michel/clusterflux-public
1
0
Fork 0
Code Issues Pull requests Projects Releases 21 Packages Wiki Activity Actions

Disclose node attach capability grants

Browse source
This commit is contained in:
Michel Paulissen 2026-07-03 22:04:13 +02:00
parent c514ab7f81
commit fe6c2d5042
3 changed files with 187 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/cli-first-contract-smoke.js
View file

@ -115,6 +115,7 @@ for (const [name, pattern] of [
["project local config coverage", /fn project_init_select_and_status_use_local_project_config\(\)/],
["project coordinator status coverage", /fn project_status_queries_public_coordinator_state\(\)/],
["run coordinator active-process coverage", /fn run_contacts_configured_coordinator_and_reports_active_process_conflicts\(\)/],
["node attach grant disclosure coverage", /fn node_attach_discloses_dangerous_capability_grants\(\)/],
["quota local status coverage", /fn quota_status_uses_project_config_and_generic_public_limits\(\)/],
["quota coordinator usage coverage", /fn quota_status_queries_public_coordinator_usage\(\)/],
["task event summary coverage", /fn process_task_log_and_artifact_reports_summarize_task_events\(\)/],
@ -197,6 +198,16 @@ expect(
"CLI sends agent workflow actor fields",
/fn add_workflow_actor_fields[\s\S]*actor_agent[\s\S]*agent_public_key_fingerprint/
);
expect(
cli,
"CLI exposes node attach grant disclosures",
/struct CapabilityGrantDisclosure[\s\S]*coordinator_policy_limited[\s\S]*fn capability_grant_disclosures/
);
expect(
cli,
"CLI parses dangerous capability overrides",
/"host-filesystem"[\s\S]*Capability::HostFilesystem[\s\S]*"network"[\s\S]*Capability::Network[\s\S]*"secrets"[\s\S]*Capability::Secrets/
);
for (const [name, pattern] of [
["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],