mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-18 06:15:19 +02:00
The only limit on an unauthenticated control connection was the 30 s idle timeout, which starts again with every read. A local client that kept sending bytes or blank lines without ever completing `auth` kept its connection, and one of the 16 connection permits, for as long as it liked; sixteen of them locked every other client out. AuthDeadlineStream wraps the read half of a connection: until the connection authenticates, reads fail once AUTH_DEADLINE (10 s) has passed since it connected, and a blocking read waits no longer than what is left. Both transports use it (the desktop app's control server and the headless `photocraft-cli serve`). After `auth` succeeds only the idle timeout applies, as before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>