# Task 7 Report: `claw-forge ui --host` defaulting to loopback

## Status
✅ COMPLETE

## Commit
`959a543` — fix(ui): add --host defaulting to 127.0.0.1 (token-injecting proxy shouldn't bind 0.0.0.0)

## Test Result
Pre-fix: FAILED (no `host` parameter)
Post-fix: **PASSED** (1 passed in 0.29s)

## Changes
1. Created `tests/test_ui_cli_host.py` — test verifies `host` parameter exists with default `127.0.0.1`
2. Added `host: str = typer.Option("127.0.0.1", "--host", help=...)` to `ui()` signature (after `state_port`)
3. Changed `uvicorn.run(static_app, host="0.0.0.0", ...)` to `uvicorn.run(static_app, host=host, ...)`
4. Removed `# noqa: S104` — no longer needed (default is now loopback; S104 only flags bind-all-interfaces)

## Lint Status
✅ `uv run ruff check claw_forge/ tests/` — All checks passed

## Concerns
None. The fix is minimal and targeted:
- Default loopback binding prevents the security gap (token-injecting proxy on all interfaces)
- Explicit `--host 0.0.0.0` allows opt-in for shared-box workflows if needed
- State service binding stays `0.0.0.0` by design (unchanged, as required)
- Test-driven flow completed without issues
