Mage terminal WebSocket replayed PTY output before authentication

Mage's terminal WebSocket could connect to a known existing PTY and replay buffered output before authenticating the connecting client, according to the research and patch proposal. A setting that prevented later command input did not necessarily protect bytes already emitted by the server. This is a read-before-authorization problem: exposure could occur even if an attacker could not type a new shell command.

PR #6206 proposes verifying a valid Editor-authorized session before PTY attachment and replay, checking terminal-disable and project restrictions, then revalidating rights before later output. The local regression described by its author uses synthetic output, not confirmed production secret theft. At the inspected October 18 snapshot, this pull request remained open. It must not inherit the merged status of Mage's other October fixes, and no released patched version is established by that open proposal.

The attack still requires access to the WebSocket and knowledge or discovery of a terminal name. The evidence supports a potentially sensitive output disclosure path, not automatically remote code execution or proof that a real user's credentials were stolen. A complete fix needs to test initial attachment, buffered replay, continuing output, mid-session revocation and privilege changes separately.