Hakan SevenandClaude Opus 5.5 1fec34d84a fix(automation): TCP automation requires a session token ...

--http (headless and GUI-hosted) and --serve --port answered anything
that reached the loopback port, and the REST responses allowed every
web origin. Loopback is shared by every process and user on the
machine, so the port proved nothing.

- Every REST request now needs Authorization: Bearer <token>, and every
  --serve --port request line a "token" field; otherwise 401 /
  unauthorized (the socket is closed).
- The token is OCS_API_TOKEN when the launcher sets it, else 32 random
  bytes printed on stderr at startup; compared in constant time.
- No CORS headers are sent, so a web page cannot read an answer.
- stdio --serve and --mcp are unchanged (private to their parent / the
  GUI's own token).

GHSA-c27p-xfx2-9r5x

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 21:48:20 +03:00

..

automation

fix(automation): TCP automation requires a session token

2026-09-30 21:48:20 +03:00

images

Merge pull request #1299: Add Windows SpaceMouse navigation

2026-09-16 09:41:25 +03:00

plugin-template

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

plugin-template-v2

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

readme

Add Greek README translation and language links

2026-09-05 14:52:45 +03:00

screenshots

docs(dimension): screenshots for arrow fit, outside text, and radial leader rules

2026-09-17 09:45:13 -05:00

cadcodec-reader-gaps.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

cadkernel-body-path.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

issue-78-comment.txt

Add demo_plugin and plugin host integration tests

2026-06-09 13:52:15 -04:00

issue-78-reply.md

Add plugin host architecture and Storm Sewer add-on package

2026-06-09 13:41:21 -04:00

native-vs-web.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

pane-grid-migration.md

docs: plan for migrating model tiles to iced pane_grid

2026-06-18 23:53:52 +03:00

perspective-depth.md

fix(renderer): keep draw-order offsets within clipping planes

2026-09-15 12:36:05 -05:00

plugin-architecture.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

plugin-host-model-completion-plan.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

plugin-host-model-coverage-ledger.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

plugin-host-model.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

plugin-host-review-guide.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

PR-plugin-host.md

Add demo_plugin and plugin host integration tests

2026-06-09 13:52:15 -04:00

releases.md

Fix web folder paths and allow main-only web hotfix deployment

2026-09-13 20:30:12 +03:00

spacemouse.md

Merge pull request #1299: Add Windows SpaceMouse navigation

2026-09-16 09:41:25 +03:00

tessellation.md

feat: node graph overlay; move to opencadcodec/opencadkernel/opencadgraph

2026-09-25 07:34:23 +03:00

trackpad.md

docs(trackpad): document the gestures and why a pinch bypasses iced

2026-09-21 23:47:32 +03:00

viewport-dimension-association.svg

Track mixed paper and viewport dimension references

2026-09-15 16:00:11 -05:00

viewport-dimension-creation.svg

Track mixed paper and viewport dimension references

2026-09-15 16:00:11 -05:00

viewport-dimensions.md

Track mixed paper and viewport dimension references

2026-09-15 16:00:11 -05:00