127.0.0.1", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.1:9898" },
+          { ip: "::1", family: "ipv6", scope: "loopback", remoteUrl: "https://[::1]:9898" },
+        ],
+      },
+      "Linux arm64",
+      { host: "tauri", platform: "desktop", windowContext: "local" },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(wildcard, /Listening mode: all/)
+    assert.match(loopback, /Listening mode: local/)
+    assert.match(loopback, /ipv6\/loopback: https:\/\/\[::1\]:9898/)
+    assert.doesNotMatch(loopback, /https:\/\/127\.0\.0\.1:9898/)
+  })
 })
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.ts b/packages/ui/src/components/settings/info-settings-diagnostics.ts
index 9880f27eb..9d782ba5a 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.ts
@@ -9,13 +9,26 @@ export interface DiagnosticRuntime {
 export type DiagnosticListeningMode = ServerMeta["listeningMode"] | "specific"
 
 export function getDiagnosticListeningMode(meta: ServerMeta): DiagnosticListeningMode {
-  if (meta.listeningMode === "all" && meta.host !== "0.0.0.0" && meta.host !== "::") return "specific"
+  if (isWildcardBindHost(meta.host)) return "all"
+  if (meta.listeningMode === "all") return "specific"
   return meta.listeningMode
 }
 
 export function getDiagnosticAddresses(meta: ServerMeta): NetworkAddress[] {
-  if (getDiagnosticListeningMode(meta) !== "specific") return meta.addresses
-  return meta.addresses.filter((address) => address.scope !== "loopback")
+  if (isWildcardBindHost(meta.host)) return meta.addresses
+  const host = normalizeBindHost(meta.host)
+  return meta.addresses.filter((address) => normalizeBindHost(address.ip) === host)
+}
+
+function isWildcardBindHost(host: string): boolean {
+  const value = normalizeBindHost(host)
+  if (value === "0.0.0.0") return true
+  return value.includes(":") && value.split(":").every((segment) => segment === "" || /^0+$/.test(segment))
+}
+
+function normalizeBindHost(host: string): string {
+  const value = host.trim().toLowerCase()
+  return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value
 }
 
 export function buildDiagnosticReport(

From d84c9948dc9fd3c2a71e244cfe479ea97bc1a3d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Andr=C3=A9?= <pascalandr@gmail.com>
Date: Mon, 10 Aug 2026 14:53:12 +0200
Subject: [PATCH 4/5] fix(connectivity): close remaining diagnostics gaps

Make IPv6 wildcard listeners explicitly dual-stack, omit unusable link-local candidates, and recognize zero-padded loopback forms so reported addresses match effective reachability.

Regenerate generated TLS certificates when the active host or configured SANs are missing, including IPv6 loopback coverage for wildcard listeners. Localize every exported diagnostic report label and add focused regression coverage.

Validated with focused server and UI tests, server/root typechecks, the UI production build, and git diff checks.
---
 .../__tests__/network-addresses.test.ts       |  4 +-
 .../src/server/__tests__/network-host.test.ts |  2 +
 .../src/server/__tests__/tls-ipv6.test.ts     | 39 +++++++++++--
 packages/server/src/server/http-server.ts     |  7 ++-
 .../server/src/server/network-addresses.ts    | 10 +++-
 packages/server/src/server/network-host.ts    |  2 +-
 packages/server/src/server/tls.ts             | 49 ++++++++++++----
 .../info-settings-diagnostics.test.ts         | 56 +++++++++++++++++--
 .../settings/info-settings-diagnostics.ts     | 55 ++++++++++++------
 .../settings/info-settings-section.tsx        | 32 ++++++++++-
 .../ui/src/lib/i18n/messages/de/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/en/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/es/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/fr/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/he/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/ja/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/ne/settings.ts   |  3 +
 .../ui/src/lib/i18n/messages/ru/settings.ts   |  3 +
 .../src/lib/i18n/messages/zh-Hans/settings.ts |  3 +
 19 files changed, 235 insertions(+), 48 deletions(-)

diff --git a/packages/server/src/server/__tests__/network-addresses.test.ts b/packages/server/src/server/__tests__/network-addresses.test.ts
index d388701af..2d74732af 100644
--- a/packages/server/src/server/__tests__/network-addresses.test.ts
+++ b/packages/server/src/server/__tests__/network-addresses.test.ts
@@ -40,9 +40,10 @@ describe("resolveNetworkAddresses", () => {
     ])
   })
 
-  it("enumerates matching IPv6 interfaces for compact and expanded wildcards", () => {
+  it("enumerates dual-stack interfaces and excludes unusable IPv6 link-local addresses", () => {
     const addresses = [
       { address: "2001:db8::20", family: "IPv6", internal: false },
+      { address: "fe80::20", family: "IPv6", internal: false },
       { address: "::1", family: 6, internal: true },
       { address: "192.168.1.20", family: "IPv4", internal: false },
     ]
@@ -52,6 +53,7 @@ describe("resolveNetworkAddresses", () => {
         const result = resolveNetworkAddresses({ host, protocol: "https", port: 9898 })
         assert.deepEqual(result, [
           { ip: "2001:db8::20", family: "ipv6", scope: "external", remoteUrl: "https://[2001:db8::20]:9898" },
+          { ip: "192.168.1.20", family: "ipv4", scope: "external", remoteUrl: "https://192.168.1.20:9898" },
           { ip: "::1", family: "ipv6", scope: "loopback", remoteUrl: "https://[::1]:9898" },
         ])
       }
diff --git a/packages/server/src/server/__tests__/network-host.test.ts b/packages/server/src/server/__tests__/network-host.test.ts
index c9610e392..7c720b2b0 100644
--- a/packages/server/src/server/__tests__/network-host.test.ts
+++ b/packages/server/src/server/__tests__/network-host.test.ts
@@ -15,7 +15,9 @@ describe("network host helpers", () => {
     assert.equal(isLoopbackHost("localhost"), true)
     assert.equal(isLoopbackHost("127.0.0.2"), true)
     assert.equal(isLoopbackHost("::1"), true)
+    assert.equal(isLoopbackHost("::0001"), true)
     assert.equal(isLoopbackHost("0:0:0:0:0:0:0:1"), true)
+    assert.equal(isLoopbackHost("0:0:0:0:0:0:0:0001"), true)
     assert.equal(isLoopbackHost("2001:db8::1"), false)
   })
 
diff --git a/packages/server/src/server/__tests__/tls-ipv6.test.ts b/packages/server/src/server/__tests__/tls-ipv6.test.ts
index e094de676..0d4133b21 100644
--- a/packages/server/src/server/__tests__/tls-ipv6.test.ts
+++ b/packages/server/src/server/__tests__/tls-ipv6.test.ts
@@ -3,21 +3,48 @@ import crypto from "node:crypto"
 import fs from "node:fs"
 import os from "node:os"
 import path from "node:path"
-import { it } from "node:test"
+import { describe, it } from "node:test"
 
 import type { Logger } from "../../logger"
 import { resolveHttpsOptions } from "../tls"
 
