Struct ControlToken 

pub struct ControlToken(/* private fields */);

A shared secret that proves a control-channel caller is this same user.

Why this exists

On Unix the daemon asks the kernel which uid is on the other end of the socket and refuses anything that is not its own - see the peer check in the unix module. Windows offers an equivalent, but reaching it means calling ImpersonateNamedPipeClient and comparing security identifiers through raw FFI, and this workspace is unsafe_code = "forbid" from top to bottom. So the Windows control channel served every connection it accepted: anyone who could reach the pipe could spawn a tool-executing agent and answer its approval prompts.

A token closes that without any of the FFI. The daemon writes a fresh random secret into its own directory, readable only by the owner, and refuses any connection that cannot quote it. A caller who can read the file is a caller who can already read config.toml - so the token grants nothing that was not already reachable, which is exactly the property wanted.

It is required on every platform, not only Windows. One protocol is easier to reason about than two, the extra round trip on a local socket is unmeasurable, and on Unix it is defence in depth behind the uid check rather than a replacement for it.

Implementations

impl ControlToken

pub fn path(dir: &Path) -> PathBuf

The token file beside the control socket.

pub fn pid_path(dir: &Path) -> PathBuf

Where the daemon records its own process id.

So lev daemon stop has a way through when the control channel does not answer - a wedged daemon, or a token file that went missing. Without it the only recovery was pkill, and the advice to “restart it” was advice that could not work: restart stops before it starts, and the stop was the part that failed.

pub fn write_pid(dir: &Path) -> Result<()>

Record this process as the running daemon.

pub fn read_pid(dir: &Path) -> Option<u32>

The recorded daemon pid, if one was written and still parses.

pub fn create(dir: &Path) -> Result<Self>

Generate a fresh token and write it owner-only.

Called at bind, so a restarted daemon invalidates every previous token - a stale one cannot be replayed against the new process.

pub fn load(dir: &Path) -> Result<Self>

Read the token a running daemon wrote.

pub fn matches(&self, presented: &str) -> bool

Whether presented is this token, compared in constant time.

Constant time because the comparison is against a secret and the caller controls the input: a byte-at-a-time early return leaks the prefix, and a local attacker can retry without limit.

pub fn expose(&self) -> &str

The token itself, for a client that is about to present it.

Trait Implementations

impl Clone for ControlToken

fn clone(&self) -> ControlToken

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ControlToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Never render the secret: this type ends up inside daemon state that other code may reasonably want to {:?}.