[PhantomDave]

Fixes the 15 findings from an xhigh code review of the whole repo, one commit per finding. Each commit message explains the bug and the fix; review commit by commit.

Security

• Bind to 127.0.0.1 instead of 0.0.0.0. The API has no auth and can create and run shell commands, so any host on the LAN could run code as the developer.
• Loopback guard on every route. checkMcpRequest (now checkLocalRequest in src/local-guard.ts) only protected /mcp. It now runs as an onRequest hook for all routes, which blocks DNS rebinding and cross-site bodyless POSTs that skip the CORS preflight (run profile, restart command, close workspace…).

Core correctness

• Global env vars were duplicated on every edit. SQLite treats NULL profiles as distinct in UNIQUE. Upserts now conflict on a COALESCE expression index, and opening an existing DB keeps the newest row of each duplicate.
• Process env came from the first profile that lists a command, not the one that launched it. The queue now passes its launch-profile tag to the env resolver, matching conductor run.
• Overlapping restarts could spawn two processes and orphan one (restartQueued re-checks the single-flight map until it's free).
• The force-kill before a respawn was reported as a crash: "crashed" (137), an auto-restart, then "recovered".
• A dependency stopped by hand that exited 0 counted as ready. Only a one-shot that completed on its own does now.
• command healthchecks had no timeout. Each run is killed (whole group) after 10s or timeout_ms, and the monitor no longer stacks probes.
• Command move / membership sync were non-atomic: a failing target dropped the command from the source. They now write once, through store methods.
• Session close closed the DB while log lines could still arrive. The session now drops lines that arrive after it closed its DB instead of throwing on a closed DB, and drained never rejects, as its doc said. (A first version waited for the pipes to drain in close(); on Windows that hit its 2s cap on every close and broke the workspace tests, so it was replaced.)
• Chained ${VAR} references are resolved; PATH=${PATH}:/x extends the inherited value.
• Unknown stop_signal names are rejected by the schema. Previously process.kill threw, killTree swallowed it, and every stop silently waited for SIGKILL.

UI

• A profile description can be cleared. The modal sent undefined, which JSON drops, and the API answered 400.

Desktop (Tauri)

• Quitting no longer orphans managed processes. The grace period goes from 5s to 10s, and on escalation the shell SIGKILLs each child's process group (pgrep -P) before the sidecar.
• No unattended update install + restart at startup. The UI checks on load and shows a notice; installing stays the button in Environment → About.

Reviewer notes

• Behaviour changes:
  • the core is no longer reachable from other machines;
  • a .conductor.yml with an invalid stop_signal (e.g. TERM) now fails to load;
  • updates are no longer auto-installed.
• Tests: 25 new ones (319 → 344). The ones that reproduce a bug fail without their fix; a few guard cases that already worked. Checks run before every commit: bun test, lint, typecheck, prettier and the run-desktop sidecar smoke. Two healthcheck port tests (probeOnce - type: port, waitForHealthy … retrying) fail on my machine before and after these changes, because localhost resolves only to ::1 there. CI should be unaffected.
• Not exercised at runtime:
  • the Rust changes passed cargo check only; please run bun run --cwd packages/desktop-tauri dev and quit with a running service, and check the update notice;
  • the profile edit modal was tested through the API contract test, not in a browser.
• Out of scope: on Windows the sidecar is still hard-killed on quit (pre-existing).

🤖 Generated with Claude Code