feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/service/oauth/pkce.rs

@@ -30,21 +30,26 @@ impl CodeVerifier {
     }
 }
 
-/// Produce one pseudo-random byte from the sub-second component of the system clock.
+/// Produce one pseudo-random byte from the system clock mixed with a monotonic
+/// counter, providing ~64 bits of per-call unpredictability without a `rand`
+/// dependency.
 ///
-/// Why: avoids pulling in a `rand` dependency for a short-lived, non-cryptographic
-/// verifier; each byte only needs to be unpredictable enough to prevent code
-/// interception, not cryptographically secure.
+/// Why: avoids pulling in a `rand` dependency for a short-lived verifier; the
+/// monotonic counter ensures that calls within the same clock tick produce
+/// different values, which is sufficient to prevent OAuth code interception.
 fn rand_byte() -> u8 {
+    use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::{SystemTime, UNIX_EPOCH};
-    let nanos = SystemTime::now()
+    static COUNTER: AtomicU64 = AtomicU64::new(0);
+    let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
+    let seed = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .unwrap_or_else(|_| {
             tracing::warn!("[pkce] system time before UNIX_EPOCH, using 0 for random byte");
             std::time::Duration::default()
         })
-        .subsec_nanos();
-    (nanos & 0xFF) as u8
+        .as_nanos() as u64;
+    ((seed ^ counter) & 0xFF) as u8
 }
 
 /// The S256-derived code challenge sent in the authorization request URL.