Credentials sent in WebSocket query string

[ComfyChloe]

Problem

The desktop client authenticates to wss://arcosc.app:48255 by passing username and password in the Socket.IO query string. Even over WSS, query strings are routinely recorded in web-server access logs, reverse-proxy logs, error trackers, and any intermediate analytics tooling, and they are visible to anything with handshake-level access. The Socket.IO engine supports a private auth payload that travels in the engine handshake body, not the URL.

Evidence

main/services/websocketManager.ts:73
    this.socket = io(socketUrl, {
        query: { username, password, clientVersion },
        transports: ['websocket'],
        autoConnect: false,
        ...
    })

File: main/services/websocketManager.ts:73 in ComfyChloe/ARC-Client.

Suggested fix

Switch to the Socket.IO auth payload so credentials travel in the engine handshake body, not the URL. The backend client_ws_manager.ts:268-272 already documents the desired migration ("Upgrade ARC-Client to send via socket.io auth payload"). Capture the credentials into { username, password, clientVersion } and pass them to io(socketUrl, { auth: {...}, transports: ['websocket'], ... }). Until then, the auth path is exposed in any system that logs the connect URL.