fix: address Copilot review on PR #7

Four legitimate catches from the review:

1. `--no-auth` was a no-op against JSS. Now forwards JSS's `--public`
   flag so the pod actually skips WAC and accepts unauthenticated
   reads/writes (verified: JSS prints "PUBLIC MODE ENABLED").

2. `JSS_SINGLE_USER_PASSWORD` env override was documented in the
   README but not honoured — the CLI always passed `--single-user-
   password me`, drowning out the env. Now the env value is read in
   jspod, passed to JSS via the CLI flag, AND surfaced in the
   banner ("Sign In (password from JSS_SINGLE_USER_PASSWORD)") so
   the displayed credentials match reality.

3. Loopback detection was too strict — only 127.0.0.1 / localhost /
   ::1 were treated as safe. Expanded to the full 127.0.0.0/8 IPv4
   range (covers Ubuntu's default 127.0.1.1 in /etc/hosts) and the
   bracketed `[::1]` form a user might paste in by accident.

4. README First Run Guide had duplicated Step 3 / Step 4 left over
   from the previous version. Renumbered and removed the obsolete
   "Register with a passkey" step (registration is disabled in
   single-user mode anyway).

Refs #1 #3 #6

Author: melvincarvalho

README.md

@@ -245,15 +245,10 @@ Override the default password without going through the UI:
 JSS_SINGLE_USER_PASSWORD='your-password' npx jspod
 ```
 
-**Step 3**: Register with a passkey
-- Click "Register" or "Sign Up"
-- Use your device's biometric auth (fingerprint, Face ID, etc.)
-- Your WebID will be created automatically
-
-**Step 4**: Start using your pod!
-- Upload files, create resources
-- Use Solid apps to connect to your pod
+**Step 5**: Start using your pod
+- Upload files, create resources from a Solid app
 - Your data stays on your server
+- Connect more apps — they all authenticate against your IDP
 
 **Troubleshooting**:
 - **Port in use?** Run `jspod --port 5445`

index.js

@@ -42,8 +42,13 @@ const options = {
 // weak default sign-in so the new user is on a working pod within seconds,
 // with a clearly-marked path to climb (change password / add a passkey).
 // Safe because the default host is localhost-only (127.0.0.1).
+// Username is fixed by JSS for root pods (server.js:970). Password defaults
+// to 'me' but can be overridden via JSS_SINGLE_USER_PASSWORD so the env
+// override documented in the README actually takes effect (and the banner
+// shows the effective password, not a stale default).
 const RUNG_1_USERNAME = 'me';
-const RUNG_1_PASSWORD = 'me';
+const RUNG_1_PASSWORD = process.env.JSS_SINGLE_USER_PASSWORD || 'me';
+const RUNG_1_PASSWORD_FROM_ENV = !!process.env.JSS_SINGLE_USER_PASSWORD;
 
 for (let i = 0; i < args.length; i++) {
   const arg = args[i];
@@ -133,7 +138,10 @@ console.log(chalk.cyan('   ├─ ') + chalk.white('Pod Root:  ') + chalk.yellow
 console.log(chalk.cyan('   └─ ') + chalk.white('Mode:      ') + (options.multiuser ? chalk.yellow('Multi-user') : chalk.yellow('Single-user')));
 
 if (options.auth && !options.multiuser) {
-  console.log('\n' + chalk.bold.white('🔑 Sign In (rung 1 of the auth ladder):\n'));
+  const rungLabel = RUNG_1_PASSWORD_FROM_ENV
+    ? 'Sign In (password from JSS_SINGLE_USER_PASSWORD):'
+    : 'Sign In (rung 1 of the auth ladder):';
+  console.log('\n' + chalk.bold.white(`🔑 ${rungLabel}\n`));
   console.log(chalk.cyan('   ├─ ') + chalk.white('Username:  ') + chalk.bold.green(RUNG_1_USERNAME));
   console.log(chalk.cyan('   ├─ ') + chalk.white('Password:  ') + chalk.bold.green(RUNG_1_PASSWORD));
   console.log(chalk.cyan('   └─ ') + chalk.dim('Climb: change the password or add a passkey from account settings'));
@@ -142,10 +150,13 @@ if (options.auth && !options.multiuser) {
   // the local machine. See issue #6 ("auth ladder"): rung 1 is only
   // safe when the host is loopback-only. Any other bind exposes the
   // well-known me/me credentials to the LAN (or worse).
+  // Loopback covers the full 127.0.0.0/8 IPv4 range plus IPv6 ::1
+  // (and its bracketed form, which a user might paste in by accident).
   const isLoopback =
-    options.host === '127.0.0.1' ||
     options.host === 'localhost' ||
-    options.host === '::1';
+    /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(options.host) ||
+    options.host === '::1' ||
+    options.host === '[::1]';
   if (!isLoopback) {
     console.log('\n' + chalk.bold.red('⚠  Warning: ') + chalk.yellow(
       `--host ${options.host} exposes the well-known me/me credentials beyond localhost.`
@@ -193,6 +204,13 @@ if (options.multiuser) {
   }
 }
 
+if (!options.auth) {
+  // JSS's `--public` is the real no-auth switch: skip WAC, open
+  // read/write. Without it, `--no-auth` would only mean "no IDP"
+  // — the pod would still be ACL-gated and unreachable.
+  jssArgs.push('--public');
+}
+
 // Start JSS with enhanced PATH to find the binary
 const jss = spawn('jss', jssArgs, {
   stdio: 'inherit',