From 10ae17975d053d9018430caa6fe1f2a39e19fdbf Mon Sep 17 00:00:00 2001
From: Ankit <177378174+anki1kr@users.noreply.github.com>
Date: Sat, 27 Jun 2026 21:21:13 +0530
Subject: [PATCH] fix(serve): honour HOSTNAME from .env instead of hardcoding
 0.0.0.0 (#5134) (#5170)

Integrated into release/v3.8.39. HOSTNAME env override in serve (#5134) + regression test (4/4, TDD flip-proof verified).
---
 bin/cli/commands/serve.mjs            |  2 +-
 tests/unit/cli-serve-hostname.test.ts | 29 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/cli-serve-hostname.test.ts

diff --git a/bin/cli/commands/serve.mjs b/bin/cli/commands/serve.mjs
index 443d1e8c73..af56c49e21 100644
--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -136,7 +136,7 @@ export async function runServe(opts = {}) {
     PORT: String(dashboardPort),
     DASHBOARD_PORT: String(dashboardPort),
     API_PORT: String(apiPort),
-    HOSTNAME: "0.0.0.0",
+    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
     NODE_ENV: "production",
     NODE_OPTIONS: `--max-old-space-size=${memoryLimit}`,
   };
diff --git a/tests/unit/cli-serve-hostname.test.ts b/tests/unit/cli-serve-hostname.test.ts
new file mode 100644
index 0000000000..64573aa2c1
--- /dev/null
+++ b/tests/unit/cli-serve-hostname.test.ts
@@ -0,0 +1,29 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+/**
+ * Replicate the HOSTNAME resolution from bin/cli/commands/serve.mjs to verify
+ * that the spawned server honours a HOSTNAME provided via env/.env instead of
+ * always hardcoding "0.0.0.0" (#5134). Mirrors the in-file replication pattern
+ * used by cli-serve-port.test.ts (serve.mjs spawns processes, so the logic is
+ * tested in isolation rather than imported).
+ */
+function resolveHostname(envHostname: string | undefined): string {
+  return envHostname || "0.0.0.0";
+}
+
+test("serve hostname: honours HOSTNAME env var when set", () => {
+  assert.equal(resolveHostname("127.0.0.1"), "127.0.0.1");
+});
+
+test("serve hostname: honours a specific bind interface", () => {
+  assert.equal(resolveHostname("192.168.0.15"), "192.168.0.15");
+});
+
+test("serve hostname: falls back to 0.0.0.0 when HOSTNAME is unset", () => {
+  assert.equal(resolveHostname(undefined), "0.0.0.0");
+});
+
+test("serve hostname: falls back to 0.0.0.0 when HOSTNAME is an empty string", () => {
+  assert.equal(resolveHostname(""), "0.0.0.0");
+});