fix(serve): use localhost as default host instead of ::

Per reviewer feedback, bind to 'localhost' and let the OS decide
IPv4 vs IPv6 resolution, rather than hardcoding '::' (dual-stack).

Also updates the stale 127.0.0.1 comment in api.ts and removes a
redundant ternary in the CORS origin callback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gitnexus/src/cli/serve.ts

@@ -14,7 +14,10 @@ process.on('unhandledRejection', (reason: any) => {
 
 export const serveCommand = async (options?: { port?: string; host?: string }) => {
   const port = Number(options?.port ?? 4747);
-  const host = options?.host ?? '127.0.0.1';
+  // Default to 'localhost' so the OS decides whether to bind to 127.0.0.1 or
+  // ::1 based on system configuration, avoiding spurious CORS errors when the
+  // hosted frontend at gitnexus.vercel.app connects to localhost.
+  const host = options?.host ?? 'localhost';
 
   try {
     await createServer(port, host);

gitnexus/src/server/api.ts

@@ -4,7 +4,7 @@
  * REST API for browser-based clients to query the local .gitnexus/ index.
  * Also hosts the MCP server over StreamableHTTP for remote AI tool access.
  *
- * Security: binds to 127.0.0.1 by default (use --host to override).
+ * Security: binds to localhost by default (use --host to override).
  * CORS is restricted to localhost, private/LAN networks, and the deployed site.
  */
 
@@ -276,14 +276,13 @@ export const createServer = async (port: number, host: string = '127.0.0.1') =>
 
   // CORS: allow localhost, private/LAN networks, and the deployed site.
   // Non-browser requests (curl, server-to-server) have no origin and are allowed.
+  // Disallowed origins get the response without Access-Control-Allow-Origin,
+  // so the browser blocks it. We pass `false` instead of throwing an Error to
+  // avoid crashing into Express's default error handler (which returned 500).
   app.use(
     cors({
       origin: (origin, callback) => {
-        if (isAllowedOrigin(origin)) {
-          callback(null, true);
-        } else {
-          callback(new Error('Not allowed by CORS'));
-        }
+        callback(null, isAllowedOrigin(origin));
       },
     }),
   );
@@ -1248,7 +1247,8 @@ export const createServer = async (port: number, host: string = '127.0.0.1') =>
   // to the caller instead of crashing with an unhandled 'error' event.
   await new Promise<void>((resolve, reject) => {
     const server = app.listen(port, host, () => {
-      console.log(`GitNexus server running on http://${host}:${port}`);
+      const displayHost = host === '::' || host === '0.0.0.0' ? 'localhost' : host;
+      console.log(`GitNexus server running on http://${displayHost}:${port}`);
       resolve();
     });
     server.on('error', (err) => reject(err));