refactor(server): drop the concatBytes imports the signature change orphaned

[chrischall]

The one nit from #223, on a fresh branch — #222 merged while I was fixing it.

Six integration fixtures (mutual-auth-idb, graphql-query, read-cookies, all-bootstrap-verbs, two-mcps, reconnect) and peer.ts still imported concatBytes after their signature payloads moved to readySignaturePayload(). Checked each rather than trusting the list: all seven had zero remaining call sites.

host.ts keeps its import — it still concatenates for the peer hello signature (mcpId || sessionNonce), which is a different payload and unaffected by #222.

Worth removing beyond tidiness in one case: in peer.ts the import was the last trace of the payload shape that #222 established is a security bug, sitting a few lines from the code that no longer builds it.

1233 tests, typecheck clean across all six workspaces.

Closes #223

[claude]

Claude finished @chrischall's task in 56s —— View job

---

Review: Remove unused concatBytes imports

Task List

• Read CLAUDE.md and understand project conventions
• Review PR diff to identify all changes
• Verify concatBytes usage is actually removed in changed files
• Verify concatBytes is still used in host.ts (as PR claims)
• Verify context and payload correctness
• Post review findings

---

Analysis

This PR removes concatBytes imports from 7 files (1 source + 6 integration test files) after PR #222 refactored the ready-signature payload to use readySignaturePayload().

Verification performed:

1. Grep for remaining usage in modified files:

   grep -n "concatBytes" packages/server/src/peer.ts packages/server/tests/integration/*.test.ts
   

   Result: No matches — confirms all 7 imports removed had zero call sites.

2. Confirmed host.ts still uses concatBytes:

   grep -n "concatBytes" packages/server/src/host.ts
   

   Result: Line 6 (import), line 302 (usage in peer hello signature). ✅ Correct — different payload.

3. Payload context verified:

   • Removed from: ready-signature payload (now readySignaturePayload(mcpHelloNonce || extHelloNonce || extensionSessionPub))
   • Still used in host.ts:302: peer hello signature (mcpId || sessionNonce)
   • Still used in build-server-hello.ts:63: MCP server hello signature (mcpId || sessionNonce)

   These are intentionally different payloads — no cross-contamination.

4. Adherence to conventions:

   • PR has label refactor ✅ (per .github/release.yml)
   • Conventional-Commit title follows format ✅
   • PR description cites the context (feat(protocol)!: bind the ephemeral key into the ready signature #222, Auto-review follow-ups for PR #222: feat(protocol)!: bind the ephemeral key into the ready signature #223) ✅
   • No version bumps in the PR (correct per CLAUDE.md) ✅

Findings

No issues found. The removals are correct, targeted, and well-scoped. The PR author correctly identified that the imports were dead code after the signature-payload refactor and preserved the legitimate uses in host.ts and build-server-hello.ts.

Verdict: pass

---

[github-actions]

✅ Auto-review verdict: pass — All seven concatBytes imports removed had zero call sites after PR #222's refactor. Legitimate uses in host.ts and build-server-hello.ts were correctly preserved.