airaknit 1.1.2-rc.9

package/package.json

@@ -0,0 +1,122 @@
+{
+  "name": "airaknit",
+  "type": "module",
+  "version": "1.1.2-rc.9",
+  "description": "A playful web workbench for Claude Code and Codex",
+  "license": "MIT",
+  "keywords": [
+    "claude",
+    "claude-code",
+    "ai",
+    "chat",
+    "ui",
+    "agent",
+    "anthropic",
+    "bun",
+    "react"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lagz0ne/tinkaria.git"
+  },
+  "bin": {
+    "airaknit": "bin/airaknit",
+    "airaknit-project": "bin/airaknit-project"
+  },
+  "packageManager": "bun@1.3.11",
+  "files": [
+    "bin/",
+    "src/nats/",
+    "src/runner/",
+    "src/server/",
+    "src/shared/",
+    "dist/client/"
+  ],
+  "engines": {
+    "bun": ">=1.3.5"
+  },
+  "scripts": {
+    "build": "vite build",
+    "check": "bunx @typescript/native-preview --noEmit -p tsconfig.json && vite build",
+    "lint:rules": "bash .git/hooks/pre-commit --all",
+    "dev": "bun run ./scripts/dev.ts",
+    "dev:client": "vite --host 0.0.0.0 --port 5174",
+    "dev:server": "bun run ./scripts/dev-server.ts --no-open --port 5175",
+    "install:dev": "bun install && bun run build && bun install -g .",
+    "start": "bun run ./src/server/cli.ts",
+    "test": "bun test",
+    "verify:journey": "bun run ./scripts/verify-journey.ts",
+    "copy:legacy-transcripts": "bun run ./scripts/copy-legacy-transcripts.ts",
+    "prepublishOnly": "vite build"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.2.91",
+    "@chenglou/pretext": "^0.0.4",
+    "@lagz0ne/nats-embedded": "^0.3.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@nats-io/jetstream": "^3.3.1",
+    "@nats-io/jwt": "^0.0.10-5",
+    "@nats-io/kv": "^3.3.1",
+    "@nats-io/nats-core": "^3.3.1",
+    "@nats-io/transport-node": "^3.3.1",
+    "@radix-ui/react-alert-dialog": "^1.1.15",
+    "@radix-ui/react-context-menu": "^2.2.16",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-select": "^2.2.6",
+    "@tanstack/react-virtual": "^3.13.23",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-serialize": "^0.14.0",
+    "@xterm/addon-web-links": "^0.12.0",
+    "@xterm/headless": "^6.0.0",
+    "@xterm/xterm": "^6.0.0",
+    "cloudflared": "^0.7.1",
+    "default-shell": "^2.2.0",
+    "diff": "^8.0.4",
+    "file-type": "^22.0.1",
+    "js-yaml": "^4.1.1",
+    "mermaid": "^11.14.0",
+    "minimatch": "^10.2.5",
+    "qrcode": "^1.5.4",
+    "react-resizable-panels": "^4.9.0",
+    "shell-quote": "^1.8.4",
+    "sonner": "^2.0.7",
+    "sugar-high": "^1.0.0",
+    "web-push": "^3.6.7",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "@resvg/resvg-js": "^2.6.2",
+    "@tailwindcss/postcss": "^4.2.2",
+    "@tailwindcss/typography": "^0.5.19",
+    "@types/bun": "^1.3.11",
+    "@types/diff": "^8.0.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.5.0",
+    "@types/qrcode": "^1.5.6",
+    "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3",
+    "@types/shell-quote": "^1.7.5",
+    "@types/web-push": "^3.6.4",
+    "@vitejs/plugin-react": "6.0.1",
+    "autoprefixer": "^10.4.27",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "lucide-react": "^1.7.0",
+    "png-to-ico": "^3.0.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "react-markdown": "^10.1.0",
+    "react-router-dom": "^7.14.0",
+    "remark-gfm": "^4.0.1",
+    "sharp": "^0.34.5",
+    "streamdown": "^2.5.0",
+    "tailwind-merge": "^3.5.0",
+    "tailwindcss": "^4.2.2",
+    "typescript": "6.0.2",
+    "vite": "^8.0.3",
+    "zustand": "^5.0.12"
+  }
+}

package/src/nats/auth-callout/callout-config.test.ts

