mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-15 07:36:50 +03:00
65c8089182
Review found that /agent-target-result checked the shared helper token and nothing else, so any connected overlay could resolve a target it never claimed. A result post now names the overlay (`clientId`), and while the target is pending only its lease holder's word lands: a bystander gets 409 (not_holder, or unclaimed when nobody holds it) and the request stays pending. The overlay sends its client id with every result. Every protocol case now answers from the tab that actually holds the claim. Also: the helper-wide bar preference is applied on every connected frame, and restoring wrote an empty display value, which dropped the bar's own inline flex layout for a plain live session that never asked for anything. Hiding remembers the bar's display value, restoring puts exactly that back, and a restore on a visible bar is a no-op. A plain boot through the launcher keeps display: flex after connect and its payload carries none of the lane's keys. Written with AI assistance (Claude). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>