Make history and remote message handling fail closed

tests/config-store.test.js

@@ -261,6 +261,39 @@ describe('ConfigStore', () => {
     assert.equal(history[104].id, 'batch-104');
   });
 
+  it('durably syncs migrated history before replacing the live file', async () => {
+    store._historyMigrated = true;
+    fs.writeFileSync(store.historyPath, '[]', 'utf-8');
+    const originalOpen = fs.promises.open;
+    const originalRename = fs.promises.rename;
+    let synced = false;
+    let renamed = false;
+    fs.promises.open = async (...args) => {
+      const handle = await originalOpen(...args);
+      const originalSync = handle.sync.bind(handle);
+      handle.sync = async () => {
+        await originalSync();
+        synced = true;
+      };
+      return handle;
+    };
+    fs.promises.rename = async (...args) => {
+      assert.equal(synced, true);
+      renamed = true;
+      return originalRename(...args);
+    };
+
+    try {
+      await store.appendHistory({ id: 'durable', files: [] });
+    } finally {
+      fs.promises.open = originalOpen;
+      fs.promises.rename = originalRename;
+    }
+
+    assert.equal(renamed, true);
+    assert.deepEqual(store.loadHistory().map(entry => entry.id), ['durable']);
+  });
+
   it('clearHistory empties the array', async () => {
     await store.appendHistory({ id: 'test', files: [] });
     assert.equal(store.loadHistory().length, 1);

tests/remote-server.test.js

@@ -67,4 +67,28 @@ describe('RemoteServer', () => {
     assert.notStrictEqual(end, -1);
     assert.match(source.slice(start, end), /host:\s*'127\.0\.0\.1'/);
   });
+
+  it('rejects non-object JSON before authentication without throwing', () => {
+    const { EventEmitter } = require('node:events');
+    const RemoteServer = require('../lib/remote-server');
+    const server = new RemoteServer();
+    const socket = new EventEmitter();
+    socket.close = (code) => {
+      socket.closeCode = code;
+    };
+    socket.send = () => {};
+    server._config = {
+      token: 'test-token-123',
+      allowlist: [],
+      diagnosticMode: false,
+      onCreateCaptureWindow: () => {},
+      onDestroyCaptureWindow: () => {},
+      onSignalingToCapture: () => {}
+    };
+
+    server._handleConnection(socket, { socket: { remoteAddress: '127.0.0.1' } });
+    assert.doesNotThrow(() => socket.emit('message', Buffer.from('null')));
+    assert.strictEqual(socket.closeCode, 4002);
+    socket.emit('close');
+  });
 });