Toolport

Toolport v1.5.2

A security and robustness hardening release, gathering a multi-dimension gateway
audit (3 high, 3 medium findings) plus a follow-on trust-boundary pass. Every fix
ships with a regression test. No configuration or identity changes: existing
installs update in place through the in-app updater once this release is published.

Installers are attached for Windows, macOS Intel, macOS Apple Silicon, and Linux.

Security

• Approvals are now bound to the tool definition. A "for this session" or "always"
  allow is keyed to a fingerprint of the exact tool definition it was granted for, resolved
  from the live server. If a server later changes that tool (a rug-pull), the call re-prompts
  instead of inheriting the old approval. Legacy broad allows are ignored, so existing users
  re-approve once.
• Broader destructive-tool detection. When a server omits the MCP destructiveHint, the
  approval gate now also treats obvious write/delete verbs in the tool name (delete, drop,
  send, publish, truncate, upload, and similar) as destructive, failing toward caution. An
  explicit destructiveHint: false still wins.
• Secret redaction in shareable diagnostics. The diagnostics summary now redacts inline
  secret arguments and credentials embedded in server URLs, and clears the live-inspection
  buffer on startup when inspection is off.
• Spawn-guard bypass via attached inline-eval flags closed. The dangerous-flag guard only
  matched interpreter flags as standalone tokens, so the attached form (python -c<code>,
  ruby -e<code>) from a booby-trapped server config slipped past and ran arbitrary code.
  The matcher now catches the attached short form.
• OAuth DNS-rebind SSRF into the private network closed. The OAuth metadata resolver
  refused only link-local and metadata IPs, leaving a resolve-then-connect window a rebinding
  host could exploit. A stable, provenance-derived flag now refuses private and loopback
  answers at connect time too. Self-hosted LAN auth servers still work.
• OAuth cleartext-exchange bypass closed. The require_https loopback exception used a
  string prefix that also matched hosts like http://127.0.0.1.evil.com; it now decides on
  the parsed host.
• HTTP-bridge token masked in the UI. The bearer token that grants local processes access
  to every tool is now masked by default with a reveal toggle, instead of shown in plaintext.

Fixed

• Config-wipe data loss on parse failure. A genuinely unparseable codex/config.toml,
  ~/.claude.json, or Gemini settings.json was replaced with a fresh file holding only the
  gateway entry, destroying the user's model, provider, profile, and MCP state. Both paths now
  fail closed and preserve the file (a timestamped backup was always taken first).
• Router lock held across downstream refresh I/O. A list_changed from one slow downstream
  stalled every concurrent request; the refresh now runs on an off-lock router clone swapped in
  under a brief lock.
• Self-heal thundering herd. A startup burst of workers could each rebuild the router,
  spawning the full server set many times over; the rebuild is now single-flighted behind a
  double-checked lock.
• Robustness batch. Cancel-forward threads are capped so a wedged downstream can't leak
  threads; the config install cap was raised from 8MB to 64MB for heavy Claude Code users;
  saturating arithmetic on the savings/audit hot paths; and frontend polish (approval-bar
  countdown scales against the real window, a stale share-export guard, and a capped
  dismissed-activity set).

CI

• Pinned the release workflow's actions to commit SHAs (it holds the signing secrets) and
  removed stray local signing-key artifacts.

Full changelog: https://github.com/tsouth89/toolport/compare/v1.5.1...v1.5.2