@@ -0,0 +1,93 @@
+import { describe, test, expect } from "bun:test"
+import { buildCalloutConfig, validateCalloutConfigShape } from "./callout-config"
+
+const FAKE_ACCOUNT_KEY = "ACPJ3QKPKLBKL6X4FAKEACCOUNTPUBLIC"
+const FAKE_AUTH_USER_KEY = "UDXFAKEUSERKEY3FAKEAUTHUSERPUBLIC"
+
+describe("buildCalloutConfig", () => {
+  test("includes required auth_callout block with provided keys", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+    })
+
+    expect(config).toContain("auth_callout")
+    expect(config).toContain(`issuer: "${FAKE_ACCOUNT_KEY}"`)
+    expect(config).toContain(`"${FAKE_AUTH_USER_KEY}"`)
+    expect(config).toContain("jetstream")
+    expect(config).toContain("websocket")
+    expect(config).toContain("no_tls: true")
+  })
+
+  test("uses default host 127.0.0.1 when not specified", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+    })
+    expect(config).toContain('"127.0.0.1"')
+  })
+
+  test("uses provided host", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+      host: "100.64.1.1",
+    })
+    expect(config).toContain('"100.64.1.1"')
+  })
+
+  test("includes storeDir when provided", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+      storeDir: "/tmp/nats-test-store",
+    })
+    expect(config).toContain('store_dir: "/tmp/nats-test-store"')
+  })
+
+  test("uses provided port", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+      port: 4567,
+      wsPort: 4568,
+    })
+    expect(config).toContain("port: 4567")
+    expect(config).toContain("port: 4568")
+  })
+
+  test("uses custom account name when provided", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+      accountName: "MY_ACCOUNT",
+    })
+    expect(config).toContain("MY_ACCOUNT")
+  })
+
+  test("no include directives (avoids wrapper mis-resolution bug)", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+    })
+    expect(config).not.toContain("include")
+  })
+})
+
+describe("validateCalloutConfigShape", () => {
+  test("passes for a valid config", () => {
+    const config = buildCalloutConfig({
+      accountPublicKey: FAKE_ACCOUNT_KEY,
+      authUserPublicKey: FAKE_AUTH_USER_KEY,
+    })
+    const { ok, missing } = validateCalloutConfigShape(config)
+    expect(ok).toBe(true)
+    expect(missing).toHaveLength(0)
+  })
+
+  test("fails when sections are missing", () => {
+    const { ok, missing } = validateCalloutConfigShape("just some text")
+    expect(ok).toBe(false)
+    expect(missing.length).toBeGreaterThan(0)
+  })
+})

package/src/nats/auth-callout/callout-config.ts

@@ -0,0 +1,109 @@
+/**
+ * Generate a self-contained nats-server config string for auth-callout mode
+ * (Stage A, PR1).
+ *
+ * Key points mirroring the spike caveat in decision 0007:
+ * - We do NOT use the wrapper's websocket+config combination (causes include
+ *   mis-resolution). This config is written to a temp file and passed via -c
+ *   to the binary directly.
+ * - The config includes the websocket{} block, JetStream, and the full
+ *   accounts + authorization { auth_callout { … } } block.
+ */
+
+export interface CalloutConfigOptions {
+  /** TCP listen port; -1 = nats-server picks a random one. */
+  port?: number
+  /** WebSocket listen port; -1 = nats-server picks a random one. */
+  wsPort?: number
+  /** Host to bind. Default: 127.0.0.1 */
+  host?: string
+  /** JetStream store directory. */
+  storeDir?: string
+  /**
+   * Optional HTTP monitoring port (bound to 127.0.0.1 only). When set, enables
+   * the nats-server monitoring endpoints (/connz, /subsz, /varz) for diagnostics.