-it("generates a certificate with a concrete IPv6 address SAN", () => {
-  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "codenomad-tls-ipv6-"))
-  const logger = { info() {}, warn() {}, error() {}, child() { return logger } } as unknown as Logger
+const logger = { info() {}, warn() {}, error() {}, child() { return logger } } as unknown as Logger
 
-  try {
+describe("generated IPv6 certificates", () => {
+  it("includes a concrete IPv6 address SAN", () => withTempConfig((configDir) => {
     const resolved = resolveHttpsOptions({ enabled: true, configDir, host: "2001:db8::20", logger })
     assert.ok(resolved)
     const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert)
     assert.match(certificate.subjectAltName ?? "", /IP Address:2001:DB8:0:0:0:0:0:20/i)
+  }))
+
+  it("includes IPv6 loopback for a fresh wildcard certificate", () => withTempConfig((configDir) => {
+    const resolved = resolveHttpsOptions({ enabled: true, configDir, host: "::", logger })
+    assert.ok(resolved)
+    const certificate = new crypto.X509Certificate(resolved.httpsOptions.cert)
+    assert.equal(certificate.checkIP("::1"), "::1")
+  }))
+
+  it("rotates a reused certificate when required host and configured SANs change", () => withTempConfig((configDir) => {
+    const initial = resolveHttpsOptions({ enabled: true, configDir, host: "127.0.0.1", logger })
+    assert.ok(initial)
+    const initialCertificate = new crypto.X509Certificate(initial.httpsOptions.cert)
+
+    const rotated = resolveHttpsOptions({ enabled: true, configDir, host: "::", tlsSANs: "diagnostics.local", logger })
+    assert.ok(rotated)
+    const rotatedCertificate = new crypto.X509Certificate(rotated.httpsOptions.cert)
+
+    assert.notEqual(rotatedCertificate.fingerprint256, initialCertificate.fingerprint256)
+    assert.equal(rotatedCertificate.checkIP("::1"), "::1")
+    assert.equal(rotatedCertificate.checkHost("diagnostics.local"), "diagnostics.local")
+  }))
+})
+
+function withTempConfig(callback: (configDir: string) => void) {
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "codenomad-tls-ipv6-"))
+  try {
+    callback(configDir)
   } finally {
     fs.rmSync(configDir, { recursive: true, force: true })
   }
-})
+}
diff --git a/packages/server/src/server/http-server.ts b/packages/server/src/server/http-server.ts
index 8ada497b4..b89b2fd63 100644
--- a/packages/server/src/server/http-server.ts
+++ b/packages/server/src/server/http-server.ts
@@ -3,7 +3,7 @@ import cors from "@fastify/cors"
 import fastifyStatic from "@fastify/static"
 import replyFrom from "@fastify/reply-from"
 import fs from "fs"
-import { connect as connectTcp, type Socket } from "net"
+import { connect as connectTcp, isIP, type Socket } from "net"
 import path from "path"
 import { connect as connectTls, type TLSSocket } from "tls"
 import { fetch, type Headers } from "undici"
@@ -47,7 +47,7 @@ import type { SideCarManager } from "../sidecars/manager"
 import type { PreviewManager } from "../previews/manager"
 import type { RemoteProxySessionManager } from "./remote-proxy"
 import { createOpenCodeUpdateService } from "../opencode-update/service"
-import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./network-host"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, stripHostBrackets } from "./network-host"
 
 interface HttpServerDeps {
   bindHost: string
@@ -344,7 +344,8 @@ export function createHttpServer(deps: HttpServerDeps) {
     instance: app,
     start: async (): Promise<HttpServerStartResult> => {
       const attemptListen = async (requestedPort: number) => {
-        const addressInfo = await app.listen({ port: requestedPort, host: deps.bindHost })
+        const dualStackWildcard = isWildcardHost(deps.bindHost) && isIP(stripHostBrackets(deps.bindHost)) === 6
+        const addressInfo = await app.listen({ port: requestedPort, host: deps.bindHost, ...(dualStackWildcard ? { ipv6Only: false } : {}) })
         return { addressInfo, requestedPort }
       }
 
diff --git a/packages/server/src/server/network-addresses.ts b/packages/server/src/server/network-addresses.ts
index d29f1876e..77d83779a 100644
--- a/packages/server/src/server/network-addresses.ts
+++ b/packages/server/src/server/network-addresses.ts
@@ -21,7 +21,7 @@ export function resolveNetworkAddresses(args: {
 
   const addAddress = (ip: string, scope: NetworkAddress["scope"]) => {
     const ipVersion = isIP(ip)
-    if (!ipVersion || isWildcardHost(ip)) return
+    if (!ipVersion || isWildcardHost(ip) || (ipVersion === 6 && isLinkLocalIPv6(ip))) return
     const family = ipVersion === 6 ? "ipv6" : "ipv4"
     const key = `${family}-${ip.toLowerCase()}`
     if (seen.has(key)) return
@@ -34,7 +34,8 @@ export function resolveNetworkAddresses(args: {
     for (const entries of Object.values(interfaces)) {
       if (!entries) continue
       for (const entry of entries) {
-        if (isIP(entry.address) !== wildcardVersion) continue
+        const entryVersion = isIP(entry.address)
+        if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4)) continue
         const scope: NetworkAddress["scope"] = entry.internal ? "loopback" : "external"
         addAddress(entry.address, scope)
       }
@@ -98,3 +99,8 @@ function parseIPv4(value: string): number[] | null {
   if (isIP(value) !== 4) return null
   return value.split(".").map((part) => Number(part))
 }
+
+function isLinkLocalIPv6(ip: string): boolean {
+  const firstSegment = Number.parseInt(ip.split(":", 1)[0], 16)
+  return Number.isInteger(firstSegment) && firstSegment >= 0xfe80 && firstSegment <= 0xfebf
+}
diff --git a/packages/server/src/server/network-host.ts b/packages/server/src/server/network-host.ts
index 767344c91..e29a9dadb 100644
--- a/packages/server/src/server/network-host.ts
+++ b/packages/server/src/server/network-host.ts
@@ -22,7 +22,7 @@ export function isLoopbackHost(host: string): boolean {
 
   const segments = value.split(":")
   const last = segments.pop()
-  return last === "1" && segments.every((segment) => segment === "" || /^0+$/.test(segment))
+  return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === "" || /^0+$/.test(segment))
 }
 
