fix(core): treat [::1] IPv6 literal as loopback origin (PER-8600)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Shivanshu-07

packages/core/src/server.js

@@ -17,9 +17,10 @@ import {
 export function isLoopbackOrigin(origin) {
   if (!origin || typeof origin !== 'string') return false;
   try {
-    // URL.hostname strips the brackets from an IPv6 literal, so `[::1]`
-    // normalises to `::1` here — no need to match the bracketed form.
+    // URL.hostname KEEPS the brackets around an IPv6 literal, so `[::1]`
+    // stays `[::1]` here and must be unwrapped before matching `::1`.
     let host = new URL(origin).hostname.toLowerCase();
+    if (host.startsWith('[') && host.endsWith(']')) host = host.slice(1, -1);
     return host === 'localhost' || host === '127.0.0.1' ||
       host === '::1' || host.endsWith('.localhost');
   } catch {

packages/core/test/unit/server.test.js

@@ -323,6 +323,11 @@ describe('Unit / Server', () => {
       expect(isLoopbackOrigin('http://app.localhost')).toBe(true);
     });
 
+    it('returns true for the bracketed IPv6 loopback literal', () => {
+      expect(isLoopbackOrigin('http://[::1]:5338')).toBe(true);
+      expect(isLoopbackOrigin('http://[::1]')).toBe(true);
+    });
+
     it('returns false for non-loopback and missing origins', () => {
       expect(isLoopbackOrigin('https://evil.example.com')).toBe(false);
       expect(isLoopbackOrigin('')).toBe(false);