fix(web): show localhost entry only for local binds

web/backend/main.go

@@ -180,6 +180,39 @@ func appendLauncherConsoleHostList(hosts []string, seen map[string]struct{}, val
 	return hosts
 }
 
+func shouldShowLocalhostConsoleEntry(hostInput string) bool {
+	normalizedHostInput := strings.TrimSpace(hostInput)
+	if normalizedHostInput == "" {
+		return true
+	}
+
+	for token := range strings.SplitSeq(normalizedHostInput, ",") {
+		token = strings.TrimSpace(token)
+		if token == "" {
+			continue
+		}
+		if token == "*" || strings.EqualFold(token, "localhost") {
+			return true
+		}
+
+		ip := net.ParseIP(strings.Trim(token, "[]"))
+		if ip == nil {
+			continue
+		}
+		if ip4 := ip.To4(); ip4 != nil {
+			if ip4.String() == "127.0.0.1" || ip4.String() == "0.0.0.0" {
+				return true
+			}
+			continue
+		}
+		if ip.String() == "::1" || ip.String() == "::" {
+			return true
+		}
+	}
+
+	return false
+}
+
 func isConsoleDisplayGlobalIPv6(ip net.IP) bool {
 	if ip == nil || ip.IsLoopback() || ip.To4() != nil {
 		return false
@@ -200,7 +233,9 @@ func launcherConsoleHostsWithLocalAddrs(
 	hosts := make([]string, 0, 8)
 	seen := make(map[string]struct{}, 8)
 
-	hosts = appendUniqueHost(hosts, seen, "localhost")
+	if shouldShowLocalhostConsoleEntry(hostInput) {
+		hosts = appendUniqueHost(hosts, seen, "localhost")
+	}
 
 	normalizedHostInput := strings.TrimSpace(hostInput)
 	if normalizedHostInput == "" {

web/backend/main_test.go

@@ -227,14 +227,27 @@ func TestLauncherConsoleHosts(t *testing.T) {
 		}
 	})
 
-	t.Run("explicit multi-address binding shows all exact ipv4 and global ipv6 addresses", func(t *testing.T) {
+	t.Run("explicit wildcard star shows localhost first", func(t *testing.T) {
+		hosts := launcherConsoleHostsWithLocalAddrs(
+			"*",
+			false,
+			[]string{"192.168.1.2", "10.0.0.8"},
+			[]string{"2001:db8::1", "2001:db8::2"},
+		)
+		want := []string{"localhost", "2001:db8::1", "2001:db8::2", "192.168.1.2", "10.0.0.8"}
+		if strings.Join(hosts, ",") != strings.Join(want, ",") {
+			t.Fatalf("hosts = %#v, want %#v", hosts, want)
+		}
+	})
+
+	t.Run("explicit multi-address binding without local tokens hides localhost", func(t *testing.T) {
 		hosts := launcherConsoleHostsWithLocalAddrs(
 			"192.168.1.2,10.0.0.8,2001:db8::1,2001:db8::2,fe80::1",
 			false,
 			[]string{"192.168.1.2", "10.0.0.8"},
 			[]string{"2001:db8::1", "2001:db8::2"},
 		)
-		want := []string{"localhost", "192.168.1.2", "10.0.0.8", "2001:db8::1", "2001:db8::2"}
+		want := []string{"192.168.1.2", "10.0.0.8", "2001:db8::1", "2001:db8::2"}
 		if strings.Join(hosts, ",") != strings.Join(want, ",") {
 			t.Fatalf("hosts = %#v, want %#v", hosts, want)
 		}