 export function formatHostForUrl(host: string): string {
diff --git a/packages/server/src/server/tls.ts b/packages/server/src/server/tls.ts
index 7188003b0..744767ec9 100644
--- a/packages/server/src/server/tls.ts
+++ b/packages/server/src/server/tls.ts
@@ -71,11 +71,11 @@ function ensureGeneratedTls(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions
     try {
       if (!fs.existsSync(certPath)) return true
       const pem = fs.readFileSync(certPath, "utf-8")
-      const x509 = new crypto.X509Certificate(pem)
-      const validToMs = Date.parse(x509.validTo)
+      const certificate = new crypto.X509Certificate(pem)
+      const validToMs = Date.parse(certificate.validTo)
       if (!Number.isFinite(validToMs)) return true
       const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000
-      return Date.now() >= rotateAt
+      return Date.now() >= rotateAt || !certificateCoversRequiredSans(certificate, args.host, args.tlsSANs)
     } catch {
       return true
     }
@@ -231,6 +231,21 @@ function pickCommonName(host: string): string {
 }
 
 function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: number; value?: string; ip?: string }> {
+  const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs)
+  const altNames: Array<{ type: number; value?: string; ip?: string }> = []
+
+  // 2 = DNS, 7 = IP
+  for (const name of dns) {
+    altNames.push({ type: 2, value: name })
+  }
+  for (const ip of ips) {
+    altNames.push({ type: 7, ip })
+  }
+
+  return altNames
+}
+
+function resolveRequiredSubjectAltNames(host: string, tlsSANs?: string): { dns: Set<string>; ips: Set<string> } {
   const dns = new Set<string>()
   const ips = new Set<string>()
 
@@ -238,7 +253,9 @@ function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: num
   ips.add("127.0.0.1")
 
   const normalizedHost = stripHostBrackets(host)
-  if (normalizedHost && !isWildcardHost(normalizedHost)) {
+  if (isWildcardHost(normalizedHost) && isIP(normalizedHost) === 6) {
+    ips.add("::1")
+  } else if (normalizedHost) {
     if (isIP(normalizedHost)) {
       ips.add(normalizedHost)
     } else {
@@ -255,17 +272,25 @@ function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: num
     }
   }
 
-  const altNames: Array<{ type: number; value?: string; ip?: string }> = []
+  return { dns, ips }
+}
 
-  // 2 = DNS, 7 = IP
-  for (const name of Array.from(dns)) {
-    altNames.push({ type: 2, value: name })
+function certificateCoversRequiredSans(certificate: crypto.X509Certificate, host: string, tlsSANs?: string): boolean {
+  const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs)
+  const existingDns = new Set(
+    (certificate.subjectAltName ?? "")
+      .split(/,\s*/)
+      .filter((entry) => entry.startsWith("DNS:"))
+      .map((entry) => entry.slice(4).toLowerCase()),
+  )
+
+  for (const name of dns) {
+    if (!existingDns.has(name.toLowerCase())) return false
   }
-  for (const ip of Array.from(ips)) {
-    altNames.push({ type: 7, ip })
+  for (const ip of ips) {
+    if (!certificate.checkIP(ip)) return false
   }
-
-  return altNames
+  return true
 }
 
 function splitList(input: string | undefined): string[] {
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
index e27c34b9b..2442f2a0a 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.test.ts
@@ -4,6 +4,26 @@ import { describe, it } from "node:test"
 import type { ServerMeta } from "../../../../server/src/api-types"
 import { buildDiagnosticReport } from "./info-settings-diagnostics"
 
+const labels = {
+  reportTitle: "CodeNomad Diagnostic Report",
+  generated: "Generated",
+  serverVersion: "Server version",
+  uiVersion: "UI version",
+  uiSource: "UI source",
+  runtime: "Runtime",
+  platform: "Platform",
+  windowContext: "Window context",
+  os: "OS",
+  listeningMode: "Listening mode",
+  bindHost: "Bind host",
+  localListener: "Local listener",
+  remoteListener: "Remote listener",
+  workspaceRoot: "Workspace root",
+  candidateAddresses: "Candidate addresses",
+  modes: { local: "local", all: "all", specific: "specific" },
+  scopes: { external: "external", internal: "internal", loopback: "loopback" },
+}
+
 const meta: ServerMeta = {
   localUrl: "http://127.0.0.1:9899",
   remoteUrl: "https://192.168.1.20:9898",
@@ -28,14 +48,15 @@ describe("buildDiagnosticReport", () => {
       meta,
       "Linux x86_64",
       { host: "tauri", platform: "desktop", windowContext: "local" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
 
     assert.match(report, /Generated: 2026-08-10T12:00:00\.000Z/)
     assert.match(report, /Listening mode: all/)
     assert.match(report, /Bind host: 0\.0\.0\.0/)
-    assert.match(report, /Local URL: http:\/\/127\.0\.0\.1:9899/)
-    assert.match(report, /Remote URL: https:\/\/192\.168\.1\.20:9898/)
+    assert.match(report, /Local listener: http:\/\/127\.0\.0\.1:9899/)
+    assert.match(report, /Remote listener: https:\/\/192\.168\.1\.20:9898/)
     assert.match(report, /Candidate addresses: 2/)
     assert.match(report, /ipv4\/external: https:\/\/192\.168\.1\.20:9898/)
   })
@@ -45,19 +66,43 @@ describe("buildDiagnosticReport", () => {
       null,
       "Unknown",
       { host: "web", platform: "web", windowContext: "remote" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
 
-    assert.match(report, /Server version: unknown/)
-    assert.match(report, /Remote URL: none/)
+    assert.match(report, /Server version: —/)
+    assert.match(report, /Remote listener: —/)
     assert.match(report, /Candidate addresses: 0/)
   })
 
+  it("uses caller-provided labels for exported reports", () => {
+    const report = buildDiagnosticReport(
+      meta,
+      "Linux x86_64",
+      { host: "tauri", platform: "desktop", windowContext: "local" },
+      {
+        ...labels,
+        reportTitle: "Rapport de diagnostic CodeNomad",
+        generated: "Généré",
+        listeningMode: "Mode d’écoute",
+        modes: { ...labels.modes, all: "Toutes les interfaces réseau" },
+        scopes: { ...labels.scopes, external: "Réseau" },
+      },
+      new Date("2026-08-10T12:00:00.000Z"),
+    )
+
+    assert.match(report, /Rapport de diagnostic CodeNomad/)
+    assert.match(report, /Généré: 2026-08-10T12:00:00\.000Z/)
+    assert.match(report, /Mode d’écoute: Toutes les interfaces réseau/)
+    assert.match(report, /ipv4\/Réseau:/)
+  })
+
   it("identifies a specific interface and omits its unreachable loopback candidate", () => {
     const report = buildDiagnosticReport(
       { ...meta, host: "192.168.1.20", addresses: meta.addresses },
       "Linux x86_64",
       { host: "electron", platform: "desktop", windowContext: "local" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
 
