feat: enable IDP, seed me/me, localhost-only by default (#1 phase 2)

The welcome page is HEAD-adaptive: it reveals "Sign in" or "Sign up"
based on what the IDP advertises. With the IDP off (jspod's previous
default), neither button rendered and the only visible CTA was a
docs link going off-site. Turning the IDP on with single-user
seeding flips that page from "read the docs" to "sign in here."

- Flip default `--host` to 127.0.0.1 (was 0.0.0.0). Personal pods
  almost always want localhost; making this the default also lets
  us safely seed deliberately-weak rung-1 credentials.
- Replace `--no-multiuser`-only single-user behaviour with full
  single-user mode: `--no-multiuser --single-user --idp
  --single-user-password me`. JSS hardcodes the username on root
  pods to 'me' (server.js:970), so credentials end up `me` / `me`
  — symmetric, memorable, clearly a placeholder.
- Banner adds a "Sign In (rung 1 of the auth ladder)" section
  showing username, password, and the climb hint. References the
  ladder framing from issue #6.
- Loud red warning if user passes `--host 0.0.0.0` (or any
  non-loopback host) telling them the well-known credentials are
  now reachable beyond localhost.
- README: First Run Guide rewritten around the ladder. Rungs 0-4
  table, climb instructions, and JSS_SINGLE_USER_PASSWORD escape
  hatch for users who want a custom rung-1 password.
- Multi-user mode (`--multiuser`) still works: passes `--idp` so
  the IDP is available for registration, but no `--single-user-*`
  flags so registration stays open.
- Help text: --host default updated to 127.0.0.1.
- Bump jspod to 0.0.10.

This addresses issue #1 phase 2, executed through the lens of
issue #3 (single-user positioning) and issue #6 (auth ladder).

Refs #1 #3 #6

Author: melvincarvalho

README.md

@@ -79,7 +79,7 @@ jspod --multiuser
 ```
 Options:
   -p, --port <number>     Port to listen on (default: 5444)
-  -h, --host <address>    Host to bind to (default: 0.0.0.0)
+  -h, --host <address>    Host to bind to (default: 127.0.0.1)
   -r, --root <path>       Data directory (default: ./pod-data)
   --multiuser             Enable multi-user mode
   --no-auth               Disable authentication
@@ -198,7 +198,7 @@ Under the hood, jspod runs JavaScriptSolidServer with these options:
 ```javascript
 {
   port: 5444,              // Memorable, low collision with common dev servers
-  host: '0.0.0.0',         // Accept connections from anywhere
+  host: '127.0.0.1',       // Localhost-only by default (rung-1 credentials)
   root: './pod-data',      // Local data directory
   multiuser: false,        // Single pod per server
   TOKEN_SECRET: (auto)     // JWT secret (auto-generated, change for production)
@@ -216,6 +216,35 @@ npx jspod
 
 > Running over SSH, in CI, or in a non-interactive terminal? jspod skips auto-open and prints the URL instead. You can also pass `--no-open` to disable it explicitly.
 
+**Step 3**: Sign in (rung 1 of the auth ladder)
+
+The first time you start jspod, an IDP account is seeded with deliberately weak default credentials:
+
+| Field    | Value |
+| -------- | ----- |
+| Username | `me`  |
+| Password | `me`  |
+
+Click **Sign in** on the welcome page, then point a Solid app (like [Pilot](https://solid-apps.github.io/pilot/)) at `http://localhost:5444` and sign in with `me` / `me`.
+
+> **Why are the defaults so weak?** jspod ships you onto the first rung of the auth ladder in under a minute, then guides you up. Rung 1 is **only safe on localhost** — jspod binds to `127.0.0.1` by default for exactly this reason. Once you're in, change the password (rung 2) or add a passkey (rung 3) from your pod's account settings. See [issue #6](https://github.com/JavaScriptSolidServer/jspod/issues/6) for the ladder rationale.
+
+**Step 4**: Climb the ladder
+
+| Rung | Auth                  | How                                          |
+| ---- | --------------------- | -------------------------------------------- |
+| 0    | None                  | `npx jspod --no-auth` (demos / dev only)     |
+| 1    | `me` / `me`           | **Default.** Localhost-only.                 |
+| 2    | Your password         | Change it from your pod's account settings   |
+| 3    | Passkey               | Add a passkey from account settings          |
+| 4    | Hardware key / MFA    | Power-user setup                             |
+
+Override the default password without going through the UI:
+
+```bash
+JSS_SINGLE_USER_PASSWORD='your-password' npx jspod
+```
+
 **Step 3**: Register with a passkey
 - Click "Register" or "Sign Up"
 - Use your device's biometric auth (fingerprint, Face ID, etc.)

