docs: update test counts and document the local server security model

README.md

@@ -173,13 +173,13 @@ Everything below was executed on a clean clone in this repository state:
 | `npm run typecheck:extensions` | exit 0 |
 | `npm run lint` | exit 0 (0 errors, 109 warnings) |
 | `npm run build` | exit 0, `dist/` about 14 MB |
-| `npm run test:run` | 89 files, 319 tests, all passing |
+| `npm run test:run` | 95 files, 426 tests, all passing (on Node 22 in CI; see the Node 25+ note below) |
 | `npm run validate` | exit 0 (the same gate CI runs in `build.yml`) |
 | `cargo check` in `src-router/` | exit 0 |
 | `cargo check --manifest-path src-tauri/Cargo.toml` | exit 0 (1 warning) |
 | extension server over HTTP | `/global/health` 200, `/` 200 with `PI_BOOT_DATA`, `/api/models` 200 with token and 401 without, `/api/sessions`, `/api/sessions/:id/messages`, `/api/sessions/:id/context`, `/api/skills`, `/api/mcp/status`, `/api/commands/list`, `/api/network/access` all 200, `/global/event` 200 `text/event-stream` |
 
-Two things to know when running the suite: `npm run test:run` needs `dist/` to exist, because the extension server test fetches the served `index.html`, so `npm run build` must run first (that is the order in `npm run validate`); and `npm run format:check` currently reports 67 files that are not Prettier-formatted, so `npm run check` fails on that step even though the CI gate passes.
+Two things to know when running the suite: `npm run test:run` needs `dist/` to exist, because the extension server test fetches the served `index.html`, so `npm run build` must run first (that is the order in `npm run validate`); and `npm run format:check` currently reports 66 files that are not Prettier-formatted, so `npm run check` fails on that step even though the CI gate passes. On Node 25 and newer, Node's built-in `localStorage` shadows the jsdom one and two `settingsBackup` tests fail; running them with `NODE_OPTIONS=--no-experimental-webstorage` makes them pass.
 
 ## Current state and limitations
 
@@ -190,6 +190,7 @@ Two things to know when running the suite: `npm run test:run` needs `dist/` to e
 - `@mariozechner/pi-coding-agent` is a devDependency for types only (the runtime provides the real extension API), and npm marks that package line as deprecated in favour of `@earendil-works/pi-coding-agent`.
 - The front end talks to one runtime per window: the discovery file or a manually configured server. There is no multi-runtime aggregation.
 - Voice input exists in the UI (`src/hooks/useVoiceTranscription.ts`) and requires an OpenAI-compatible STT endpoint configured in settings; it is not covered by an automated browser test.
+- Security model of the local server: it binds `0.0.0.0` but answers only loopback `Host`/`Origin` values until LAN access is enabled, and `/api/*` needs the bearer token from the discovery file (generated with `crypto.randomBytes` and stored with mode `0600`). Once LAN access is enabled in settings, requests from private-network hosts are accepted without a token, so turn it on only on networks you trust: the API can read project files and manage Git and extensions. There is no per-user authentication.
 - No published npm package and no hosted web demo; both README and code assume a local runtime.
 - `docker-frontend.yml` last ran on 2026-06-01 and failed at the build step, so `ghcr.io/evandrodevbr/opencodeui-frontend` was never published (verified against GHCR with the owner credentials); the compose files pull that one image from upstream until the workflow is fixed.