DeskAccess v0.1.1

DeskAccess 0.1.1

Security and reliability update for iroh sidecar authentication, RDP tunnel stability, and pairing-link behavior.

Fixed

• Allow authenticated tunnel session tokens to open multiple short-lived app streams.
• Limit tunnel session tokens to 2 minutes and 16 uses to support RDP without restoring long-lived replay risk.
• Keep paired links active until revoked or deleted.
• Continue consuming one-time links after first use.

Security hardening

• Bind machine identity proofs to the DeskAccess node key to prevent transport-peer or crafted-invite identity confusion.
• Tighten Windows IPC/dashboard process validation so local control requests must come from the trusted DeskAccess executable.
• Validate iroh sidecar tickets before using or storing them, including refreshed tickets returned during pairing and reconnect.
• Protect SessionStore with internal locking.
• Clarify TPM support as hardware-backed identity-key proof, not full manufacturer-chain attestation.

Notes

Pairing links are reusable by design until revoked or deleted. One-time links remain single-use.

DeskAccess v0.1.0

Fix protocol handler windows