naiba 36240f5888 fix(rpc): cap concurrent IO streams per user and per server ...

GHSA-jg62-j5h6-8mpq: the terminal and file-manager endpoints created unbounded
IO streams; an authenticated member could open thousands, each spawning
goroutines, a 1MiB buffer and an agent-side PTY, exhausting dashboard and agent
resources. CreateStream now enforces a per-user (20) and per-server (40) cap in
the existing ioStreamMutex critical section, using the stream map as the single
source of truth. Dashboard-internal streams (uid==0: NAT, server transfer, MCP
transfer) skip the per-user cap but still count per-server. Adds caps,
exemption, slot-release and no-leak regression tests.

2026-06-05 02:42:38 +00:00

..

dashboard

fix(rpc): cap concurrent IO streams per user and per server

2026-06-05 02:42:38 +00:00