25500234879
65%

Ran 07 May 2026 02:01PM UTC

Jobs 1

Files 720

Run time 2min

Badge

Embed ▾

Committed 07 May 2026 01:54PM UTC coverage: 64.786% (-0.01%) from 64.796%

Build # 25500234879

Build Type

push

github

Committed by

web-flow

Commit Message

Restrict Windows named-pipe DACL to creating user (#5214)

By default winio.ListenPipe inherits the kernel default DACL, which
on shared, RDP, or Citrix hosts permits any other interactive user
to open the pipe and exercise the entire REST API; OIDC is opt-in
via WithOIDCConfig and not always present.

Set an explicit SDDL granting GenericAll only to the creating user
(OW) and SYSTEM (SY), with the Protected flag (P) so no inherited
ACEs widen the descriptor. Soften the surrounding doc comment to
match what the listener now enforces, and mark the Windows
AF_UNIX fallback path as best-effort since the .sock file inherits
the parent directory's NTFS ACL.

Add http.Server.IdleTimeout as defense in depth across platforms;
winio.MaxInstances defaults to 255, so a slow client must not be
allowed to keep an instance idle indefinitely and starve new
connections.

Co-authored-by: Cursor <cursoragent@cursor.com>

Coverage Stats

63205 of 97560 relevant lines covered (64.79%)

57.83 hits per line

Coverage Regressions

Lines	Coverage	∆	File
92	15.15	2.5%	pkg/api/server.go
12	75.09	-4.33%	pkg/client/config.go
12	67.9	-14.81%	pkg/client/discovery.go
10	90.99	0.4%	pkg/server/discovery/health.go
8	23.56	-4.6%	pkg/client/manager.go
2	94.77	-1.31%	pkg/vmcp/composer/dag_executor.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	25500234879.1	07 May 2026 02:01PM UTC	720	64.79	GitHub Action Run

stacklok / toolhive / 25500234879
65%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 25500234879

stacklok / toolhive / 25500234879 65%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 25500234879

stacklok / toolhive / 25500234879
65%

README BADGES
x