fix: address Copilot review 2 on PR #7

Four follow-ups from the second pass:

1. Banner no longer prints the env-provided password verbatim. When
   the credential comes from JSS_SINGLE_USER_PASSWORD, the banner
   confirms "(hidden — set via JSS_SINGLE_USER_PASSWORD)" instead of
   echoing the value to stdout. Default rung-1 'me' still prints
   (the user doesn't know it yet, and it has no secrecy property).
   Avoids leaking real passwords into terminal scrollback, shell
   history capture, CI logs, and shared sessions.

2. `--host [::1]` (bracketed IPv6) now parses cleanly. Brackets are
   stripped at CLI parse time, so options.host stays canonical
   ('::1'), and formatUrl re-adds brackets only where URLs need
   them. Previously the bracketed form would round-trip through
   formatUrl as http://[[::1]]:PORT (invalid).

3. LAN-exposure warning no longer references a `--single-user-
   password` jspod flag that doesn't exist. It now points users to
   JSS_SINGLE_USER_PASSWORD=... or binding to 127.0.0.1.

4. README's "Default Configuration" code block previously claimed
   TOKEN_SECRET was "(auto)" / "auto-generated". The code actually
   uses a static fallback ('jspod-default-secret-change-in-
   production'). Documentation now matches reality. A real
   per-data-dir secret-generator can land in a follow-up PR.

Refs #1 #3 #6

Author: melvincarvalho

README.md

@@ -201,7 +201,8 @@ Under the hood, jspod runs JavaScriptSolidServer with these options:
   host: '127.0.0.1',       // Localhost-only by default (rung-1 credentials)
   root: './pod-data',      // Local data directory
   multiuser: false,        // Single pod per server
-  TOKEN_SECRET: (auto)     // JWT secret (auto-generated, change for production)
+  TOKEN_SECRET: 'jspod-default-secret-change-in-production'
+                           // Static fallback. Override via env for any non-local use.
 }
 ```
 

index.js

@@ -56,7 +56,11 @@ for (let i = 0; i < args.length; i++) {
   if (arg === '--port' || arg === '-p') {
     options.port = parseInt(args[++i], 10);
   } else if (arg === '--host' || arg === '-h') {
-    options.host = args[++i];
+    // Strip optional brackets from IPv6 literals so a user-friendly
+    // `--host [::1]` paste-in stays canonical. formatUrl re-adds the
+    // brackets where they belong in URLs; the raw host going to JSS
+    // and to comparisons remains the unbracketed literal.
+    options.host = args[++i].replace(/^\[|\]$/g, '');
   } else if (arg === '--root' || arg === '-r') {
     options.root = args[++i];
   } else if (arg === '--multiuser') {
@@ -143,25 +147,35 @@ if (options.auth && !options.multiuser) {
     : 'Sign In (rung 1 of the auth ladder):';
   console.log('\n' + chalk.bold.white(`🔑 ${rungLabel}\n`));
   console.log(chalk.cyan('   ├─ ') + chalk.white('Username:  ') + chalk.bold.green(RUNG_1_USERNAME));
-  console.log(chalk.cyan('   ├─ ') + chalk.white('Password:  ') + chalk.bold.green(RUNG_1_PASSWORD));
+  // Only print the literal password when it's the rung-1 default. If
+  // the user set a real password via env, echoing it to stdout would
+  // leak into terminal scrollback, shell history capture, CI logs, and
+  // shared sessions. They already know the value they set; the banner
+  // just confirms it was picked up.
+  if (RUNG_1_PASSWORD_FROM_ENV) {
+    console.log(chalk.cyan('   ├─ ') + chalk.white('Password:  ') + chalk.dim('(hidden — set via JSS_SINGLE_USER_PASSWORD)'));
+  } else {
+    console.log(chalk.cyan('   ├─ ') + chalk.white('Password:  ') + chalk.bold.green(RUNG_1_PASSWORD));
+  }
   console.log(chalk.cyan('   └─ ') + chalk.dim('Climb: change the password or add a passkey from account settings'));
 
   // Loud warning if the rung-1 known credentials are reachable beyond
   // the local machine. See issue #6 ("auth ladder"): rung 1 is only
   // safe when the host is loopback-only. Any other bind exposes the
   // well-known me/me credentials to the LAN (or worse).
-  // Loopback covers the full 127.0.0.0/8 IPv4 range plus IPv6 ::1
-  // (and its bracketed form, which a user might paste in by accident).
+  // Loopback covers the full 127.0.0.0/8 IPv4 range plus IPv6 ::1.
+  // (Bracketed `[::1]` input is stripped to `::1` at CLI parse time
+  // — see options.host parsing — so it matches here without a
+  // bracketed branch.)
   const isLoopback =
     options.host === 'localhost' ||
     /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(options.host) ||
-    options.host === '::1' ||
-    options.host === '[::1]';
+    options.host === '::1';
   if (!isLoopback) {
     console.log('\n' + chalk.bold.red('⚠  Warning: ') + chalk.yellow(
       `--host ${options.host} exposes the well-known me/me credentials beyond localhost.`
     ));
-    console.log(chalk.dim('   Set --single-user-password via env (JSS_SINGLE_USER_PASSWORD) or run on 127.0.0.1.'));
+    console.log(chalk.dim('   Set JSS_SINGLE_USER_PASSWORD=... before running, or bind to 127.0.0.1.'));
   }
 }