+   * Localhost-only — never exposed beyond the server host. Off when undefined.
+   */
+  monitorPort?: number
+  /** Public key of the callout issuer account. */
+  accountPublicKey: string
+  /** Public key of the auth-service user (bypasses the callout). */
+  authUserPublicKey: string
+  /** Name used for the callout account and auth_users entry. */
+  accountName?: string
+}
+
+/**
+ * Return a complete nats-server configuration string for callout mode.
+ * The config is self-contained (no `include` directives) so it can be written
+ * to any path and passed to nats-server via `-c`.
+ */
+export function buildCalloutConfig(opts: CalloutConfigOptions): string {
+  const host = opts.host ?? "127.0.0.1"
+  const port = opts.port ?? -1
+  const wsPort = opts.wsPort ?? -1
+  const accountName = opts.accountName ?? "CALLOUT_ACCOUNT"
+
+  const lines: string[] = [
+    `# nats-server config — auth-callout mode (generated by Tinkaria)`,
+    `host: "${host}"`,
+    `port: ${port}`,
+    ``,
+    `# JetStream`,
+    `jetstream: true`,
+    ...(opts.storeDir ? [`store_dir: "${opts.storeDir}"`] : []),
+    ``,
+    // HTTP monitoring (diagnostics only, localhost-bound). Enables /connz, /subsz,
+    // /varz so we can inspect connections + per-connection subscriptions. Off
+    // unless monitorPort is provided.
+    ...(opts.monitorPort ? [`http: "127.0.0.1:${opts.monitorPort}"`, ``] : []),
+    `# WebSocket`,
+    `websocket {`,
+    `  host: "${host}"`,
+    `  port: ${wsPort}`,
+    `  no_tls: true`,
+    `}`,
+    ``,
+    `# Accounts — one account holds all connections`,
+    `accounts {`,
+    `  ${accountName} {`,
+    `    jetstream: enabled`,
+    `    users [`,
+    `      # auth_users: this user bypasses the callout (the responder itself)`,
+    `      { nkey: "${opts.authUserPublicKey}" }`,
+    `    ]`,
+    `  }`,
+    `}`,
+    ``,
+    `# Auth-callout — delegate authorization to the responder`,
+    `authorization {`,
+    `  auth_callout {`,
+    `    issuer: "${opts.accountPublicKey}"`,
+    `    auth_users: [ "${opts.authUserPublicKey}" ]`,
+    `    account: "${accountName}"`,
+    `  }`,
+    `}`,
+  ]
+
+  return lines.join("\n") + "\n"
+}
+
+/**
+ * Validate the generated config shape by checking for required sections.
+ * Used in tests; not called in production code.
+ */
+export function validateCalloutConfigShape(config: string): {
+  ok: boolean
+  missing: string[]
+} {
+  const required = [
+    "auth_callout",
+    "issuer:",
+    "auth_users:",
+    "account:",
+    "websocket",
+    "jetstream",
+  ]
+  const missing = required.filter((s) => !config.includes(s))
+  return { ok: missing.length === 0, missing }
+}

package/src/nats/auth-callout/callout.integration.test.ts

@@ -0,0 +1,332 @@
+/**
+ * Integration test — auth-callout isolation (Stage B, PR1).
+ *
+ * Proves:
+ *  1. A runner-A credential connects and can pub/sub its own scoped subjects.
+ *  2. The same runner-A credential is DENIED (permissions violation) on
+ *     runtime.runner.cmd.B.> — the subject scoped to runner-B.
+ *  3. The same runner-A credential is DENIED on runner-B's KV registry key.
+ *  4. A ui-client credential is denied on any runtime.runner.cmd subject.
+ *  5. Unknown/garbage token is refused at connect time.
+ *
+ * Stage B: credentials are minted via mintCredentialToken (stateless HMAC-signed
+ * tokens) rather than registered in the in-memory registry. All isolation
+ * assertions are preserved unchanged.
