From 731e6079fd976d9f8d46b9f1523c6d243d008a45 Mon Sep 17 00:00:00 2001
From: MarkXian <mark-xian@foxmail.com>
Date: Tue, 28 Jul 2026 14:24:49 +0800
Subject: [PATCH] fix(kap-server): classify localhost case-insensitively

---
 .changeset/localhost-bind-classification.md      | 5 +++++
 packages/kap-server/src/security/bindClassify.ts | 5 +++--
 packages/kap-server/test/bindClassify.test.ts    | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/localhost-bind-classification.md

diff --git a/.changeset/localhost-bind-classification.md b/.changeset/localhost-bind-classification.md
new file mode 100644
index 0000000000..16f9c75045
--- /dev/null
+++ b/.changeset/localhost-bind-classification.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Classify localhost bind hosts case-insensitively.
diff --git a/packages/kap-server/src/security/bindClassify.ts b/packages/kap-server/src/security/bindClassify.ts
index 9e476884cf..e525e68fa0 100644
--- a/packages/kap-server/src/security/bindClassify.ts
+++ b/packages/kap-server/src/security/bindClassify.ts
@@ -88,10 +88,11 @@ function isLinkLocalV6(host: string): boolean {
  * resolve to a public address.
  */
 export function classify(host: string, opts?: ClassifyOptions): BindClass {
-  if (host === '' || host === '0.0.0.0' || host === '::') {
+  const normalizedHost = host.toLowerCase();
+  if (host === '' || normalizedHost === '0.0.0.0' || normalizedHost === '::') {
     return opts?.bindClass ?? 'public';
   }
-  if (host === 'localhost') {
+  if (normalizedHost === 'localhost') {
     return 'loopback';
   }
   const family = net.isIP(host);
diff --git a/packages/kap-server/test/bindClassify.test.ts b/packages/kap-server/test/bindClassify.test.ts
index bd5b9cf2fa..eeb595b12c 100644
--- a/packages/kap-server/test/bindClassify.test.ts
+++ b/packages/kap-server/test/bindClassify.test.ts
@@ -4,7 +4,7 @@ import { classify } from '../src/security/bindClassify';
 
 describe('classify', () => {
   describe('loopback', () => {
-    it.each([['127.0.0.1'], ['127.255.255.255'], ['::1'], ['localhost']])(
+    it.each([['127.0.0.1'], ['127.255.255.255'], ['::1'], ['localhost'], ['LOCALHOST']])(
       '%s → loopback',
       (host) => {
         expect(classify(host)).toBe('loopback');