fix: remove shell injection from socket existence check

[lucasbalieiro]

closes https://github.com/project-loupe/audit-sv2-ui/issues/6

needs testing on linux to see if the node.sock probe still working from docker and dev envs

[GitGab19]

Clanker suggestion:

This test name says it covers both success and failure, but it only asserts the missing-path failure case. Could we also create the path and assert the script exits successfully? That would catch regressions where the probe always returns non-zero.

Suggested change

	test('bitcoinSocketExistsScript exits 0 when the socket exists and non-zero otherwise', () => {
	const tmp = mkdtempSync(path.join(tmpdir(), 'sock-exists-'));
	try {
	const socketPath = path.join(tmp, 'node.sock');
	execFileSync(process.execPath, ['-e', bitcoinSocketExistsScript, socketPath], {
	stdio: 'ignore',
	});
	assert.fail('expected non-zero exit for missing socket');
	} catch (err) {
	assert.ok(
	err && typeof err === 'object' && 'status' in err && err.status !== 0,
	'missing socket should exit non-zero',
	);
	}
	});
	test('bitcoinSocketExistsScript exits 0 when the socket path exists and non-zero otherwise', () => {
	const tmp = mkdtempSync(path.join(tmpdir(), 'sock-exists-'));
	try {
	const socketPath = path.join(tmp, 'node.sock');
	assert.throws(
	() => execFileSync(process.execPath, ['-e', bitcoinSocketExistsScript, socketPath], {
	stdio: 'ignore',
	}),
	/Command failed/,
	'missing socket path should exit non-zero',
	);
	writeFileSync(socketPath, '');
	execFileSync(process.execPath, ['-e', bitcoinSocketExistsScript, socketPath], {
	stdio: 'ignore',
	});
	} finally {
	rmSync(tmp, { recursive: true, force: true });
	}
	});

[lucasbalieiro]

amended the suggestion

[GitGab19]

Tested on Linux.

• Dev server (localhost:3001): a listening Unix socket at ~/.sv2-ui-pr239/node.sock validates successfully.
• Dev server missing-path check: ~/.sv2-ui-pr239-empty/node.sock returns the expected Socket not found error.
• Dockerized sv2-ui (localhost:8080): the same listening Unix socket validates successfully.

So the node.sock probe still works from both dev and Docker environments on Linux.