@@ -80,6 +125,7 @@ describe("buildDiagnosticReport", () => {
       },
       "Windows x64",
       { host: "electron", platform: "desktop", windowContext: "local" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
 
@@ -94,6 +140,7 @@ describe("buildDiagnosticReport", () => {
       { ...meta, host: "0:0:0:0:0:0:0:0", addresses: [] },
       "Linux arm64",
       { host: "tauri", platform: "desktop", windowContext: "local" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
     const loopback = buildDiagnosticReport(
@@ -109,6 +156,7 @@ describe("buildDiagnosticReport", () => {
       },
       "Linux arm64",
       { host: "tauri", platform: "desktop", windowContext: "local" },
+      labels,
       new Date("2026-08-10T12:00:00.000Z"),
     )
 
diff --git a/packages/ui/src/components/settings/info-settings-diagnostics.ts b/packages/ui/src/components/settings/info-settings-diagnostics.ts
index 9d782ba5a..bb9f2d1db 100644
--- a/packages/ui/src/components/settings/info-settings-diagnostics.ts
+++ b/packages/ui/src/components/settings/info-settings-diagnostics.ts
@@ -6,6 +6,26 @@ export interface DiagnosticRuntime {
   windowContext: string
 }
 
+export interface DiagnosticLabels {
+  reportTitle: string
+  generated: string
+  serverVersion: string
+  uiVersion: string
+  uiSource: string
+  runtime: string
+  platform: string
+  windowContext: string
+  os: string
+  listeningMode: string
+  bindHost: string
+  localListener: string
+  remoteListener: string
+  workspaceRoot: string
+  candidateAddresses: string
+  modes: Record<DiagnosticListeningMode, string>
+  scopes: Record<NetworkAddress["scope"], string>
+}
+
 export type DiagnosticListeningMode = ServerMeta["listeningMode"] | "specific"
 
 export function getDiagnosticListeningMode(meta: ServerMeta): DiagnosticListeningMode {
@@ -35,31 +55,32 @@ export function buildDiagnosticReport(
   meta: ServerMeta | null,
   osDisplay: string,
   runtime: DiagnosticRuntime,
+  labels: DiagnosticLabels,
   generatedAt = new Date(),
 ): string {
   const addresses = meta ? getDiagnosticAddresses(meta) : []
+  const listeningMode = meta ? labels.modes[getDiagnosticListeningMode(meta)] : "—"
   const lines = [
-    "CodeNomad Diagnostic Report",
+    labels.reportTitle,
     "============================",
-    `Generated: ${generatedAt.toISOString()}`,
-    `Server version: ${meta?.serverVersion ?? "unknown"}`,
-    `UI version: ${meta?.ui?.version ?? "unknown"} (source: ${meta?.ui?.source ?? "unknown"})`,
-    `Runtime: ${runtime.host}`,
-    `Platform: ${runtime.platform}`,
-    `Window context: ${runtime.windowContext}`,
-    `OS: ${osDisplay}`,
-    `Listening mode: ${meta ? getDiagnosticListeningMode(meta) : "unknown"}`,
-    `Bind host: ${meta?.host ?? "unknown"}`,
-    `Local URL: ${meta?.localUrl ?? "unknown"}`,
-    `Local port: ${meta?.localPort ?? "unknown"}`,
-    `Remote URL: ${meta?.remoteUrl ?? "none"}`,
-    `Remote port: ${meta?.remotePort ?? "none"}`,
-    `Workspace root: ${meta?.workspaceRoot ?? "unknown"}`,
-    `Candidate addresses: ${addresses.length}`,
+    `${labels.generated}: ${generatedAt.toISOString()}`,
+    `${labels.serverVersion}: ${meta?.serverVersion ?? "—"}`,
+    `${labels.uiVersion}: ${meta?.ui?.version ?? "—"}`,
+    `${labels.uiSource}: ${meta?.ui?.source ?? "—"}`,
+    `${labels.runtime}: ${runtime.host}`,
+    `${labels.platform}: ${runtime.platform}`,
+    `${labels.windowContext}: ${runtime.windowContext}`,
+    `${labels.os}: ${osDisplay}`,
+    `${labels.listeningMode}: ${listeningMode}`,
+    `${labels.bindHost}: ${meta?.host ?? "—"}`,
+    `${labels.localListener}: ${meta?.localUrl ?? "—"}`,
+    `${labels.remoteListener}: ${meta?.remoteUrl ?? "—"}`,
+    `${labels.workspaceRoot}: ${meta?.workspaceRoot ?? "—"}`,
+    `${labels.candidateAddresses}: ${addresses.length}`,
   ]
 
   for (const address of addresses) {
-    lines.push(`- ${address.family}/${address.scope}: ${address.remoteUrl}`)
+    lines.push(`- ${address.family}/${labels.scopes[address.scope]}: ${address.remoteUrl}`)
   }
 
   lines.push("")
diff --git a/packages/ui/src/components/settings/info-settings-section.tsx b/packages/ui/src/components/settings/info-settings-section.tsx
index 08197ebd2..fa7f4565b 100644
--- a/packages/ui/src/components/settings/info-settings-section.tsx
+++ b/packages/ui/src/components/settings/info-settings-section.tsx
@@ -121,6 +121,34 @@ export const InfoSettingsSection: Component = () => {
 
   const supportInfo = createMemo(() => meta()?.support ?? null)
 
+  const diagnosticLabels = createMemo(() => ({
+    reportTitle: t("settings.info.diagnostics.reportTitle"),
+    generated: t("settings.info.diagnostics.generated"),
+    serverVersion: t("settings.info.version.server"),
+    uiVersion: t("settings.info.version.ui"),
+    uiSource: t("settings.info.version.uiSource"),
+    runtime: t("settings.info.runtime.type"),
+    platform: t("settings.info.runtime.platform"),
+    windowContext: t("settings.info.runtime.windowContext"),
+    os: t("settings.info.runtime.os"),
+    listeningMode: t("remoteAccess.sections.listeningMode.label"),
+    bindHost: t("settings.info.connectivity.host"),
+    localListener: t("settings.info.connectivity.localListener"),
+    remoteListener: t("settings.info.connectivity.remoteListener"),
+    workspaceRoot: t("settings.info.server.root"),
+    candidateAddresses: t("remoteAccess.sections.addresses.label"),
+    modes: {
+      local: t("settings.info.connectivity.mode.local"),
+      all: t("settings.info.connectivity.mode.all"),
+      specific: t("settings.info.connectivity.mode.specific"),
+    },
+    scopes: {
+      external: t("remoteAccess.address.scope.network"),
+      internal: t("remoteAccess.address.scope.internal"),
+      loopback: t("remoteAccess.address.scope.loopback"),
+    },
+  }))
+
   const latestVersion = createMemo(() => {
     const update = updateInfo()
     if (update?.version) return update.version
@@ -168,14 +196,14 @@ export const InfoSettingsSection: Component = () => {
   })
 
