The LAN-bound HTTP server joined the raw URL path onto the project dir,
so /../../.ssh/id_ed25519 (and %2e%2e variants) served any file the
user could read. Resolve and require the path stay inside the project.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add src/workbench/cli.py with subcommands: mcp (stdio transport), serve
(standalone project serving), list (show all projects). Remove legacy
server.py and scaffold.html from project root.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mortdecai