refactor: centralize isPlainObject, isRecord, isErrno, isLoopbackHost utilities (#12926)

src/gateway/config-reload.ts

@@ -2,6 +2,7 @@ import chokidar from "chokidar";
 import type { OpenClawConfig, ConfigFileSnapshot, GatewayReloadMode } from "../config/config.js";
 import { type ChannelId, listChannelPlugins } from "../channels/plugins/index.js";
 import { getActivePluginRegistry } from "../plugins/runtime.js";
+import { isPlainObject } from "../utils.js";
 
 export type GatewayReloadSettings = {
   mode: GatewayReloadMode;
@@ -126,15 +127,6 @@ function matchRule(path: string): ReloadRule | null {
   return null;
 }
 
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return Boolean(
-    value &&
-    typeof value === "object" &&
-    !Array.isArray(value) &&
-    Object.prototype.toString.call(value) === "[object Object]",
-  );
-}
-
 export function diffConfigPaths(prev: unknown, next: unknown, prefix = ""): string[] {
   if (prev === next) {
     return [];

src/gateway/net.ts

@@ -255,6 +255,20 @@ function isValidIPv4(host: string): boolean {
   });
 }
 
+/**
+ * Check if a hostname or IP refers to the local machine.
+ * Handles: localhost, 127.x.x.x, ::1, [::1], ::ffff:127.x.x.x
+ * Note: 0.0.0.0 and :: are NOT loopback - they bind to all interfaces.
+ */
 export function isLoopbackHost(host: string): boolean {
-  return isLoopbackAddress(host);
+  if (!host) {
+    return false;
+  }
+  const h = host.trim().toLowerCase();
+  if (h === "localhost") {
+    return true;
+  }
+  // Handle bracketed IPv6 addresses like [::1]
+  const unbracket = h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+  return isLoopbackAddress(unbracket);
 }

src/gateway/origin-check.ts

@@ -1,3 +1,5 @@
+import { isLoopbackHost } from "./net.js";
+
 type OriginCheckResult = { ok: true } | { ok: false; reason: string };
 
 function normalizeHostHeader(hostHeader?: string): string {
@@ -38,22 +40,6 @@ function parseOrigin(
   }
 }
 
-function isLoopbackHost(hostname: string): boolean {
-  if (!hostname) {
-    return false;
-  }
-  if (hostname === "localhost") {
-    return true;
-  }
-  if (hostname === "::1") {
-    return true;
-  }
-  if (hostname === "127.0.0.1" || hostname.startsWith("127.")) {
-    return true;
-  }
-  return false;
-}
-
 export function checkBrowserOrigin(params: {
   requestHost?: string;
   origin?: string;