OSC 52 and VNC ServerCutText now go through one handler that honours
'allow remote clipboard' and always toasts the first line, so a silent
clipboard swap can't set up a paste into another shell (SEC-20261012-010).
Multi-line pastes into a terminal without bracketed paste ask first, with a
preview (SEC-20261012-017). The launch-time update check can be turned off
and the updater docs no longer claim it is opt-in; the unused GitHub
fallback is removed (SEC-20261012-013, F15).
Under the 'ask' policy a changed host key used to be a hard error. The
prompt now shows the stored and received fingerprints and offers Reject,
Accept Once (connect, keep the record) and Accept & Update (replace the
record; audited). Unknown keys gain an Accept Once option too. Strict and
accept-new still refuse changed keys without prompting. Known-host rows
written by the old app are confirmed removable by id (test).
The NickServ password (and any other "remember for this session" secret) was
resolved through a fresh per-connect cache, so every auto-reconnect prompted
again with a 60 s timeout and an unanswered prompt failed the reconnect.
Session-only secrets now live on the session, survive auto and explicit
reconnects, and IDENTIFY is sent on every registration as before.
- The VNC client refuses desktop sizes over 64 Mpx (ServerInit and
DesktopSize/ExtendedDesktopSize) and ZRLE rectangles over 64 MiB before
allocating, so a hostile server can't force a multi-gigabyte allocation.
- Release URLs from the update manifest and repository URLs from the GitHub
API are handed to the system opener only when they are http(s) links.
- SSH key pairs are generated with ssh-key (Ed25519/ECDSA P-256/RSA) and
encrypted in-process, so the passphrase no longer appears as an ssh-keygen
command-line argument visible in the process list.
- open_tunnel's loopback bridge checks the accepted peer is our own client
socket, so a local process racing for the ephemeral port can't be spliced
into the IRC/VNC SSH tunnel.
- run_command caps buffered output at 1 MiB; local-forward abort handles are
pruned as connections finish; SOCKS5 host/credential lengths over 255 bytes
are rejected instead of being truncated into a malformed request.
- Secrets::delete_profile removes every profile credential kind from the OS
keychain as well as the vault (previously only the vault was purged, so
keychain passwords/tokens outlived the profile).
- write_private writes to a sibling temp file and renames it into place, so a
crash mid-write cannot truncate the vault or an export, and a pre-existing
world-readable file is replaced rather than reused.
- Argon2-derived vault/export keys are Zeroizing and wiped on drop.
- Recordings (which capture typed input), JSON exports and --data-dir
directories are created owner-only.
Andy Dixon