   const handleCopy = async () => {
-    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv)
+    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv, diagnosticLabels())
     const ok = await copyToClipboard(report)
     if (ok) setCopyFeedback("success")
     else setCopyFeedback("error")
   }
 
   const handleDownload = () => {
-    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv)
+    const report = buildDiagnosticReport(meta() ?? null, osDisplay(), runtimeEnv, diagnosticLabels())
     const ts = new Date().toISOString().replace(/[:.]/g, "-")
     downloadTextFile(`codenomad-diagnostics-${ts}.txt`, report)
   }
diff --git a/packages/ui/src/lib/i18n/messages/de/settings.ts b/packages/ui/src/lib/i18n/messages/de/settings.ts
index 2f5425fed..7eab5430d 100644
--- a/packages/ui/src/lib/i18n/messages/de/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/de/settings.ts
@@ -463,6 +463,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Betriebssystem",
   "settings.info.server.url": "Server-URL",
   "settings.info.server.root": "Arbeitsbereich-Root",
+  "settings.info.runtime.windowContext": "Fensterkontext",
+  "settings.info.diagnostics.reportTitle": "CodeNomad-Diagnosebericht",
+  "settings.info.diagnostics.generated": "Erstellt",
   "settings.info.connectivity.title": "CodeNomad-Serververbindung",
   "settings.info.connectivity.subtitle": "Prüfen Sie die tatsächlich verwendete Listener-Konfiguration und mögliche Netzwerkadressen.",
   "settings.info.connectivity.mode.local": "Nur lokal",
diff --git a/packages/ui/src/lib/i18n/messages/en/settings.ts b/packages/ui/src/lib/i18n/messages/en/settings.ts
index 07b825d6f..ffe043178 100644
--- a/packages/ui/src/lib/i18n/messages/en/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/en/settings.ts
@@ -465,6 +465,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Operating system",
   "settings.info.server.url": "Server URL",
   "settings.info.server.root": "Workspace root",
+  "settings.info.runtime.windowContext": "Window context",
+  "settings.info.diagnostics.reportTitle": "CodeNomad Diagnostic Report",
+  "settings.info.diagnostics.generated": "Generated",
   "settings.info.connectivity.title": "CodeNomad server connectivity",
   "settings.info.connectivity.subtitle": "Inspect the effective listener configuration and candidate network addresses.",
   "settings.info.connectivity.mode.local": "Local only",
diff --git a/packages/ui/src/lib/i18n/messages/es/settings.ts b/packages/ui/src/lib/i18n/messages/es/settings.ts
index f6d2d3254..6591d0184 100644
--- a/packages/ui/src/lib/i18n/messages/es/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/es/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Sistema operativo",
   "settings.info.server.url": "URL del servidor",
   "settings.info.server.root": "Raíz del workspace",
+  "settings.info.runtime.windowContext": "Contexto de ventana",
+  "settings.info.diagnostics.reportTitle": "Informe de diagnóstico de CodeNomad",
+  "settings.info.diagnostics.generated": "Generado",
   "settings.info.connectivity.title": "Conectividad del servidor CodeNomad",
   "settings.info.connectivity.subtitle": "Consulta la configuración de escucha en uso y las posibles direcciones de red.",
   "settings.info.connectivity.mode.local": "Solo local",
diff --git a/packages/ui/src/lib/i18n/messages/fr/settings.ts b/packages/ui/src/lib/i18n/messages/fr/settings.ts
index 50a225cff..a6eb49eeb 100644
--- a/packages/ui/src/lib/i18n/messages/fr/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/fr/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Système d'exploitation",
   "settings.info.server.url": "URL du serveur",
   "settings.info.server.root": "Racine de l'espace de travail",
+  "settings.info.runtime.windowContext": "Contexte de la fenêtre",
+  "settings.info.diagnostics.reportTitle": "Rapport de diagnostic CodeNomad",
+  "settings.info.diagnostics.generated": "Généré",
   "settings.info.connectivity.title": "Connectivité du serveur CodeNomad",
   "settings.info.connectivity.subtitle": "Consultez la configuration d’écoute actuellement utilisée et les adresses réseau possibles.",
   "settings.info.connectivity.mode.local": "Local uniquement",
diff --git a/packages/ui/src/lib/i18n/messages/he/settings.ts b/packages/ui/src/lib/i18n/messages/he/settings.ts
index f368b5f1a..7dcb66efb 100644
--- a/packages/ui/src/lib/i18n/messages/he/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/he/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "מערכת הפעלה",
   "settings.info.server.url": "כתובת השרת",
   "settings.info.server.root": "שורש סביבת העבודה",
+  "settings.info.runtime.windowContext": "הקשר החלון",
+  "settings.info.diagnostics.reportTitle": "דוח אבחון של CodeNomad",
+  "settings.info.diagnostics.generated": "נוצר",
   "settings.info.connectivity.title": "קישוריות שרת CodeNomad",
   "settings.info.connectivity.subtitle": "בדיקת תצורת ההאזנה הפעילה וכתובות רשת אפשריות.",
   "settings.info.connectivity.mode.local": "מקומי בלבד",
diff --git a/packages/ui/src/lib/i18n/messages/ja/settings.ts b/packages/ui/src/lib/i18n/messages/ja/settings.ts
index fc1d77176..b5d2486bb 100644
--- a/packages/ui/src/lib/i18n/messages/ja/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ja/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "オペレーティングシステム",
   "settings.info.server.url": "サーバー URL",
   "settings.info.server.root": "ワークスペースルート",
+  "settings.info.runtime.windowContext": "ウィンドウコンテキスト",
+  "settings.info.diagnostics.reportTitle": "CodeNomad 診断レポート",
+  "settings.info.diagnostics.generated": "生成日時",
   "settings.info.connectivity.title": "CodeNomad サーバー接続",
   "settings.info.connectivity.subtitle": "有効なリスナー設定と候補のネットワークアドレスを確認します。",
   "settings.info.connectivity.mode.local": "ローカルのみ",
diff --git a/packages/ui/src/lib/i18n/messages/ne/settings.ts b/packages/ui/src/lib/i18n/messages/ne/settings.ts
index 85f5707e8..80e02b79d 100644
--- a/packages/ui/src/lib/i18n/messages/ne/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ne/settings.ts
@@ -463,6 +463,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "अपरेटिङ सिस्टम",
   "settings.info.server.url": "सर्भर URL",
   "settings.info.server.root": "कार्यस्थानको मूल",
+  "settings.info.runtime.windowContext": "विन्डो सन्दर्भ",
+  "settings.info.diagnostics.reportTitle": "CodeNomad डायग्नोस्टिक रिपोर्ट",
+  "settings.info.diagnostics.generated": "सिर्जना गरिएको",
   "settings.info.connectivity.title": "CodeNomad सर्भर जडान",
   "settings.info.connectivity.subtitle": "वास्तवमा लागू भएको लिस्नर कन्फिगरेसन र सम्भावित नेटवर्क ठेगानाहरू हेर्नुहोस्।",
   "settings.info.connectivity.mode.local": "स्थानीय मात्र",
diff --git a/packages/ui/src/lib/i18n/messages/ru/settings.ts b/packages/ui/src/lib/i18n/messages/ru/settings.ts
index e30708265..db5aab8de 100644
--- a/packages/ui/src/lib/i18n/messages/ru/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/ru/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "Операционная система",
   "settings.info.server.url": "URL сервера",
   "settings.info.server.root": "Корень рабочей области",
+  "settings.info.runtime.windowContext": "Контекст окна",
+  "settings.info.diagnostics.reportTitle": "Диагностический отчёт CodeNomad",
+  "settings.info.diagnostics.generated": "Создан",
   "settings.info.connectivity.title": "Подключение к серверу CodeNomad",
   "settings.info.connectivity.subtitle": "Просмотрите фактическую конфигурацию прослушивания и возможные сетевые адреса.",
   "settings.info.connectivity.mode.local": "Только локально",
diff --git a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
index 21e956f45..6d849dcb3 100644
--- a/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
+++ b/packages/ui/src/lib/i18n/messages/zh-Hans/settings.ts
@@ -464,6 +464,9 @@ export const settingsMessages = {
   "settings.info.runtime.os": "操作系统",
   "settings.info.server.url": "服务器 URL",
   "settings.info.server.root": "工作区根目录",
+  "settings.info.runtime.windowContext": "窗口上下文",
+  "settings.info.diagnostics.reportTitle": "CodeNomad 诊断报告",
+  "settings.info.diagnostics.generated": "生成时间",
   "settings.info.connectivity.title": "CodeNomad 服务器连接",
   "settings.info.connectivity.subtitle": "查看实际生效的监听配置和候选网络地址。",
   "settings.info.connectivity.mode.local": "仅本机",

