fix: prevent persisting degraded exposure mode and align loopback hostname checks

- Do not persist 'local-only' fallback when 'network-accessible' was
  requested but no LAN address was available, preserving the user's
  preference for the next restart.
- Add startsWith('127.') check to isLoopbackHostname in http.ts to
  match the broader 127.x.x.x coverage in ServerAuthPolicy.

Author: cursoragent

apps/desktop/src/main.ts

@@ -220,11 +220,13 @@ async function applyDesktopServerExposureMode(
     ...(advertisedHostOverride ? { advertisedHostOverride } : {}),
   });
 
+  let degraded = false;
   if (mode === "network-accessible" && exposure.mode !== "network-accessible") {
     if (options?.rejectIfUnavailable) {
       throw new Error("No reachable network address is available for this desktop right now.");
     }
     mode = "local-only";
+    degraded = true;
   }
 
   desktopServerExposureMode = exposure.mode;
@@ -241,7 +243,7 @@ async function applyDesktopServerExposureMode(
   backendEndpointUrl = exposure.endpointUrl;
   backendAdvertisedHost = exposure.advertisedHost;
 
-  if (options?.persist || exposure.mode !== mode) {
+  if (!degraded && (options?.persist || exposure.mode !== mode)) {
     writeDesktopSettings(DESKTOP_SETTINGS_PATH, desktopSettings);
   }
 

apps/server/src/http.ts

@@ -34,7 +34,7 @@ export function isLoopbackHostname(hostname: string): boolean {
     .trim()
     .toLowerCase()
     .replace(/^\[(.*)\]$/, "$1");
-  return LOOPBACK_HOSTNAMES.has(normalizedHostname);
+  return LOOPBACK_HOSTNAMES.has(normalizedHostname) || normalizedHostname.startsWith("127.");
 }
 
 export function resolveDevRedirectUrl(devUrl: URL, requestUrl: URL): string {