Web UI & remote access

The embedded server

Settings ▸ Web UI in the desktop app serves SpecForge at http://127.0.0.1:<port> — a browser tab mirroring the app’s live state, useful for a second monitor or a browser-native reading setup. It binds loopback only, and no setting exists that can move it onto a network interface.

specforge-serve

The standalone binary serves the same UI without the desktop app — a homelab box, a headless server, the machine where the repositories actually live. It binds 127.0.0.1:4317 by default and renders the workspaces registered on the machine running it.

The web UI behaves like a site, not a port of an app: browser back and forward work, and every view has a durable URL you can bookmark or paste. Settings that only make sense on the desktop are hidden.

The trust boundary

Reachability and authorisation are separate concerns. The bound interface decides who can open a socket; a request-authority allow-list decides which page may drive the API. On loopback, every request’s Origin and Host are checked against known authorities — loopback itself, plus your machine’s own Tailscale name when that is enabled — so a stray web page in your browser cannot quietly drive a server that reads your filesystem.

Remote access, the sanctioned way

For access beyond the machine, SpecForge supports Tailscale Serve: the proxy connects to the loopback port, and SpecForge trusts your machine’s own tailnet name — resolved automatically, with a manual override, and failing closed when no name is available. The server itself never binds a network interface for this.

An optional allow-list of Tailscale logins narrows it further: when set, a proxied request is accepted only if Tailscale identifies the visitor as one of those users. Left empty, the tailnet itself is the boundary. Local loopback requests never need a login, and Tailscale Funnel — public-internet exposure — is not supported at all.

An SSH tunnel (ssh -L 4317:127.0.0.1:4317 host) works too, with no configuration: from the server’s point of view you are a loopback visitor.

The --bind escape hatch

specforge-serve --bind 0.0.0.0 publishes the UI on a network interface directly — unauthenticated, with the authority checks necessarily stood down. The network you publish on, and every site any browser on it visits, becomes the trust boundary. It exists for networks you genuinely trust; the flag is per-invocation and never persisted, so the exposure cannot outlive the command that asked for it.