From e8e2b5cbff76dae3ba6353be156089ee67bbd639 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pascal=20Andr=C3=A9?= <pascalandr@gmail.com>
Date: Mon, 10 Aug 2026 15:12:05 +0200
Subject: [PATCH 5/5] fix(server): normalize edge-case listener hosts

Canonicalize IPv4-mapped IPv6 bind addresses before listener classification so wildcard exposure, loopback scope, plugin URLs, and diagnostics reflect the effective IPv4 endpoint.

Convert internationalized DNS names to ASCII for stable generated certificate reuse. Reject zone-scoped IPv6 CLI hosts because they cannot form supported listener URLs, while normalizing scoped SAN entries to their certificate-safe address.

Covered mapped wildcard and loopback forms, IDN certificate reuse, scoped SANs, and CLI host validation with focused tests. Server/root typechecks and diff checks pass.
---
 packages/server/src/index.test.ts             | 11 ++++-
 packages/server/src/index.ts                  | 13 +++---
 .../__tests__/network-addresses.test.ts       | 11 +++++
 .../src/server/__tests__/network-host.test.ts | 11 ++++-
 .../src/server/__tests__/tls-ipv6.test.ts     | 14 ++++++
 .../server/src/server/listener-base-url.ts    |  4 +-
 .../server/src/server/network-addresses.ts    | 16 ++++---
 packages/server/src/server/network-host.ts    | 44 ++++++++++++++++---
 packages/server/src/server/tls.ts             | 17 ++++---
 9 files changed, 112 insertions(+), 29 deletions(-)

diff --git a/packages/server/src/index.test.ts b/packages/server/src/index.test.ts
index 2e8f4cf81..984fc827d 100644
--- a/packages/server/src/index.test.ts
+++ b/packages/server/src/index.test.ts
@@ -3,7 +3,7 @@ import { spawn } from "node:child_process"
 import { once } from "node:events"
 import { describe, it } from "node:test"
 
-import { installShutdownSignalHandlers, installShutdownStdinHandler, STDIN_SHUTDOWN_COMMAND } from "./index"
+import { installShutdownSignalHandlers, installShutdownStdinHandler, resolveHost, STDIN_SHUTDOWN_COMMAND } from "./index"
 import { createServerShutdownHandler } from "./shutdown"
 
 describe("CLI shutdown signal registration", () => {
@@ -71,3 +71,12 @@ describe("CLI shutdown signal registration", () => {
     assert.equal(code, 0)
   })
 })
+
+describe("CLI host normalization", () => {
+  it("normalizes mapped and internationalized hosts and rejects IPv6 zones", () => {
+    assert.equal(resolveHost("::ffff:0:0"), "0.0.0.0")
+    assert.equal(resolveHost("::ffff:7f00:1"), "127.0.0.1")
+    assert.equal(resolveHost("münchen.local"), "xn--mnchen-3ya.local")
+    assert.throws(() => resolveHost("fe80::1%12"), /IPv6 zone identifiers/)
+  })
+})
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index 887a40800..a35c8561b 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -24,7 +24,7 @@ import { resolveHttpsOptions } from "./server/tls"
 import { RemoteProxySessionManager } from "./server/remote-proxy"
 import { resolveNetworkAddresses, resolveRemoteAddresses } from "./server/network-addresses"
 import { resolvePluginBaseUrl } from "./server/listener-base-url"
-import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./server/network-host"
+import { formatHostForUrl, hasIPv6Zone, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./server/network-host"
 import { startDevReleaseMonitor } from "./releases/dev-release-monitor"
 import { SpeechService } from "./speech/service"
 import { SideCarManager } from "./sidecars/manager"
@@ -264,19 +264,20 @@ function parsePort(input: string): number {
   return value
 }
 
-function resolveHost(input: string | undefined): string {
+export function resolveHost(input: string | undefined): string {
   const trimmed = input?.trim()
   if (!trimmed) return DEFAULT_HOST
 
-  if (trimmed === "0.0.0.0") {
-    return "0.0.0.0"
+  if (hasIPv6Zone(trimmed)) {
+    throw new InvalidArgumentError("IPv6 zone identifiers are not supported in --host")
   }
 
-  if (trimmed === "localhost") {
+  const normalized = normalizeNetworkHost(trimmed)
+  if (normalized === "localhost") {
     return DEFAULT_HOST
   }
 
-  return trimmed
+  return normalized
 }
 
 export function programHasArg(argv: string[], flag: string): boolean {
diff --git a/packages/server/src/server/__tests__/network-addresses.test.ts b/packages/server/src/server/__tests__/network-addresses.test.ts
index 2d74732af..653036713 100644
--- a/packages/server/src/server/__tests__/network-addresses.test.ts
+++ b/packages/server/src/server/__tests__/network-addresses.test.ts
@@ -40,6 +40,17 @@ describe("resolveNetworkAddresses", () => {
     ])
   })
 
