Toolport

The hardening release. Conduit went through a thorough multi-perspective security, reliability, and UX audit, and this ships the fixes.

Security

• Importing a shared setup now shows exactly what it will run (each server's command, args, and url) and imports only on your confirmation, flagging anything that spawns a shell. A shared config can no longer slip an unseen command past you.
• OAuth endpoints discovered from a server's metadata are rejected if they point at a private or loopback address while the server itself is public (SSRF protection). Legitimate local servers are unaffected.
• The app window now has an explicit Content-Security-Policy.

Reliability

• Your registry is written atomically, so a crash mid-write can't corrupt your server set.
• A corrupt registry no longer makes your tools silently vanish: the gateway keeps serving the last good tool list and logs the problem.
• The catalog and config backups are stored in one consistent place across install types.

Polish

• Onboarding's final step reflects what you actually set up and explains lazy discovery; the empty state offers a "Browse catalog" action; the New Profile dialog explains that profiles scope servers, not credentials.
• Clearer macOS OAuth guidance, shown before sign-in rather than only after a failure.

Updating

v0.3.3 and later update in place (Windows, macOS, and Linux). Earlier versions: download below.