fix(web): bind dual-stack so the Tailscale address the auth layer trusts is reachable (AGT-4290)

[unohee]

The defect

The Tailscale trust path was complete and unreachable. isTailscaleAddress trusts only the IPv6 ULA prefix — CGNAT is refused on purpose, because 100.64.0.0/10 is shared with carriers and proves no identity — but the server bound '0.0.0.0', which is IPv4 only.

Measured on the deployment host:

CGNAT http://100.95.200.28:3847/api/usage       -> 403
ULA   http://[fd7a:115c:a1e0::bc01:c823]:3847/  -> could not connect
host socket: LISTEN 0.0.0.0:3847   (no IPv6 listener)

An operator with their peer listed exactly in OPENSWARM_TAILSCALE_PEERS was still asked for a token on every remote request.

What changed

web.ts	bind '::' instead of '0.0.0.0'; fall back to '0.0.0.0' when IPv6 is unavailable; fix the startup banner
webAuth.ts	require the connection to have arrived on a Tailscale address
tailscaleNetwork.ts	normalise IPv6 spelling in the peer allowlist; fix detectTailscaleIP
webBind.test.ts	new — listens for real and reads back what is reachable

Exposure delta — read this before merging

Binding '::' makes the daemon reachable from address families an IPv4-only bind never exposed: ::1, every fe80:: link-local, every other ULA on the host, and any global IPv6 the host carries. No endpoint becomes newly unauthenticated — the auth gate is address-family agnostic and 403s correctly from a non-loopback IPv6 source — but /api/health, /, /index.html and /issues were already ungated and are now reachable from those families. Operators who treated IPv4 NAT as defence in depth behind OPENSWARM_WEB_TOKEN lose that silently.

The ULA trust itself is the sharper edge. A ULA carries no allocation authority: anyone can assign fd7a:115c:a1e0::… to their own interface. That was moot while nothing could reach the ULA; dual-stack makes it reachable over every interface. So this PR also requires the local end of the socket to be a Tailscale address — the packet came to us through the tailnet, not to our LAN address with a forged source. The Origin header does not backstop it: isTrustedLocalOrigin returns true when there is no Origin, which is every non-browser client.

That check is defence in depth, not proof. An on-link attacker who can also route the ULA prefix defeats it. Real proof needs the Tailscale control plane (node key / capability check), which this process does not talk to.

Why the fallback

A host with ipv6.disable=1 refuses an AF_INET6 bind. The error handler rejected anything but EADDRINUSE, and startService rethrows — so the daemon would not have started at all. Strictly worse than the reach this set out to widen, and it ships to other users through docker-compose.yml.

Verification

Gate	Result
npx tsc --noEmit	exit 0
npm run build	exit 0
npx oxlint (5 files)	0 warnings, 0 errors
vitest src/support src/issues/graphql src/cli/daemonEndpoint.test.ts	exit 0 — 71 files, 807 passed
live socket	one IPv6 TCP *:port listener; [::1] 200, 127.0.0.1 200
bind reverted to '0.0.0.0'	webBind.test.ts fails 2 of 4

That last row is the point. The first cut of this change shipped three tests that all passed with the bind reverted — they exercised webAuth predicates against fabricated requests and never observed a socket. The one line under review was untested.

Review

Layer-2 independent subagent review (openswarm review is not run on my own changes, per the 2026-09-02 policy). It returned REVISE with five MAJORs; all five are fixed here — dead detectTailscaleIP, the self-assignable ULA, the untested bind, unnormalised peer spelling, and the missing IPv6 fallback.

Closes AGT-4290.

🤖 Generated with Claude Code