[wcares]

Problem. In the managed backend agent-computer starts Bun.serve({ port }) with no hostname (src/browser-runtime.ts sets hostname: "127.0.0.1" only for local-chrome, and src/index.ts
passes a hostname only when the runtime has one). Bun then listens on every interface. The same process serves /exec (a shell) and /files/*, behind COMPUTER_TOKEN only. In the intended
deployment (a container or a pod) that is fine, but anyone who runs the managed computer directly on a person's own machine (a developer on macOS or Windows, which browser-runtime.ts already
anticipates: "A developer running this directly on a Mac or Windows keeps headless") exposes a token-protected shell and file API to the whole local network, and on Windows triggers the firewall
prompt.

Measured (OpenBot 46642d6, Bun 1.4.3, Linux): COMPUTER_TOKEN=x PORT=47401 COMPUTER_BROWSER_MODE=headless bun run agent-computer/src/index.ts listens on *:47401; a request to the machine's
LAN address gets 200 from /health and 401 from POST /exec (reachable). Bun's server.hostname prints localhost in that state, and HOST / HOSTNAME environment variables change nothing, so
there is no existing setting that closes it.

Fix. A new optional COMPUTER_BIND: when set, the managed computer listens on that address (127.0.0.1 keeps it on the machine). Unset keeps today's behaviour exactly, so container images do not change.
local-chrome still always binds 127.0.0.1. No behaviour change by default.

Test. tests/browser-runtime.test.ts: unset gives no hostname; COMPUTER_BIND=" 127.0.0.1 " gives 127.0.0.1 (trimmed); allowExec unchanged.

After the change (this exact opt-in diff on current upstream main 743649e, Bun 1.4.3, Linux; git apply --check also clean on 46642d6): unset still listens on *:47421 (LAN /health 200, unchanged); COMPUTER_BIND=127.0.0.1 listens on 127.0.0.1:47422, loopback /health 200 and a LAN connection is refused; bun test tests/browser-runtime.test.ts: 14 pass, 0 fail (with the new test).

Note (not part of this change): the startup line is hard-coded, agent-computer listening on http://127.0.0.1:<port>, and prints it also when the process listens on every interface (measured above: the line says 127.0.0.1 while ss shows *:47421), which is how the open listener went unnoticed. Printing the address the process was actually told to bind (or "all interfaces") would make it visible.
Suggested follow-up (not in this PR): say in the README that running a managed computer outside a container should set COMPUTER_BIND=127.0.0.1.

🤖 Generated with Claude Code