cafeTechne/antigravity-link-extension v1.0.19

on GitHub

Security

• Debug endpoints now require authentication. /debug/* routes were previously accessible on the LAN without a token, exposing snapshot HTML, cascade IDs, Language Server connection details, and button inventories. They now require the same Bearer token as the REST API.
• Localhost guard on Language Server RPC calls. lsPost, cancelCascadeInvocation, and probePort now assert the destination URL is 127.0.0.1 before connecting. Requests to any other host are rejected.
• Hardened PID shell interpolation. findConnectPort validates pid as a positive integer below 10,000,000 and converts it to an explicit base-10 string before interpolation into shell commands.
• README network claim made precise. The "no network access outside your LAN" statement now explicitly lists the three local destinations so the claim is verifiable.
• rejectUnauthorized: false documented. All LS RPC call sites now explain that cert validation is intentionally skipped because the destination is always 127.0.0.1.