+ */
+
+import { describe, test, expect, afterAll, beforeAll } from "bun:test"
+import { spawn, type ChildProcess } from "node:child_process"
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { connect, tokenAuthenticator } from "@nats-io/transport-node"
+import { nkeyAuthenticator } from "@nats-io/nats-core"
+import type { NatsConnection } from "@nats-io/transport-node"
+import { resolveBinary } from "@lagz0ne/nats-embedded"
+import { ensureCalloutKeys } from "./keys"
+import { buildCalloutConfig } from "./callout-config"
+import { CalloutResponder } from "./responder"
+import { runnerKvKeySubject } from "./scope-policy"
+import { mintCredentialToken } from "./token"
+
+// ── Test setup ────────────────────────────────────────────────────────────────
+
+const RUNNER_A = "runner-A"
+const RUNNER_B = "runner-B"
+
+// Tokens are minted from the shared secret in startCalloutServer(); declared
+// here so tests can reference them after setup.
+let SERVER_ADMIN_TOKEN: string
+let UI_CLIENT_TOKEN: string
+let RUNNER_A_TOKEN: string
+let RUNNER_B_TOKEN: string
+
+interface ServerInfo {
+  natsUrl: string
+  wsUrl: string
+  wsPort: number
+  tcpPort: number
+}
+
+let serverProcess: ChildProcess | null = null
+let responder: CalloutResponder | null = null
+let configDir: string | null = null
+let serverInfo: ServerInfo | null = null
+
+async function startCalloutServer(): Promise<ServerInfo> {
+  const dataDir = mkdtempSync(join(tmpdir(), "nats-callout-test-data-"))
+  configDir = mkdtempSync(join(tmpdir(), "nats-callout-test-conf-"))
+
+  const keys = await ensureCalloutKeys(dataDir)
+
+  // Stage B: mint stateless signed tokens — no registration needed.
+  SERVER_ADMIN_TOKEN = await mintCredentialToken({ class: "server-admin" }, keys.tokenSecret)
+  UI_CLIENT_TOKEN = await mintCredentialToken({ class: "ui-client" }, keys.tokenSecret)
+  RUNNER_A_TOKEN = await mintCredentialToken({ class: "runner", runnerId: RUNNER_A }, keys.tokenSecret)
+  RUNNER_B_TOKEN = await mintCredentialToken({ class: "runner", runnerId: RUNNER_B }, keys.tokenSecret)
+
+  const config = buildCalloutConfig({
+    host: "127.0.0.1",
+    port: -1,  // random
+    wsPort: -1, // random
+    accountPublicKey: keys.accountPublicKey,
+    authUserPublicKey: keys.authUserPublicKey,
+  })
+
+  const configPath = join(configDir, "test-callout.conf")
+  writeFileSync(configPath, config)
+
+  const binaryPath = resolveBinary()
+
+  return new Promise<ServerInfo>((resolve, reject) => {
+    const proc = spawn(binaryPath, ["-c", configPath], {
+      stdio: ["ignore", "ignore", "pipe"],
+    })
+
+    serverProcess = proc
+
+    const timeout = setTimeout(() => {
+      proc.kill("SIGKILL")
+      reject(new Error("nats-server did not start within 10s"))
+    }, 10_000)
+
+    proc.on("error", (err) => { clearTimeout(timeout); reject(err) })
+    proc.on("exit", (code) => {
+      clearTimeout(timeout)
+      reject(new Error(`nats-server exited early with code ${code}`))
+    })
+
+    let tcpPort: number | null = null
+    let wsPort: number | null = null
+    let buffer = ""
+
+    proc.stderr!.on("data", (chunk: Buffer) => {
+      buffer += chunk.toString()
+      const lines = buffer.split("\n")
+      buffer = lines.pop() ?? ""
+
+      for (const line of lines) {
+        const tcpMatch = line.match(/Listening for client connections on .+:(\d+)/)
+        if (tcpMatch) tcpPort = Number(tcpMatch[1])
+
+        const wsMatch = line.match(/Listening for websocket clients on .+:(\d+)/)
+        if (wsMatch) wsPort = Number(wsMatch[1])
+
+        if (tcpPort !== null && wsPort !== null) {
+          clearTimeout(timeout)
+          proc.removeAllListeners("exit")
+          const natsUrl = `nats://127.0.0.1:${tcpPort}`
+          resolve({ natsUrl, wsUrl: `ws://127.0.0.1:${wsPort}`, wsPort, tcpPort })
+          return
+        }
+      }
+    })
+  }).then(async (info) => {
+    // Start the responder — tokenSecret is sufficient; no registration step.
