docs: revise terminal command loopback convention for #72

按 issue #72 设计同步修订：ADR-0015 命令地址段落改为「默认兼容回环 +
非本机方式会话内可选 Wi‑Fi/Ethernet 地址」，表格列名改默认命令地址；
CONTEXT.md 命令定义与监听约束同步；设计文档标记已实现。健康检查与系统
代理目标仍由监听方式确定。

CONTEXT.md

@@ -31,7 +31,7 @@
 - **Legacy Privoxy adapter**: The frozen implementation's HTTP(S)-to-local-SOCKS5 bridge. It is a Legacy-only dependency and is not migrated into 2.0.
 - **Listener mode**: The user-facing choice that determines which address families the local proxy listeners accept: this Mac only (IPv4 loopback), all IPv4 interfaces, all IPv4 and IPv6 interfaces, or all IPv6 interfaces only. One mode applies to both the local SOCKS and HTTP proxy inbounds. _Avoid_: Listen scope.
 - **HTTP proxy environment command**: An HTTP-only terminal command that sets lowercase `http_proxy` and `https_proxy` for this Mac's local HTTP proxy inbound. It always targets a loopback address for the selected listener mode.
-- **Terminal proxy environment commands**: Shell-specific commands for zsh/bash and fish that set lowercase `http_proxy` and `https_proxy` through the local HTTP inbound, `all_proxy` through the local SOCKS inbound, and `no_proxy` for `localhost`, `127.0.0.1`, `::1`, and `.local` hostnames. The proxy endpoints use loopback addresses selected by listener mode, and the commands affect child processes that honor these variables.
+- **Terminal proxy environment commands**: Shell-specific commands for zsh/bash and fish that set lowercase `http_proxy` and `https_proxy` through the local HTTP inbound, `all_proxy` through the local SOCKS inbound, and `no_proxy` for `localhost`, `127.0.0.1`, `::1`, and `.local` hostnames. The proxy endpoints use the terminal command address (defaulting to a compatible loopback address), and the commands affect child processes that honor these variables.
 - **Terminal command address**: The user-selected IP address used by both HTTP and SOCKS endpoints in copied terminal proxy environment commands. It defaults to a compatible loopback address; non-local listener modes also offer addresses of enabled Wi-Fi and Ethernet interfaces in the accepted address families, and the selection lasts only for the current app session without changing listener or system-proxy settings.
 - **Proxy runtime**: The per-user background host process, independent of the GUI's lifetime, that runs the external tunnel service and loads the optional generated ACL sidecar.
 - **Legacy configuration**: The server list and preferences persisted by the frozen implementation in `Legacy/`.
@@ -80,7 +80,7 @@
 - A unique, syntactically valid Legacy server UUID is preserved. An otherwise valid server with a missing, malformed, or duplicate UUID receives a fresh UUID; invalid records are omitted with a user-visible report.
 - A Legacy import migrates only server records; mode, target, login-item, and all other preferences stay untouched. Legacy passwords, plugin options, and user-provided remote URLs move to credential references; generated configurations, caches, diagnostics, logs, and binaries do not migrate. The imported plugin program reference is preserved verbatim even when 2.0 does not provide that plugin.
 - 2.0 and Legacy are independent applications that may run concurrently. 2.0 never stops Legacy processes, retires Legacy runtime jobs, or transfers preferences; a Legacy import brings over server records only. Their factory-default local endpoint ports are distinct, but enabling 2.0's system proxy switch may replace proxy values in the active network location regardless of which app wrote them.
-- The local SOCKS and HTTP proxy inbounds share one listener mode; the factory default is IPv4 loopback. The other modes bind all interfaces of their selected address families and expose unauthenticated proxy endpoints, whose reachability from other devices depends on the firewall and network. Terminal proxy environment commands are for this Mac's shell and always point to loopback, even when listeners bind to all interfaces.
+- The local SOCKS and HTTP proxy inbounds share one listener mode; the factory default is IPv4 loopback. The other modes bind all interfaces of their selected address families and expose unauthenticated proxy endpoints, whose reachability from other devices depends on the firewall and network. Terminal proxy environment commands are for this Mac's shell and default to a compatible loopback address even when listeners bind to all interfaces; in non-local modes the home command card can point them at an enabled Wi-Fi or Ethernet interface address (see Terminal command address), without changing listener or system-proxy settings.
 - Saving an independently saved setting item persists and applies only that item's complete value. Other unsaved settings remain pending and cannot overwrite the saved item when they are later committed.
 - Listener mode is an independently saved setting item. Saving it does not commit unrelated settings or start a disabled proxy runtime; if the runtime is running, the listener change is applied by restarting it. A saved mode remains selected if runtime convergence fails, and the proxy status UI owns runtime status and restart-failure presentation rather than the settings view or editor.
 - The ports of the locally provided proxy endpoints are explicit user configuration in the range 1000–65535: the system never rewrites a port on its own, and a port conflict rejects proxy start with an error naming the endpoint until the user explicitly chooses a new port. A recovery suggestion only proposes candidate ports (32768–65535, free and distinct from the other endpoints' configured values) and applies only after the user confirms and saves.

