mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-24 10:08:00 -06:00
The loopback listener spawned a thread per accepted connection and read its first line with no deadline and no limit on how many could wait, so any local process could hold threads for ever before knowing the token. Each connection now has an absolute deadline to authenticate (10 s from acceptance, re-armed per read so a byte at a time cannot extend it), at most 8 may wait at once (the rest are refused on the accepting thread with an error and closed), writes time out, and a waiting place is given back on authentication and on every exit. Claude-Session: https://claude.ai/code/session_01RUNQSPVXx3dDBabRZHAnjz Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>