+    responder = new CalloutResponder({
+      natsUrl: info.natsUrl,
+      authUserKp: keys.authUserKp,
+      accountKp: keys.accountKp,
+      accountPublicKey: keys.accountPublicKey,
+      accountName: "CALLOUT_ACCOUNT",
+      tokenSecret: keys.tokenSecret,
+    })
+
+    await responder.start()
+
+    // Brief settle for the responder subscription to be active
+    await new Promise((r) => setTimeout(r, 100))
+
+    return info
+  })
+}
+
+async function connectWithToken(natsUrl: string, token: string): Promise<NatsConnection> {
+  return connect({
+    servers: natsUrl,
+    authenticator: tokenAuthenticator(token),
+    // Short timeout so permission errors surface quickly
+    timeout: 5000,
+  })
+}
+
+// ── Lifecycle ─────────────────────────────────────────────────────────────────
+
+beforeAll(async () => {
+  serverInfo = await startCalloutServer()
+}, 15_000)
+
+afterAll(async () => {
+  await responder?.stop()
+  serverProcess?.kill("SIGTERM")
+  if (configDir) {
+    try { rmSync(configDir, { recursive: true }) } catch { /* best-effort */ }
+  }
+})
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("auth-callout isolation", () => {
+
+  // ── Happy path ──────────────────────────────────────────────────────────────
+
+  test("runner-A connects with scoped credential", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, RUNNER_A_TOKEN)
+    expect(nc.isClosed()).toBe(false)
+    await nc.drain()
+  })
+
+  test("runner-A can publish its own heartbeat", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, RUNNER_A_TOKEN)
+    // If the subject is not allowed, NATS will close the connection with a
+    // permissions violation. No error here = allowed.
+    nc.publish(`runtime.runner.heartbeat.${RUNNER_A}`, new TextEncoder().encode("hb"))
+    await nc.flush()
+    await nc.drain()
+  })
+
+  test("runner-A can subscribe to its own cmd subject", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, RUNNER_A_TOKEN)
+    const sub = nc.subscribe(`runtime.runner.cmd.${RUNNER_A}.>`)
+    expect(sub).toBeDefined()
+    sub.unsubscribe()
+    await nc.drain()
+  })
+
+  test("ui-client connects and can subscribe to runner events", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, UI_CLIENT_TOKEN)
+    const sub = nc.subscribe("runtime.runner.evt.>")
+    expect(sub).toBeDefined()
+    sub.unsubscribe()
+    await nc.drain()
+  })
+
+  // ── Negative — the decisive isolation assertions ────────────────────────────
+
+  test("runner-A is DENIED on runtime.runner.cmd.B.> (permissions violation)", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, RUNNER_A_TOKEN)
+
+    // Collect status events and the closed reason.
+    const statusEvents: string[] = []
+    let closedError: Error | null = null
+
+    // Subscribe before triggering the violation.
+    void (async () => {
+      for await (const s of nc.status()) {
+        statusEvents.push(`${s.type}:${String(s.data)}`)
+      }
+    })()
+
+    const closedPromise = nc.closed().then((err) => {
+      closedError = err instanceof Error ? err : new Error(String(err ?? "connection closed"))
+    })
+
+    // Attempt to publish to runner-B's command subject (not in runner-A's pub allow list).
+    // NATS sends -ERR 'Permissions Violation for Publish' and closes the connection.
