Security model
Loopback plus a token file — possession of the Mac is the auth. What that buys, and what it deliberately does not.
Security model (deliberate)
Loopback-only + token file = possession of the user's machine is the auth.
Any process running as the logged-in user can read the token and therefore
fully drive the deck — including spawning a shell pane and typing into it,
which is arbitrary command execution. That is the product: the deck is an
execution surface for agents the user already lets onto the machine. Do not
expose the port beyond loopback; there is no rate limit, scoping, or token
rotation (delete the token file and restart the app to re-mint). The one
guard is against accidents, not attackers: closing a pane the human opened
needs force, because addresses move and a bot's stale 1.x has hit a live
session.