+  it("reports IPv4-mapped wildcard and loopback hosts as IPv4", () => {
+    usingMockedNetworkInterfaces([{ address: "192.168.1.20", family: "IPv4", internal: false }], () => {
+      assert.deepEqual(resolveNetworkAddresses({ host: "::ffff:0:0", protocol: "https", port: 9898 }), [
+        { ip: "192.168.1.20", family: "ipv4", scope: "external", remoteUrl: "https://192.168.1.20:9898" },
+      ])
+      assert.deepEqual(resolveNetworkAddresses({ host: "::ffff:7f00:1", protocol: "https", port: 9898 }), [
+        { ip: "127.0.0.1", family: "ipv4", scope: "loopback", remoteUrl: "https://127.0.0.1:9898" },
+      ])
+    })
+  })
+
   it("enumerates dual-stack interfaces and excludes unusable IPv6 link-local addresses", () => {
     const addresses = [
       { address: "2001:db8::20", family: "IPv6", internal: false },
diff --git a/packages/server/src/server/__tests__/network-host.test.ts b/packages/server/src/server/__tests__/network-host.test.ts
index 7c720b2b0..d606d8fd6 100644
--- a/packages/server/src/server/__tests__/network-host.test.ts
+++ b/packages/server/src/server/__tests__/network-host.test.ts
@@ -1,13 +1,14 @@
 import assert from "node:assert/strict"
 import { describe, it } from "node:test"
 
-import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "../network-host"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "../network-host"
 
 describe("network host helpers", () => {
   it("recognizes IPv4 and IPv6 wildcard forms", () => {
     assert.equal(isWildcardHost("0.0.0.0"), true)
     assert.equal(isWildcardHost("::"), true)
     assert.equal(isWildcardHost("0:0:0:0:0:0:0:0"), true)
+    assert.equal(isWildcardHost("::ffff:0:0"), true)
     assert.equal(isWildcardHost("::1"), false)
   })
 
@@ -18,6 +19,7 @@ describe("network host helpers", () => {
     assert.equal(isLoopbackHost("::0001"), true)
     assert.equal(isLoopbackHost("0:0:0:0:0:0:0:1"), true)
     assert.equal(isLoopbackHost("0:0:0:0:0:0:0:0001"), true)
+    assert.equal(isLoopbackHost("::ffff:7f00:1"), true)
     assert.equal(isLoopbackHost("2001:db8::1"), false)
   })
 
@@ -26,4 +28,11 @@ describe("network host helpers", () => {
     assert.equal(formatHostForUrl("::1"), "[::1]")
     assert.equal(formatHostForUrl("[2001:db8::20]"), "[2001:db8::20]")
   })
+
+  it("normalizes IPv4-mapped addresses and internationalized DNS names", () => {
+    assert.equal(normalizeNetworkHost("::ffff:0:0"), "0.0.0.0")
+    assert.equal(normalizeNetworkHost("::ffff:7f00:1"), "127.0.0.1")
+    assert.equal(normalizeNetworkHost("::ffff:192.168.1.20"), "192.168.1.20")
+    assert.equal(normalizeNetworkHost("münchen.local"), "xn--mnchen-3ya.local")
+  })
 })
diff --git a/packages/server/src/server/__tests__/tls-ipv6.test.ts b/packages/server/src/server/__tests__/tls-ipv6.test.ts
index 0d4133b21..a807e64db 100644
--- a/packages/server/src/server/__tests__/tls-ipv6.test.ts
+++ b/packages/server/src/server/__tests__/tls-ipv6.test.ts
@@ -38,6 +38,20 @@ describe("generated IPv6 certificates", () => {
     assert.equal(rotatedCertificate.checkIP("::1"), "::1")
     assert.equal(rotatedCertificate.checkHost("diagnostics.local"), "diagnostics.local")
   }))
+
+  it("reuses certificates for normalized IDN and scoped IPv6 SAN values", () => withTempConfig((configDir) => {
+    const first = resolveHttpsOptions({ enabled: true, configDir, host: "münchen.local", tlsSANs: "fe80::1%12", logger })
+    assert.ok(first)
+    const firstCertificate = new crypto.X509Certificate(first.httpsOptions.cert)
+
+    const reused = resolveHttpsOptions({ enabled: true, configDir, host: "münchen.local", tlsSANs: "fe80::1%12", logger })
+    assert.ok(reused)
+    const reusedCertificate = new crypto.X509Certificate(reused.httpsOptions.cert)
+
+    assert.equal(reusedCertificate.fingerprint256, firstCertificate.fingerprint256)
+    assert.equal(reusedCertificate.checkHost("xn--mnchen-3ya.local"), "xn--mnchen-3ya.local")
+    assert.equal(reusedCertificate.checkIP("fe80::1"), "fe80::1")
+  }))
 })
 
 function withTempConfig(callback: (configDir: string) => void) {
diff --git a/packages/server/src/server/listener-base-url.ts b/packages/server/src/server/listener-base-url.ts
index b7c1ff497..4d9d40a15 100644
--- a/packages/server/src/server/listener-base-url.ts
+++ b/packages/server/src/server/listener-base-url.ts
@@ -1,5 +1,5 @@
 import { isIP } from "node:net"
-import { formatHostForUrl, isLoopbackHost, isWildcardHost, stripHostBrackets } from "./network-host"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host"
 
 export interface StartedListenerBaseUrlInput {
   protocol: "http" | "https"
@@ -16,7 +16,7 @@ export interface ResolvePluginBaseUrlInput {
 export function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {
   const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))
   if (loopbackListener) {
-    const bindHost = stripHostBrackets(loopbackListener.bindHost)
+    const bindHost = normalizeNetworkHost(loopbackListener.bindHost)
     const loopbackHost = isWildcardHost(bindHost)
       ? isIP(bindHost) === 6 ? "::1" : "127.0.0.1"
       : bindHost
diff --git a/packages/server/src/server/network-addresses.ts b/packages/server/src/server/network-addresses.ts
index 77d83779a..efc1cc030 100644
--- a/packages/server/src/server/network-addresses.ts
+++ b/packages/server/src/server/network-addresses.ts
@@ -1,7 +1,7 @@
 import os from "os"
 import { isIP } from "node:net"
 import type { NetworkAddress } from "../api-types"
-import { formatHostForUrl, isLoopbackHost, isWildcardHost } from "./network-host"
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host"
 
 export interface ResolvedRemoteAddresses {
   all: NetworkAddress[]
@@ -14,19 +14,21 @@ export function resolveNetworkAddresses(args: {
   protocol: "http" | "https"
   port: number
 }): NetworkAddress[] {
-  const { host, protocol, port } = args
+  const { protocol, port } = args
+  const host = normalizeNetworkHost(args.host)
   const interfaces = os.networkInterfaces()
   const seen = new Set<string>()
   const results: NetworkAddress[] = []
 