+    nc.publish(`runtime.runner.cmd.${RUNNER_B}.start`, new TextEncoder().encode("{}"))
+    await nc.flush().catch(() => { /* may fail if already closing */ })
+
+    // Wait for the connection to be closed (NATS closes it on permissions violation).
+    await Promise.race([
+      closedPromise,
+      new Promise((r) => setTimeout(r, 4000)),
+    ])
+
+    // Drain/close cleanup (may already be closed)
+    try { await nc.drain() } catch { /* expected */ }
+
+    // The decisive assertion: NATS must have closed the connection after the
+    // permissions violation, or we must have received a permissionsError status.
+    const hasPermissionsViolation =
+      closedError !== null ||
+      statusEvents.some((s) =>
+        s.toLowerCase().includes("permission") || s.toLowerCase().includes("violation")
+      )
+
+    const evidenceMsg = closedError
+      ? `connection closed by NATS: ${closedError.message}`
+      : `status events: ${statusEvents.join(", ")}`
+
+    console.log(`[TEST] runner-A denied on runtime.runner.cmd.${RUNNER_B}.start — ${evidenceMsg}`)
+
+    expect(hasPermissionsViolation).toBe(true)
+  }, 10_000)
+
+  test("runner-A is DENIED on runner-B KV registry key", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, RUNNER_A_TOKEN)
+
+    let denied = false
+    const errorPromise = new Promise<void>((resolve) => {
+      void (async () => {
+        for await (const s of nc.status()) {
+          if (s.type === "permissionsError" || String(s.data).includes("Permissions Violation")) {
+            denied = true
+            resolve()
+            return
+          }
+        }
+      })()
+      nc.closed().then(() => { denied = true; resolve() })
+    })
+
+    // Attempt to write runner-B's KV key directly via NATS publish.
+    const runnerBKvSubject = runnerKvKeySubject(RUNNER_B)
+    nc.publish(runnerBKvSubject, new TextEncoder().encode("{}"))
+
+    await Promise.race([
+      errorPromise,
+      nc.closed(),
+      new Promise((r) => setTimeout(r, 3000)),
+    ])
+
+    try { await nc.drain() } catch { /* expected */ }
+
+    expect(denied).toBe(true)
+    console.log(`[TEST] runner-A denied on runner-B KV subject (${runnerBKvSubject})`)
+  }, 10_000)
+
+  test("ui-client is DENIED on runtime.runner.cmd subject", async () => {
+    const nc = await connectWithToken(serverInfo!.natsUrl, UI_CLIENT_TOKEN)
+
+    let denied = false
+    const errorPromise = new Promise<void>((resolve) => {
+      void (async () => {
+        for await (const s of nc.status()) {
+          if (s.type === "permissionsError" || String(s.data).includes("Permissions Violation")) {
+            denied = true
+            resolve()
+            return
+          }
+        }
+      })()
+      nc.closed().then(() => { denied = true; resolve() })
+    })
+
+    nc.publish(`runtime.runner.cmd.${RUNNER_A}.start`, new TextEncoder().encode("{}"))
+
+    await Promise.race([
+      errorPromise,
+      nc.closed(),
+      new Promise((r) => setTimeout(r, 3000)),
+    ])
+
+    try { await nc.drain() } catch { /* expected */ }
+
+    expect(denied).toBe(true)
+    console.log("[TEST] ui-client denied on runtime.runner.cmd")
+  }, 10_000)
+
+  // ── Unknown credential is rejected at connect ──────────────────────────────
+
+  test("unknown token is refused at connect time", async () => {
+    let connectError: Error | null = null
+    try {
+      const nc = await connectWithToken(serverInfo!.natsUrl, "bogus-token-not-registered")
+      await nc.drain()
+    } catch (err) {
+      connectError = err instanceof Error ? err : new Error(String(err))
+    }
+    expect(connectError).not.toBeNull()
+    console.log("[TEST] unknown credential refused:", connectError?.message)
+  }, 10_000)
+})