Public release release-09ca780bd67a

Source commit: 09ca780bd67a00467e78139cf38466b8201b66ca

Public tree identity: sha256:2f744c260b5fc2cf074ad9129f97f87f03714902e5b9fe174128afdc342ec2d0

scripts/user-session-token-boundary-smoke.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+
+const repo = path.resolve(__dirname, "..");
+
+function read(file) {
+  return fs.readFileSync(path.join(repo, file), "utf8");
+}
+
+function extractBalancedBlock(source, marker) {
+  const start = source.indexOf(marker);
+  assert(start >= 0, `missing marker ${marker}`);
+  const open = source.indexOf("{", start);
+  assert(open >= 0, `missing opening brace for ${marker}`);
+  let depth = 0;
+  for (let index = open; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "{") depth += 1;
+    if (char === "}") {
+      depth -= 1;
+      if (depth === 0) return source.slice(start, index + 1);
+    }
+  }
+  throw new Error(`missing closing brace for ${marker}`);
+}
+
+function extractEnumVariant(source, variant) {
+  const marker = `    ${variant} {`;
+  return extractBalancedBlock(source, marker);
+}
+
+const forbiddenUserSessionCredentials =
+  /\b(BrowserSession|CliDeviceSession|BrowserLoginFlow|CliLoginFlow|authorization_url|verification_url|device_code|access_token|refresh_token|provider_token|provider_tokens|session_token|user_token|oauth_token)\b/i;
+
+function assertNoUserSessionCredential(surface, text) {
+  assert.doesNotMatch(
+    text,
+    forbiddenUserSessionCredentials,
+    `${surface} must not carry user OAuth/browser/session credentials`
+  );
+}
+
+const coordinatorService = `${read("crates/clusterflux-coordinator/src/service/protocol.rs")}\n${read("crates/clusterflux-coordinator/src/service/protocol/responses.rs")}`;
+for (const variant of [
+  "AdminStatus",
+  "SuspendTenant",
+  "AttachNode",
+  "RegisterAgentPublicKey",
+  "ListAgentPublicKeys",
+  "RotateAgentPublicKey",
+  "RevokeAgentPublicKey",
+  "NodeHeartbeat",
+  "ReportNodeCapabilities",
+  "RevokeNodeCredential",
+  "RequestRendezvous",
+  "RequestSourcePreparation",
+  "CompleteSourcePreparation",
+  "StartProcess",
+  "ReconnectNode",
+  "CancelTask",
+  "CancelProcess",
+  "PollTaskControl",
+  "RestartTask",
+  "DebugAttach",
+  "TaskCompleted",
+]) {
+  assertNoUserSessionCredential(
+    `CoordinatorRequest::${variant}`,
+    extractEnumVariant(coordinatorService, variant)
+  );
+}
+
+const nodeRuntime = [
+  read("crates/clusterflux-node/src/lib.rs"),
+  read("crates/clusterflux-node/src/command_runner.rs"),
+].join("\n");
+for (const marker of [
+  "pub struct LinuxCommandRunPlan",
+  "pub struct LinuxCommandTaskOutput",
+  "pub struct CapturedCommandLogs",
+  "pub struct VirtualThreadCommand",
+  "pub struct CommandOutput",
+]) {
+  assertNoUserSessionCredential(marker, extractBalancedBlock(nodeRuntime, marker));
+}
+
+const coreExecution = read("crates/clusterflux-core/src/execution.rs");
+assertNoUserSessionCredential(
+  "CommandInvocation",
+  extractBalancedBlock(coreExecution, "pub struct CommandInvocation")
+);
+
+const dapAdapter = read("crates/clusterflux-dap/src/variables.rs");
+assertNoUserSessionCredential(
+  "DAP variables response",
+  extractBalancedBlock(dapAdapter, "fn variables_response")
+);
+
+const panel = read("crates/clusterflux-core/src/operator_panel.rs");
+assertNoUserSessionCredential(
+  "PanelEvent",
+  extractBalancedBlock(panel, "pub struct PanelEvent")
+);
+
+const auth = read("crates/clusterflux-core/src/auth.rs");
+assert.match(
+  auth,
+  /task_credentials_do_not_contain_user_session/,
+  "core auth must keep the task credential user-session guard"
+);
+assert.match(
+  auth,
+  /CredentialKind::BrowserSession \| CredentialKind::CliDeviceSession/,
+  "task credential guard must reject browser and CLI sessions"
+);
+
+console.log("User session token boundary smoke passed");