Runtime: remove non-debug Werkzeug fallback from localhost deployments

[techmore]

Summary

The runtime no longer starts Flask-SocketIO from app.py with a hard-coded allow_unsafe_werkzeug=True call. That part was fixed by the bootstrap/runtime refactor.

The remaining gap is in nmapui/bootstrap.py: run_socketio_server() still enables Werkzeug whenever the app binds to 127.0.0.1 or localhost, even outside explicit debug mode.

Current Evidence

allow_unsafe_werkzeug = runtime_options["debug"] or runtime_options["host"] in {
    "127.0.0.1",
    "localhost",
}

That means the app still defaults to the development server in the common local-daemon deployment path.

Why It Matters

Running on localhost reduces exposure, but it does not change the fact that Werkzeug is still a development server with weaker concurrency and operational behavior than a production-capable Socket.IO server.

This app performs long-running scan work and maintains persistent websocket-style client connections, so server/runtime behavior still matters for stability.

Proposed Fix

• Make the server backend explicit in runtime configuration.
• Default production-style runs to an async server/runtime that Flask-SocketIO supports cleanly.
• Reserve Werkzeug fallback for explicit debug/developer mode only.
• Document the supported local-daemon deployment model clearly.

Severity

Medium — narrower than the original report, but still a valid runtime-hardening issue.

[techmore]

Tracked as a secondary follow-up in #108. The original issue was narrowed after the bootstrap/runtime refactor; the remaining gap is the non-debug localhost Werkzeug fallback.

[techmore]

Implemented on codex/runtime-contract-fixes in commit 8f56d9d.

What landed:

• nmapui.bootstrap.run_socketio_server() no longer enables allow_unsafe_werkzeug just because the host is loopback
• Werkzeug fallback is now allowed only in explicit debug mode
• bootstrap tests now cover:
  • loopback + non-debug => Werkzeug not allowed
  • non-loopback + non-debug => Werkzeug not allowed
  • explicit debug mode => Werkzeug allowed

Validation:

• ./.venv/bin/python -m pytest -q
• 133 passed

[techmore]

Implemented on and verified in the current test suite. Keeping the detailed implementation notes on the issue comments; closing this as resolved by the branch work.

[techmore]

Implemented on branch codex/runtime-contract-fixes and verified in the current test suite. Detailed implementation notes are already on the issue comments; closing this as resolved by the branch work.