   const addAddress = (ip: string, scope: NetworkAddress["scope"]) => {
-    const ipVersion = isIP(ip)
-    if (!ipVersion || isWildcardHost(ip) || (ipVersion === 6 && isLinkLocalIPv6(ip))) return
+    const normalizedIp = normalizeNetworkHost(ip)
+    const ipVersion = isIP(normalizedIp)
+    if (!ipVersion || isWildcardHost(normalizedIp) || (ipVersion === 6 && isLinkLocalIPv6(normalizedIp))) return
     const family = ipVersion === 6 ? "ipv6" : "ipv4"
-    const key = `${family}-${ip.toLowerCase()}`
+    const key = `${family}-${normalizedIp}`
     if (seen.has(key)) return
     seen.add(key)
-    results.push({ ip, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(ip)}:${port}` })
+    results.push({ ip: normalizedIp, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(normalizedIp)}:${port}` })
   }
 
   if (isWildcardHost(host)) {
@@ -34,7 +36,7 @@ export function resolveNetworkAddresses(args: {
     for (const entries of Object.values(interfaces)) {
       if (!entries) continue
       for (const entry of entries) {
-        const entryVersion = isIP(entry.address)
+        const entryVersion = isIP(normalizeNetworkHost(entry.address))
         if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4)) continue
         const scope: NetworkAddress["scope"] = entry.internal ? "loopback" : "external"
         addAddress(entry.address, scope)
diff --git a/packages/server/src/server/network-host.ts b/packages/server/src/server/network-host.ts
index e29a9dadb..2bf360ee7 100644
--- a/packages/server/src/server/network-host.ts
+++ b/packages/server/src/server/network-host.ts
@@ -1,31 +1,63 @@
 import { isIP } from "node:net"
+import { domainToASCII } from "node:url"
 
 export function stripHostBrackets(host: string): string {
   const trimmed = host.trim()
   return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed
 }
 
-export function isWildcardHost(host: string): boolean {
+export function normalizeNetworkHost(host: string): string {
   const value = stripHostBrackets(host).toLowerCase()
+  if (isIP(value) === 6) {
+    const canonical = canonicalIPv6(value)
+    const mapped = canonical?.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
+    if (mapped) {
+      const high = Number.parseInt(mapped[1], 16)
+      const low = Number.parseInt(mapped[2], 16)
+      return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`
+    }
+  }
+  if (isIP(value)) return value
+  return domainToASCII(value) || value
+}
+
+export function hasIPv6Zone(host: string): boolean {
+  const value = stripHostBrackets(host)
+  return value.includes("%") && isIP(value) === 6
+}
+
+export function stripIPv6Zone(host: string): string {
+  const value = stripHostBrackets(host)
+  return hasIPv6Zone(value) ? value.slice(0, value.lastIndexOf("%")) : value
+}
+
+export function isWildcardHost(host: string): boolean {
+  const value = normalizeNetworkHost(host)
   if (value === "0.0.0.0") return true
   return isIP(value) === 6 && value.split(":").every((segment) => segment === "" || /^0+$/.test(segment))
 }
 
 export function isLoopbackHost(host: string): boolean {
-  const value = stripHostBrackets(host).toLowerCase()
+  const value = normalizeNetworkHost(host)
   if (value === "localhost") return true
   if (isIP(value) === 4) return value.startsWith("127.")
   if (isIP(value) !== 6) return false
 
-  const mappedIpv4 = value.match(/(?:^|:)ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1]
-  if (mappedIpv4) return isLoopbackHost(mappedIpv4)
-
   const segments = value.split(":")
   const last = segments.pop()
   return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === "" || /^0+$/.test(segment))
 }
 
 export function formatHostForUrl(host: string): string {
-  const value = stripHostBrackets(host)
+  const value = normalizeNetworkHost(host)
   return isIP(value) === 6 ? `[${value}]` : value
 }
+
+function canonicalIPv6(value: string): string | null {
+  if (hasIPv6Zone(value)) return null
+  try {
+    return new URL(`http://[${value}]`).hostname.slice(1, -1)
+  } catch {
+    return null
+  }
+}
diff --git a/packages/server/src/server/tls.ts b/packages/server/src/server/tls.ts
index 744767ec9..7e021eb01 100644
--- a/packages/server/src/server/tls.ts
+++ b/packages/server/src/server/tls.ts
@@ -4,7 +4,7 @@ import path from "path"
 import { createRequire } from "module"
 import { isIP } from "node:net"
 import type { Logger } from "../logger"
-import { isWildcardHost, stripHostBrackets } from "./network-host"
+import { isWildcardHost, normalizeNetworkHost, stripIPv6Zone } from "./network-host"
 
 const require = createRequire(import.meta.url)
 
@@ -221,13 +221,14 @@ function generateServerCertificate(args: {
 }
 
 function pickCommonName(host: string): string {
-  if (!host || isWildcardHost(host)) {
+  const normalizedHost = normalizeCertificateHost(host)
+  if (!normalizedHost || isWildcardHost(normalizedHost)) {
     return "localhost"
   }
-  if (host === "127.0.0.1") {
+  if (normalizedHost === "127.0.0.1") {
     return "localhost"
   }
-  return host
+  return normalizedHost
 }
 
 function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: number; value?: string; ip?: string }> {
@@ -252,7 +253,7 @@ function resolveRequiredSubjectAltNames(host: string, tlsSANs?: string): { dns:
   dns.add("localhost")
   ips.add("127.0.0.1")
 
-  const normalizedHost = stripHostBrackets(host)
+  const normalizedHost = normalizeCertificateHost(host)
   if (isWildcardHost(normalizedHost) && isIP(normalizedHost) === 6) {
     ips.add("::1")
   } else if (normalizedHost) {
@@ -264,7 +265,7 @@ function resolveRequiredSubjectAltNames(host: string, tlsSANs?: string): { dns:
   }
 
   for (const token of splitList(tlsSANs)) {
-    const normalizedToken = stripHostBrackets(token)
+    const normalizedToken = normalizeCertificateHost(token)
     if (isIP(normalizedToken)) {
       ips.add(normalizedToken)
     } else if (normalizedToken) {
@@ -275,6 +276,10 @@ function resolveRequiredSubjectAltNames(host: string, tlsSANs?: string): { dns:
   return { dns, ips }
 }
 
+function normalizeCertificateHost(host: string): string {
+  return normalizeNetworkHost(stripIPv6Zone(host))
+}
+
 function certificateCoversRequiredSans(certificate: crypto.X509Certificate, host: string, tlsSANs?: string): boolean {
   const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs)
   const existingDns = new Set(