docs/adr/0015-four-way-listener-mode.md

@@ -4,7 +4,7 @@
 
 Replace the former loopback/host choice with one independently saved listener mode shared by the SOCKS and HTTP inbounds. The dialog uses these labels and bindings:
 
-| Option | Binding | `ipv6_only` | HTTP proxy command host |
+| Option | Binding | `ipv6_only` | Default terminal command address |
 | --- | --- | --- | --- |
 | 仅本机 | `127.0.0.1` | — | `127.0.0.1` |
 | 所有 IPv4 接口 | `0.0.0.0` | — | `127.0.0.1` |
@@ -15,6 +15,6 @@ The dialog's outer row shows only the selected label; each choice includes a sub
 
 The pinned `sslocal` v1.25.0 exposes `ipv6_only` as a top-level option for listeners bound to `::`, so the two IPv6 modes set it explicitly. Include this setting in runtime identity so switching dual-stack and IPv6-only restarts listeners even though the address remains `::`. Update local health checks and system-proxy targets to use an address family accepted by the selected mode; IPv6-only uses `::1`. Verify the dual-stack and IPv6-only behavior on supported macOS versions before claiming runtime support. [Upstream configuration](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/README.md), [configuration source](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/config.rs), [listener source](https://github.com/shadowsocks/shadowsocks-rust/blob/v1.25.0/crates/shadowsocks-service/src/local/mod.rs).
 
-The HTTP proxy environment command is local-terminal convenience, not a device-sharing feature: it uses `127.0.0.1` for the first three modes and `::1` for IPv6-only. Remove the manual advertised IPv4 address because no remaining feature consumes it. Show a no-auth, all-interfaces exposure warning in the dialog for the three non-loopback modes, without an extra confirmation.
+The terminal proxy environment commands are local-terminal convenience by default, not a device-sharing feature: they use `127.0.0.1` for the first three modes and `::1` for IPv6-only. In the three non-loopback modes the home command card adds a session-scoped command address picker (issue #72) whose candidates are limited to loopback and the unicast addresses of enabled Wi-Fi and Ethernet interfaces in the mode's accepted address families. Selecting an address changes only the copied commands — never the listener binding, system proxy targets, or health checks, which all remain determined by the listener mode — and the selection is not persisted across app restarts. Remove the manual advertised IPv4 address because no remaining feature consumes it. Show a no-auth, all-interfaces exposure warning in the dialog for the three non-loopback modes, without an extra confirmation.
 
 Persistence success and runtime convergence remain separate. A saved mode is retained after restart failure; the settings view and editor handle persistence outcomes only, while the proxy status UI reports whether the agent restarted and its current state.

docs/design/terminal-command-address.md

@@ -1,7 +1,7 @@
 # 首页代理环境变量命令地址选择
 
 日期：2026-10-01。
-状态：交互设计与测试边界已确定，spec 已发布为 [Issue #72](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/72)，标记 ready-for-agent；尚未实现。
+状态：已实现（issue #72）；交互设计与测试边界来自 grill-with-docs 会话，spec 已发布为 [Issue #72](https://github.com/qiuyuzhou/ShadowsocksX-NG/issues/72)。
 
 ## 功能范围