Harden packaged identity and local listener binding

tests/remote-server.test.js

@@ -1,5 +1,7 @@
 const { describe, it, beforeEach, afterEach } = require('node:test');
 const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
 
 // Test the module can be required and has the expected API
 describe('RemoteServer', () => {
@@ -39,4 +41,30 @@ describe('RemoteServer', () => {
     assert.strictEqual(server.getClientCount(), 0);
     server.stop();
   });
+
+  it('binds to loopback when no host is supplied', async () => {
+    const RemoteServer = require('../lib/remote-server');
+    const server = new RemoteServer();
+    try {
+      await server.start({
+        port: 0,
+        token: 'test-token-123',
+        onSignalingToCapture: () => {},
+        onCreateCaptureWindow: () => {},
+        onDestroyCaptureWindow: () => {}
+      });
+      assert.strictEqual(server._wss.address().address, '127.0.0.1');
+    } finally {
+      server.stop();
+    }
+  });
+
+  it('keeps the application remote-control listener on loopback', () => {
+    const source = fs.readFileSync(path.join(__dirname, '..', 'main.js'), 'utf8');
+    const start = source.indexOf('async function startRemoteServer()');
+    const end = source.indexOf("ipcMain.on('remote:signaling-from-capture'", start);
+    assert.notStrictEqual(start, -1);
+    assert.notStrictEqual(end, -1);
+    assert.match(source.slice(start, end), /host:\s*'127\.0\.0\.1'/);
+  });
 });