fix(server): allow managed public host binding.

Permit an explicit managed-deployment escape hatch so Claw3D can bind to 0.0.0.0 on Fly without requiring a studio access token.

Made-with: Cursor

server/network-policy.js

@@ -63,11 +63,15 @@ const isPublicHost = (host) => {
   return true;
 };
 
-const assertPublicHostAllowed = ({ host, studioAccessToken }) => {
+const allowPublicHostWithoutStudioToken = (env = process.env) =>
+  /^(1|true)$/i.test(String(env.ALLOW_PUBLIC_HOST_WITHOUT_STUDIO_TOKEN ?? "").trim());
+
+const assertPublicHostAllowed = ({ host, studioAccessToken, env = process.env }) => {
   if (!isPublicHost(host)) return;
 
   const token = String(studioAccessToken ?? "").trim();
   if (token) return;
+  if (allowPublicHostWithoutStudioToken(env)) return;
 
   const normalized = normalizeHost(host) || String(host ?? "").trim() || "(unknown)";
   throw new Error(
@@ -77,6 +81,7 @@ const assertPublicHostAllowed = ({ host, studioAccessToken }) => {
 };
 
 module.exports = {
+  allowPublicHostWithoutStudioToken,
   resolveHosts,
   resolveHost,
   isPublicHost,

tests/unit/serverNetworkPolicy.test.ts

@@ -58,4 +58,17 @@ describe("server network policy", () => {
       assertPublicHostAllowed({ host: "0.0.0.0", studioAccessToken: "abc" })
     ).not.toThrow();
   });
+
+  it("allows public bind when explicitly opted in for managed deployments", async () => {
+    const { assertPublicHostAllowed } = await import("../../server/network-policy");
+    expect(() =>
+      assertPublicHostAllowed({
+        host: "0.0.0.0",
+        studioAccessToken: "",
+        env: {
+          ALLOW_PUBLIC_HOST_WITHOUT_STUDIO_TOKEN: "true",
+        } as unknown as NodeJS.ProcessEnv,
+      })
+    ).not.toThrow();
+  });
 });