fix: resolve security and correctness findings

[icanvardar]

Summary

• Relay: buffer pre-auth frames so the host/viewer socket isn't closed before ticket auth completes
• CLI: PtySession spawn failure no longer hangs shell-host (deferred emit + state guard)
• Backend: never use a known default Better Auth secret outside dev (ephemeral fallback fails closed)
• Backend: rate-limit unauthenticated device-auth endpoints
• CLI: installer verifies release archive checksum before extraction
• Relay: parity test guards the deploy-time protocol copy against @repo/protocol drift

---

Note

High Risk
Touches authentication secret handling, unauthenticated device-auth endpoints, and relay WebSocket authorization—security-sensitive paths where misconfiguration or regressions could block logins or weaken abuse protections.

Overview
Addresses several security and correctness findings across the relay, CLI shell host, backend auth, and release pipeline.

Relay now initializes WebSocket connections with explicit pre-auth state, buffers inbound frames until ticket authorization completes (instead of treating the socket as unbound), flushes them in order after bind, skips work if the socket closed during the Convex round-trip, and caps pre-auth buffering at 32 frames. A protocol parity test compares the deploy-time protocol.ts copy against @repo/protocol so CI catches wire-format drift.

CLI / PTY: PtySession defers error/exit emits on spawn failure so callers can attach listeners; shell-host exits early when spawn already failed and resolves exit if the session closed during setup, avoiding hangs. A regression test covers the late-listener case.

Backend: BETTER_AUTH_SECRET resolution moves to lazy evaluation in createAuth; outside development, missing config uses an ephemeral random secret (fail-closed) instead of a known default or a module-load throw that breaks Convex deploy. Fixed-window rate limits on unauthenticated device-code request/poll mutations are backed by a new rateLimit table and enforceRateLimit helper.

Release / install: CLI releases attach checksums.txt; install.sh verifies SHA-256 against that file before extracting. Minor .oxfmtignore tweak for **/_generated/**.

^{Reviewed by Cursor Bugbot for commit 3521fa7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dec34e7. Configure here.}

[cursor]

Ephemeral auth secret not stable

High Severity

When BETTER_AUTH_SECRET is unset outside development, resolveBetterAuthSecret() generates a new ephemeral secret on each createAuth() invocation. This causes a mismatch between the secret used by the Better Auth component (initialized once) and secrets used by HTTP routes, leading to unpredictable session and device token validation failures.

 

^{Reviewed by Cursor Bugbot for commit dec34e7. Configure here.}