Local security and recovery

The local API accepts loopback and the published extension origin, then verifies a capability secret stored with restrictive file permissions. Token rotation keeps the previous secret valid for 24 hours so active processes can adopt the new value; revocation removes the file and forces reauthorization.

A stale tray PID lock is replaced while a live instance remains untouched. Stop and restart first use the helper’s graceful path; on macOS a stuck listener is terminated only after it remains responsive past the wait. Corrupt fallback history JSON resets to a blank schema with protected Personal and Inbox. Legacy screenshots under a nested shots/shots path are migrated without overwriting name conflicts.

The local workspace only accepts the Pinar application and the official extension. Rotation keeps the previous secret valid long enough for running processes to catch up; revocation forces a new authorization.

If another Pinar instance is already running, that instance stays in place. Nested screenshot folders are migrated without overwriting name conflicts. If local history cannot open, Pinar recovers a usable Personal project and Inbox instead of crashing.

• Keep using the official extension and the Pinar application; other sites cannot talk to the local workspace.
• After you revoke local access, restart Pinar so the workspace can authorize again.
• If local history cannot open, expect a recovered Personal project and Inbox rather than a crash.