winrdp-mcp 0.1.1 — security hardening

Security & reliability hardening from a full-code audit. Recommended upgrade from 0.1.0.

No tool signatures were removed. One behavioral change: provisioning no longer enables
Basic auth / AllowUnencrypted / TrustedHosts=* (NTLM encrypts the payload without them).

Security

• Fixed a PowerShell injection in write_event (level) that ran as SYSTEM; validated file_hash.algorithm and ui_find.control_type too.
• deploy_ui_agent now binds 127.0.0.1 by default (was 0.0.0.0 with an optional auth key — an unauthenticated remote desktop-control endpoint); a non-loopback bind requires a validated auth_key.
• New-account passwords (user_create / service_create) are staged to an admin-only file and read on the box, keeping them off the target's process command line / Event 4688.
• Provisioning no longer sets Basic / AllowUnencrypted / TrustedHosts=*.
• Vault passphrase KDF is now scrypt + a persisted salt (was unsalted SHA-256); old inventories still decrypt and re-encrypt to the strong key on next save.
• Owner-only ACLs for the vault key (no open write window), the encrypted inventory, and an on-box secrets directory.
• Log redaction now scrubs the rendered message (secrets passed as %s args were leaking); model-facing error text is redacted.

Reliability

• Fixed infinite recursion in the chunked file upload over a WinRM-only box with no SMB/SSH fast channel.
• Each transport now serializes its own use (pywinrm/paramiko aren't thread-safe) — fixes the HTTP 400 cascade under concurrent same-host calls; run_on_hosts dedups aliases.
• Reconnect-retry no longer double-executes non-idempotent calls; per-call timeout is honored on WinRM.
• Session-leak fixes (SMB channel close, failed fast-channel close, port_forward SSH client + ssh_port); locked vault saves; guarded elevated-task cleanup.

Install / upgrade

pipx upgrade winrdp-mcp   # or: pipx install winrdp-mcp

Full details in CHANGELOG.md.