SerenaDashboardTrayManager: Configure trusted hosts (local hosts only)

CHANGELOG.md

@@ -13,7 +13,8 @@ Status of the `main` branch. Changes prior to the next official version change w
   - Project activation errors are now reported to the client in Serena's system prompt, instead of failures 
     being visible only in the log. This applies both to a failed activation of an explicitly given project and to a 
     failed `--project-from-cwd` auto-detection (#1773).
-  - ProjectServer: Configure trusted hosts for localhost case
+  - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost
+  - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only)
 
 * CLI:
   - Fix: `start-mcp-server` help text for `--project-from-cwd` falsely promised a fallback to the CWD, which was 

src/serena/dashboard.py

@@ -207,7 +207,7 @@ class SerenaDashboardAPI:
         self._tool_names = tool_names
         self._agent = agent
         self._host = host
-        self._app = Flask(__name__)
+        self._app = Flask(self.__class__.__name__)
         if trusted_hosts:
             self._app.config["TRUSTED_HOSTS"] = trusted_hosts
         self._tool_usage_stats = tool_usage_stats
@@ -966,6 +966,8 @@ class SerenaDashboardTrayManager:
     HOST = "127.0.0.1"
     """listen address (local only)"""
 
+    TRUSTED_HOSTS = ["localhost", "127.0.0.1"]
+
     ALIVE_CHECK_INTERVAL_SECONDS = 3
     """interval in seconds between alive checks of registered instances"""
 
@@ -984,7 +986,8 @@ class SerenaDashboardTrayManager:
         self._lock = threading.Lock()
         self._tray_icon: Optional["pystray.Icon"] = None
         self._alive_check_use_pid = alive_check_use_pid
-        self._app = Flask(__name__)
+        self._app = Flask(self.__class__.__name__)
+        self._app.config["TRUSTED_HOSTS"] = self.TRUSTED_HOSTS
         self._setup_routes()
         self._use_pywebview = use_pywebview