Determine the configured host and port from local env files in this order:
- .env.local
- .env.development
- .env.production
- .env
Prefer OPENCLAW_HOST over HOST, and OPENCLAW_PORT over PORT.
Default the port to 18789 if no valid port is configured.
Check whether a process is actively listening on that port.
Classify the listener binding as one of:
- loopback only
- wildcard / all interfaces
- private network address
- public non-loopback address
- inconclusive
Check whether the current process is running with elevated privileges:
- on Unix, uid == 0 means elevated
- on Windows, treat an administrative token or Administrators group membership as elevated

Required reporting behavior

Distinguish runtime listener state from config file state.
Do not claim definite public internet exposure based only on 0.0.0.0, ::, or *.
Use wording like may be reachable beyond localhost unless you have stronger evidence.
If no active listener is detected, say so explicitly.
If the host config is missing, say that runtime flags or another config source may be in use.
Elevated privileges are a warning, not proof of compromise.

Fix behavior

Never modify files without explicit user permission.
Only offer a fix when an existing HOST or OPENCLAW_HOST entry is present in one of the known env files.
Prefer updating the specific env file that actually contains the host setting.
Before editing, create a .bak backup beside the file.
Change only the host value to 127.0.0.1.
Preserve comments and quoting where possible.
If no existing host entry is found, do not add one automatically; explain that the active config source may be elsewhere.

Use the reference logic in index.ts when you need exact parsing or classification behavior. Keep your user-facing output concise and conservative.