v0.7.0

Breaking Changes

The web dashboard now binds 127.0.0.1 by default

taskmd web start previously listened on every network interface. It now binds
loopback only, reachable just from the machine running it.

The dashboard's JSON API has no authentication, and unless --readonly is set it serves
PUT /api/tasks/{id}, which rewrites task markdown on disk. Binding every interface by
default exposed that to whatever networks the host happened to sit on.

If you reach the dashboard from another machine, you now have to opt in:

taskmd web start --host 0.0.0.0

or in .taskmd.yaml:

web:
  host: 0.0.0.0
  readonly: true

On untrusted networks, pair a wider bind with --readonly and restrict access at the
host level (firewall, VPN, or an authenticating reverse proxy). taskmd still does not
authenticate web requests.

Reported in #23.

Web Dashboard

• New --host flag on taskmd web start, with a matching web.host config key and
  TASKMD_WEB_HOST environment variable. Bind one interface on a multi-homed host with
  --host 10.0.0.1, or every interface with --host 0.0.0.0.
• The startup banner now tells the truth about the bind address. It previously always
  printed http://localhost:PORT, even when the server was actually on 0.0.0.0 and
  [::] — so anyone reading that line and concluding the dashboard was local-only was
  wrong, with nothing in the output to correct them.
• A warning is printed when the bind is not loopback, naming the unauthenticated API
  and — only when editing is actually enabled — the PUT /api/tasks/{id} write endpoint.
• IPv6 bind addresses are handled correctly (--host ::1).
• Listen failures now name the full address instead of just the port: a bind failure on a
  specific host is a different diagnosis from a port conflict.

Docker

• The image sets TASKMD_WEB_HOST=0.0.0.0, so published ports keep working. Inside a
  container the network namespace is itself the isolation boundary and -p is the
  operator's explicit opt-in, so wildcard is the correct bind there. Without this, the new
  loopback default would have made every documented docker run -p 8080:8080 unreachable.
• Set via ENV rather than baked into CMD, so the documented CMD overrides
  (web start --port 3000, web start --readonly) keep working instead of silently
  dropping the flag.

Documentation

• web.host and web.readonly are now documented in both example configs. web.readonly
  has always worked from .taskmd.yaml but appeared only as a row in the options table.
• TASKMD_WEB_HOST and TASKMD_WEB_PORT are documented, with their config-key mapping.
• Corrected the config precedence order. Two pages stated that environment variables
  rank below config files. The actual order is flags → environment variables → project
  .taskmd.yaml → global ~/.taskmd.yaml → built-in defaults.
• New FAQ entry on reaching the dashboard from another machine.

Internal

• The CI Docker smoke test could never fail. Its assertion piped curl -sf into
  head, and the step ran without pipefail, so it took its exit status from head and
  reported success whether or not the server was reachable.
• Added regression guards asserting both Dockerfiles set the wildcard bind and that the
  Docker smoke-test step declares shell: bash.
• Removed references to docs/guides/cli-guide.md and docs/guides/web-guide.md from the
  audit-docs skill; that directory no longer exists.