chore(release): prepare 0.7.1

CHANGELOG.md

@@ -20,6 +20,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Applied rate-limiting and text length bounds to the custom `firelink://` scheme to mitigate DoS and injection attempts.
 
 ### Fixes
+- Restored the UUID fallback for token generation to prevent silent failures if secure random byte generation fails.
+- Hardened local API security by immediately rejecting requests if the expected pairing token is completely empty.
 - Implemented a thread-safe cleanup mechanism for temporary directories to resolve a concurrency race condition during engine cancellation.
 
 ## [0.7.0] - 2026-06-11

Sources/Firelink/LocalExtensionServer.swift

@@ -156,6 +156,10 @@ final class LocalExtensionServer: @unchecked Sendable {
         }
 
         let expectedToken = currentPairingToken
+        guard !expectedToken.isEmpty else {
+            return .forbidden
+        }
+        
         let bodyString = String(data: request.body, encoding: .utf8) ?? ""
         guard let signatureHex = request.header(named: "x-firelink-signature"),
               let timestampStr = request.header(named: "x-firelink-timestamp"),

Sources/Firelink/Settings/IntegrationSettingsPane.swift

@@ -61,6 +61,8 @@ struct IntegrationSettingsPane: View {
                                 let status = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
                                 if status == errSecSuccess {
                                     settings.extensionPairingToken = Data(bytes).base64EncodedString()
+                                } else {
+                                    settings.extensionPairingToken = UUID().uuidString
                                 }
                             }
                         )