1.1.2

2026-08-28

Rework of the DevTools access after the second marketplace review round: a
random port is still an unauthenticated port, so the debug endpoint is gone
entirely.

Security

• No TCP debug port at all. The webapp now launches with
  --remote-debugging-pipe: the browser speaks CDP over file descriptors
  inherited from its launcher, so no process — not even one running as the
  same user — can connect to the authenticated mailbox session.
• New omarchy-protonmail-broker: the sole CDP client. It launches the
  browser, serves a narrowly scoped API on a unix socket
  (recent truncated metadata only; per-client SO_PEERCRED uid check) and
  forwards external tabs to the default browser itself.
• omarchy-protonmail-recent is now a thin broker client with the same
  output contract; omarchy-protonmail-linkguard was removed (its job lives
  in the broker's sweep).
• The launcher, widget and notification now focus-or-launch through
  omarchy-protonmail-focus-or-launch.

Fixed

• Window focusing on newer Hyprland versions that dispatch through
  hl.dsp.focus(...) (legacy focuswindow address: syntax is kept as a
  fallback).