Dylan M. Taylor 6d744887f4 fix(mcp): send the control token only to 127.0.0.1:PORT and read it only from a private file (#2718) ...

The bridge picked the token by port alone and sent it to whatever the address resolved to, so a listener another account opened on ::1 with the same port received the desktop's credential. The token is now attached only when the connected peer is exactly 127.0.0.1:PORT, where the app listens. Reading the token refuses a symlink, a non-plain file and a file others can read, and the shared temporary directory is no longer a fallback location for it.

2026-11-10 21:33:51 -05:00

..

src

fix(mcp): send the control token only to 127.0.0.1:PORT and read it only from a private file (#2718)

2026-11-10 21:33:51 -05:00

tests/it

chore: resolve SonarCloud maintainability issues (#2025)

2026-10-24 04:34:49 -04:00

Cargo.toml

fix(mcp): send the control token only to 127.0.0.1:PORT and read it only from a private file (#2718)

2026-11-10 21:33:51 -05:00