index.js

@@ -31,13 +31,20 @@ function formatUrl(host, port) {
 const args = process.argv.slice(2);
 const options = {
   port: 5444,
-  host: '0.0.0.0',
+  host: '127.0.0.1',
   root: './pod-data',
   multiuser: false,
   auth: true,
   open: true
 };
 
+// Auth-ladder rung-1 credentials. See issue #6: jspod ships a deliberately
+// weak default sign-in so the new user is on a working pod within seconds,
+// with a clearly-marked path to climb (change password / add a passkey).
+// Safe because the default host is localhost-only (127.0.0.1).
+const RUNG_1_USERNAME = 'me';
+const RUNG_1_PASSWORD = 'me';
+
 for (let i = 0; i < args.length; i++) {
   const arg = args[i];
 
@@ -66,7 +73,7 @@ for (let i = 0; i < args.length; i++) {
     console.log(chalk.yellow('  jspod') + chalk.dim(' [options]\n'));
     console.log(chalk.white('Options:'));
     console.log(chalk.green('  -p, --port ') + chalk.yellow('<number>') + chalk.dim('     Port to listen on (default: 5444)'));
-    console.log(chalk.green('  -h, --host ') + chalk.yellow('<address>') + chalk.dim('    Host to bind to (default: 0.0.0.0)'));
+    console.log(chalk.green('  -h, --host ') + chalk.yellow('<address>') + chalk.dim('    Host to bind to (default: 127.0.0.1)'));
     console.log(chalk.green('  -r, --root ') + chalk.yellow('<path>') + chalk.dim('       Data directory (default: ./pod-data)'));
     console.log(chalk.green('  --multiuser') + chalk.dim('            Enable multi-user mode'));
     console.log(chalk.green('  --no-auth') + chalk.dim('              Disable authentication'));
@@ -125,6 +132,28 @@ console.log(chalk.cyan('   ├─ ') + chalk.white('Host:      ') + chalk.yellow
 console.log(chalk.cyan('   ├─ ') + chalk.white('Pod Root:  ') + chalk.yellow(options.root));
 console.log(chalk.cyan('   └─ ') + chalk.white('Mode:      ') + (options.multiuser ? chalk.yellow('Multi-user') : chalk.yellow('Single-user')));
 
+if (options.auth && !options.multiuser) {
+  console.log('\n' + chalk.bold.white('🔑 Sign In (rung 1 of the auth ladder):\n'));
+  console.log(chalk.cyan('   ├─ ') + chalk.white('Username:  ') + chalk.bold.green(RUNG_1_USERNAME));
+  console.log(chalk.cyan('   ├─ ') + chalk.white('Password:  ') + chalk.bold.green(RUNG_1_PASSWORD));
+  console.log(chalk.cyan('   └─ ') + chalk.dim('Climb: change the password or add a passkey from account settings'));
+
+  // Loud warning if the rung-1 known credentials are reachable beyond
+  // the local machine. See issue #6 ("auth ladder"): rung 1 is only
+  // safe when the host is loopback-only. Any other bind exposes the
+  // well-known me/me credentials to the LAN (or worse).
+  const isLoopback =
+    options.host === '127.0.0.1' ||
+    options.host === 'localhost' ||
+    options.host === '::1';
+  if (!isLoopback) {
+    console.log('\n' + chalk.bold.red('⚠  Warning: ') + chalk.yellow(
+      `--host ${options.host} exposes the well-known me/me credentials beyond localhost.`
+    ));
+    console.log(chalk.dim('   Set --single-user-password via env (JSS_SINGLE_USER_PASSWORD) or run on 127.0.0.1.'));
+  }
+}
+
 console.log('\n' + chalk.bold.white('✨ Features:\n'));
 console.log(chalk.cyan('   ├─ ') + chalk.green('Solid Protocol     ') + chalk.bold.green('✓'));
 console.log(chalk.cyan('   ├─ ') + chalk.green('WebID Auth         ') + (options.auth ? chalk.bold.green('✓') : chalk.dim('✗')));
@@ -150,8 +179,18 @@ const jssArgs = [
   '--conneg'
 ];
 
-if (!options.multiuser) {
-  jssArgs.push('--no-multiuser');
+if (options.multiuser) {
+  // Multi-user mode is an explicit opt-out from jspod's single-user
+  // positioning (#3). The IDP stays available so users can register.
+  if (options.auth) jssArgs.push('--idp');
+} else {
+  // Default: single-user personal pod with rung-1 credentials seeded.
+  // The pod, IDP, and known credentials are created on first start;
+  // every subsequent start is a no-op (JSS is idempotent on the seed).
+  jssArgs.push('--no-multiuser', '--single-user');
+  if (options.auth) {
+    jssArgs.push('--idp', '--single-user-password', RUNG_1_PASSWORD);
+  }
 }
 
 // Start JSS with enhanced PATH to find the binary

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jspod",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "JavaScript Solid Pod - Just works, batteries included",
   "type": "module",
   "main": "index.js",