로컬 에이전트 하네스를 위한 루프백 전용 DNS 적용 (bind + LLM 클라이언트)

I can't audit your repo directly since I don't have access to it, but here's a concrete plan and reference implementation you can apply. I'll structure it as (1) bind-side assertions, (2) client-side resolver, (3) verification, and (4) the unit test.

## 1. Server binds: post-bind loopback assertion

For every `TcpListener::bind(host)` where `host` is a string like `"localhost"` or `"127.0.0.1"`, add an assertion immediately after bind. The key point: `local_addr()` reflects the *resolved* address the kernel actually bound to, so this closes the hostname-vs-address gap.

```rust
use std::io;
use std::net::TcpListener;

fn bind_loopback(host: &str, port: u16) -> io::Result<TcpListener> {
    let listener = TcpListener::bind((host, port))?;
    let addr = listener.local_addr()?;
    if !addr.ip().is_loopback() {
        return Err(io::Error::new(
            io::ErrorKind::AddrNotAvailable,
            format!(
                "refusing to serve on non-loopback address {addr} (requested host={host:?}); \
                 this endpoint is intended for local use only"
            ),
        ));
    }
    Ok(listener)
}
```

Apply the same pattern to every bind site. Grep for candidates:

```bash
rg -n 'TcpListener::bind|\.bind\(|bind_addr|listen\(' --type rust
rg -n 'localhost|127\.0\.0\.1|::1' --type rust
```

For async stacks (tokio, axum, hyper), the shape is the same:

```rust
let listener = tokio::net::TcpListener::bind((host, port)).await?;
let addr = listener.local_addr()?;
if !addr.ip().is_loopback() {
    return Err(anyhow::anyhow!(
        "refusing to bind non-loopback address {addr} (host={host:?})"
    ));
}
```

Notes:
- Fail *closed*: return an error, don't log-and-continue.
- Do this even when `host` is `"127.0.0.1"` — it's cheap and catches config drift (e.g. someone swaps in `0.0.0.0`).
- If you have a config layer that accepts `host: String`, put the assertion in the single function that constructs the listener so every caller inherits it.

## 2. HTTP clients: custom resolver for local services

For clients pointed at `http://localhost:PORT` (local model servers, sidecars, etc.), install a resolver that validates the *answer*, not the hostname. This eliminates the check-then-connect gap because the resolver's output is what the connector dials.

```rust
use std::io;
use std::net::{IpAddr, SocketAddr, ToSocketAddrs};

const MAX_ADDRS: usize = 8;

/// Filter a resolved address list: non-empty, bounded, entirely loopback.
pub fn filter_loopback_addrs(addrs: Vec<SocketAddr>) -> io::Result<Vec<SocketAddr>> {
    if addrs.is_empty() {
        return Err(io::Error::new(
            io::ErrorKind::NotFound,
            "resolver returned no addresses",
        ));
    }
    if addrs.len() > MAX_ADDRS {
        return Err(io::Error::new(
            io::ErrorKind::InvalidData,
            format!("resolver returned {} addresses (max {MAX_ADDRS})", addrs.len()),
        ));
    }
    if let Some(bad) = addrs.iter().find(|a| !a.ip().is_loopback()) {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            format!("resolver returned non-loopback address {bad}; refusing to connect"),
        ));
    }
    Ok(addrs)
}

/// Resolver used by the HTTP client for local-service URLs.
pub fn resolve_loopback(host: &str, port: u16) -> io::Result<Vec<SocketAddr>> {
    let addrs: Vec<SocketAddr> = (host, port).to_socket_addrs()?.collect();
    filter_loopback_addrs(addrs)
}
```

Wire it into the client. With `reqwest`:

```rust
use reqwest::dns::{Addrs, Name, Resolve, Resolving};
use std::sync::Arc;

#[derive(Debug)]
struct LoopbackResolver;

impl Resolve for LoopbackResolver {
    fn resolve(&self, name: Name) -> Resolving {
        let host = name.as_str().to_owned();
        Box::pin(async move {
            let addrs = tokio::task::spawn_blocking(move || {
                let resolved: Vec<SocketAddr> =
                    (host.as_str(), 0u16).to_socket_addrs()?.collect();
                filter_loopback_addrs(resolved)
            })
            .await
            .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)?
            .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)?;
            let iter: Addrs = Box::new(addrs.into_iter());
            Ok(iter)
        })
    }
}

let client = reqwest::Client::builder()
    .dns_resolver(Arc::new(LoopbackResolver))
    .build()?;
```

With `hyper`/`hyper-util`, use `HttpConnector::set_resolver` with an equivalent `Resolve` impl. With `ureq`, use `AgentBuilder::resolver(...)`.

Important: the resolver must be the *only* path to a socket for these clients. If any code path calls `TcpStream::connect("localhost:…")` directly, it bypasses the filter — route those through the same helper.

