fix: harden plugin sockets, public routes, prebuilt binaries and login fallback

src/backend/tests/plugins/ctx-process.test.ts

@@ -113,7 +113,8 @@ describe("ctx.process.ensureBinary", () => {
   const contents = "#!/bin/sh\necho hi\n";
 
   it("uses a prebuilt copy whose checksum matches, without downloading", async () => {
-    const prebuilt = path.join(dir, "prebuilt-tool");
+    await fs.mkdir(path.join(dir, "prebuilt"), { recursive: true });
+    const prebuilt = path.join(dir, "prebuilt", "tool");
     await fs.writeFile(prebuilt, contents);
     const fetch = vi.fn();
     const { process: proc } = create({ fetch: fetch as never });
@@ -129,6 +130,23 @@ describe("ctx.process.ensureBinary", () => {
     expect(fetch).not.toHaveBeenCalled();
   });
 
+  it("never hashes a prebuilt path that is not the binary itself", async () => {
+    const other = path.join(dir, "secrets.db");
+    await fs.writeFile(other, contents);
+    await fs.mkdir(path.join(dir, "tool-dir", "tool"), { recursive: true });
+    const fetch = vi.fn(async () => new Response(contents));
+    const { process: proc } = create({ fetch: fetch as never });
+    const result = await proc.ensureBinary({
+      name: "tool",
+      version: "1",
+      url: "https://example.test/tool",
+      sha256: sha256(contents),
+      prebuilt: [other, "relative/tool", path.join(dir, "tool-dir", "tool")],
+    });
+    expect(result).toBe(path.join(dir, "bin", "tool"));
+    expect(fetch).toHaveBeenCalledOnce();
+  });
+
   it("downloads once, verifies it and reuses the copy", async () => {
     const fetch = vi.fn(async () => new Response(contents));
     const { process: proc } = create({ fetch: fetch as never });