proxy: bind loopback on both IPv4 and IPv6 so localhost isn't shadowed

The proxy bound only 127.0.0.1 (IPv4). On macOS `localhost` resolves to ::1
(IPv6) first, so if another process holds a wildcard IPv6 listener on the same
port (e.g. OrbStack/Docker on *:PORT with SO_REUSEPORT), the IPv4-only bind
still succeeds but never receives `localhost` traffic — it lands on the other
listener, which resets it. The proxy looked healthy ("Ctrl-C to stop") while
every request failed with "connection reset by peer".

Bind loopback on both 127.0.0.1 and ::1 (single site for an explicit
non-loopback --address). Binding the specific loopback addresses wins over a
wildcard listener, so localhost reaches the proxy; a genuinely conflicting
specific bind now surfaces as a loud EADDRINUSE instead of a silent half-bind.
IPv6-unavailable hosts fall back to IPv4 with a note.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mhotan

src/flyte/cli/_proxy.py

@@ -1,4 +1,5 @@
 import asyncio
+import errno
 import json
 import sys
 
@@ -169,15 +170,50 @@ async def send(refresh: bool):
     server.router.add_route("*", "/{tail:.*}", handle)
     runner = web.AppRunner(server)
     await runner.setup()
-    site = web.TCPSite(runner, address, port)
-    await site.start()
+    # Bind loopback on BOTH IPv4 and IPv6 so the proxy owns `localhost` fully.
+    # macOS resolves `localhost` to ::1 (IPv6) first, and a wildcard listener in
+    # another process (e.g. OrbStack/Docker on *:PORT) otherwise shadows an
+    # IPv4-only 127.0.0.1 bind: bind() still succeeds, so the proxy looks healthy
+    # yet never receives the request (it lands on the other listener, which
+    # resets it). Binding ::1 too turns that silent half-bind into a loud
+    # EADDRINUSE. A non-loopback --address is bound as-is (single family).
+    loopback = address in ("127.0.0.1", "localhost", "::1", "loopback")
+    hosts = ["127.0.0.1", "::1"] if loopback else [address]
 
     actual = port
-    if port == 0:
-        actual = runner.addresses[0][1]
-    local = f"http://{address}:{actual}"
+    bound: list[str] = []
+    for host in hosts:
+        try:
+            await web.TCPSite(runner, host, actual).start()
+        except OSError as e:
+            if e.errno == errno.EADDRINUSE:
+                await runner.cleanup()
+                raise click.ClickException(
+                    f"Port {actual} is already in use (binding {host} failed). Another "
+                    f"process — often a wildcard binder like OrbStack or Docker — holds it "
+                    f"and would silently shadow this proxy. Re-run with --port <free-port>."
+                )
+            if host == "::1" and e.errno in (errno.EADDRNOTAVAIL, errno.EAFNOSUPPORT):
+                click.secho(
+                    f"note: IPv6 loopback unavailable, binding IPv4 only ({e.strerror}).",
+                    fg="yellow",
+                    err=True,
+                )
+                continue
+            await runner.cleanup()
+            raise
+        bound.append(host)
+        if port == 0 and actual == 0:
+            # First site picked a free port; pin the other family to the same one.
+            actual = runner.addresses[0][1]
+    if not bound:
+        await runner.cleanup()
+        raise click.ClickException("Failed to bind any loopback address.")
+
+    display_host = "127.0.0.1" if loopback else address
+    local = f"http://{display_host}:{actual}"
 
-    if address not in ("127.0.0.1", "localhost", "::1"):
+    if not loopback:
         click.secho(
             f"WARNING: binding {address} exposes your Union identity to anything that can reach it; prefer 127.0.0.1.",
             fg="yellow",