## 3. Leave IP-literal URLs untouched

`http://127.0.0.1:PORT` and `http://[::1]:PORT` never invoke a resolver — the connector parses the literal and dials it. That's fine and desirable: no DNS, no gap. Just make sure your code doesn't accidentally rewrite literals into hostnames (e.g. via URL normalization) and that the resolver isn't installed on clients that only ever see literals (harmless, but noise).

A quick audit grep:

```bash
rg -n 'http://localhost|https://localhost|localhost:' --type rust --type ts --type py
rg -n 'http://127\.0\.0\.1|http://\[::1\]' --type rust --type ts --type py
```

## 4. Verification

### Positive run

```bash
# Start a mock local server on loopback
python3 -m http.server 18080 --bind 127.0.0.1 &
MOCK_PID=$!
trap 'kill $MOCK_PID 2>/dev/null' EXIT

# Point the client at localhost and confirm it connects
cargo run --bin probe -- --url http://localhost:18080/health
# expect: success
```

### Negative run

Temporarily map `localhost` to a non-loopback address, then restore with a trap. Use a private `/etc/hosts` override via a container or a `HOSTALIASES`-style shim; the simplest portable approach is a temporary hosts file plus `LD_PRELOAD`-free override through `nsswitch` is fragile, so prefer a container or a bind-mount:

```bash
set -euo pipefail
HOSTS_BAK=$(mktemp)
cp /etc/hosts "$HOSTS_BAK"
restore() { cp "$HOSTS_BAK" /etc/hosts; rm -f "$HOSTS_BAK"; }
trap restore EXIT

# Point localhost at a non-loopback address (use a real non-loopback IP on this host)
NONLOOP=$(ip -4 addr show scope global | awk '/inet /{print $2}' | cut -d/ -f1 | head -n1)
printf '127.0.0.1 localhost\n%s localhost\n' "$NONLOOP" > /etc/hosts

# Expect the client to fail closed with a clear error
if cargo run --bin probe -- --url http://localhost:18080/health; then
  echo "FAIL: client connected to non-loopback localhost" >&2
  exit 1
else
  echo "OK: client refused non-loopback localhost"
fi
```

If you can't touch `/etc/hosts` (CI sandboxes), run the negative case in a container with a custom `/etc/hosts`, or inject a test resolver that returns a non-loopback address and assert `filter_loopback_addrs` rejects it — that's the unit test below.

Also add a bind-side negative: start the server with `--host 0.0.0.0` and assert it exits non-zero with the "refusing to serve on non-loopback address" message.

## 5. Unit test pinning the resolver filter

```rust
#[cfg(test)]
mod tests {
    use super::*;
    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};

    fn sa(ip: IpAddr, port: u16) -> SocketAddr { SocketAddr::new(ip, port) }

    #[test]
    fn empty_answer_is_rejected() {
        let err = filter_loopback_addrs(vec![]).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::NotFound);
    }

    #[test]
    fn mixed_answer_is_rejected() {
        let addrs = vec![
            sa(IpAddr::V4(Ipv4Addr::LOCALHOST), 8080),
            sa(IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)), 8080),
        ];
        let err = filter_loopback_addrs(addrs).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::PermissionDenied);
        assert!(err.to_string().contains("non-loopback"));
    }

    #[test]
    fn oversized_answer_is_rejected() {
        let addrs: Vec<_> = (0..=MAX_ADDRS)
            .map(|_| sa(IpAddr::V4(Ipv4Addr::LOCALHOST), 8080))
            .collect();
        let err = filter_loopback_addrs(addrs).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn all_loopback_v4_and_v6_is_accepted() {
        let addrs = vec![
            sa(IpAddr::V4(Ipv4Addr::LOCALHOST), 8080),
            sa(IpAddr::V6(Ipv6Addr::LOCALHOST), 8080),
        ];
        let out = filter_loopback_addrs(addrs.clone()).unwrap();
        assert_eq!(out, addrs);
    }
}
```

## Checklist to run against the repo

- [ ] Every `TcpListener::bind` / `tokio::net::TcpListener::bind` / `axum::serve` / `hyper::Server::bind` site goes through `bind_loopback` (or equivalent) with the post-bind assertion.
- [ ] Every HTTP client targeting a local model/service uses `LoopbackResolver` (or the stack's equivalent) — no direct `TcpStream::connect("localhost:…")` bypass.
- [ ] IP-literal URLs are left alone; confirm no URL normalization rewrites them to hostnames.
- [ ] Positive run against a mock loopback server passes.
- [ ] Negative run with `localhost` → non-loopback fails closed with a clear message; `/etc/hosts` restored via `trap`.
- [ ] Unit tests cover empty, mixed, oversized, and all-loopback (v4+v6) answers.
- [ ] Bind-side negative test: `--host 0.0.0.0` exits non-zero.

If you paste the relevant bind sites and client construction code, I can point at the exact lines to change.