[rounak610]

What is this about?

The v8 port of #319. It protects the service's local gRPC connection to the BrowserStack CLI binary with a per-launch token (SDK-7618, CWE-306). Paired with browserstack-binary#1984, which rejects calls without the token.

• BrowserstackCLI.start() generates a token (randomBytes(32), hex) and sets BROWSERSTACK_CLI_AUTH_TOKEN in process.env before spawning the binary, so the binary and every wdio worker inherit it.
• GrpcClient.connect() passes one grpc-js interceptor to the SDKClient stub that adds x-browserstack-cli-token to every call.
• There is no opt-out: every spawn gets a fresh token. Dev mode (BROWSERSTACK_CLI_ENV=development) generates nothing, because it connects to a separately started binary.

The code is the same as #319. The v8 files have drifted from main, so this is a hand port, not a cherry-pick. Older binaries ignore the extra header, so this can be released before or after the binary. Sibling SDK PRs: #319 (v9), https://github.com/browserstack/browserstack-python-sdk/pull/1353, https://github.com/browserstack/browserstack-node-agent/pull/2780, https://github.com/browserstack/browserstack-ruby-sdk/pull/221, https://github.com/browserstack/browserstack-javaagent/pull/2363, https://github.com/browserstack/browserstack-csharp-sdk/pull/1429

Related Jira task/s

• https://browserstack.atlassian.net/browse/SDK-7618

Release (mandatory for every PR — required for the ready-for-review label)

Version bump: (required — tick exactly one)

• minor (backwards-compatible feature)
• patch (bug fix or other small change)

Release notes type: (optional)

• New Feature
• Bug Fix
• Other Improvement

Release notes (customer-facing): (optional but encouraged)

• Secured the local connection between the SDK and the BrowserStack CLI with a per-run token.

Release notes (internal): (required — engineer-facing; what actually changed / why)

• v8 line: the SDK generates BROWSERSTACK_CLI_AUTH_TOKEN per binary spawn and sends x-browserstack-cli-token on every RPC. Enforced by browserstack-binary#1984 and ignored by older binaries. CWE-306 (SDK-7618). Same change as [SDK-7618] fix(security): send the CLI launch token on every gRPC call #319 (v9).

Checklist

• Ready to review
• Has it been tested locally?

PR Validations

Run Tests: Comment RUN_TESTS to trigger sanity tests.

🤖 Generated with Claude Code

[rounak610]

E2E verification (SDK-7618, v8) against a packaged binary built from browserstack-binary#1984 (head b848bf2a), with the binary pointed at via SDK_CLI_BIN_PATH. In each run an unrelated local process called ConnectBinSession on the live binary (no token / wrong token) to check enforcement.

Framework: wdio 8.46.0 mocha, 2 spec files, maxInstances: 2, Windows 11 chrome, Automate + Test Observability (CLI flow, binary spawned by the launcher).

Run	Service	Result	Outside call
A	released 8.55.0 (npm)	3/3 passed, 2/2 workers connected	OK (open, as today)
B	this PR (npm pack build)	3/3, 2/2 workers connected	UNAUTHENTICATED with no token and with a wrong token; OK with the right token
C	this PR + BROWSERSTACK_CLI_AUTH_DISABLE=true	3/3, 2/2 workers connected	OK

• Socket: the unix socket is srw-------.
• gRPC event counts: identical across A/B/C, with no failed events (startBinSession 1, connectBinSession 2, driverInit 2, testFrameworkEvent 6, testSessionEvent 3, logCreatedEvent 1, hook 12).
• Token: both workers in B inherited the launcher's token. The token value and the variable name appear in no log.

Static checks on this branch:

• Build and tsc --noEmit are clean.
• Unit tests: 1171/1171 pass, including tests/cli/** 367/367.
• ESLint (main's config): no new errors. src/grpc/index.ts has the same 214 errors as on origin/v8, from the file's 2-space style with semicolons.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 23faa76f-2e8a-453c-b3ba-8c2ebc253468

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[rounak610]

✅ Good to go

File	Status	Reason
.changeset/pr-326.md	✅ All Clear	Judged, no issues
packages/browserstack-service/src/cli/grpcClient.ts	✅ All Clear	Judged, no issues
packages/browserstack-service/src/cli/index.ts	✅ All Clear	Judged, no issues
packages/browserstack-service/src/constants.ts	✅ All Clear	Judged, no issues
packages/browserstack-service/src/grpc/index.ts	✅ All Clear	Judged, no issues

Change map (generated deterministically from the diff)

graph LR
  subgraph nwdio_browserstack_service["wdio-browserstack-service"]
    npackages_browserstack_service_src_cli_grpcClient_ts["⚠ grpcClient.ts<br/>~7 lines"]
    npackages_browserstack_service_src_grpc_index_ts["⚠ index.ts<br/>~7 lines"]
    n_changeset_pr_326_md["pr-326.md<br/>~5 lines"]
    npackages_browserstack_service_src_cli_index_ts["index.ts<br/>~4 lines"]
    npackages_browserstack_service_src_constants_ts["constants.ts<br/>~4 lines"]
  end

Loading

↻ This verdict comment is the review anchor — it's updated in place on each run (the gate posts its status separately).

— SDK PR Review Agent

[github-actions]

🟢 SDK PR Review gate is green — the SDK PR Review Agent has run on the current head commit (verdict: success).

This gate confirms a review ran on the latest commit. The verdict itself is advisory — read the findings and use your judgement; it does not block merge. A native GitHub reviewer approval is still separately required by branch protection before this PR can merge.

[github-actions]

⚠️ The ready-for-review label was removed because the PR body does not pass the release gate:

• Tick - [x] Ready to review once the PR body is complete.

How to get (and keep) the ready-for-review label:

1. Make sure the PR body follows the repo PR template (all sections present).
2. In the ## Release section, tick exactly one version bump (minor or patch).
3. Fill in at least one bullet under **Release notes (internal):** (engineer-facing; feeds the internal CHANGELOG.md).
4. Tick - [x] Ready to review in the checklist.
5. Apply the ready-for-review label yourself — this workflow does NOT add it for you; it only removes it if the body stops passing, and the check stays red until the label is present.

[rounak610]

Removed the BROWSERSTACK_CLI_AUTH_DISABLE off switch (e1f585b). BrowserstackCLI.start() now always sets a fresh randomBytes(32) token before spawning the binary. The changeset no longer mentions the switch.

Re-tested against the browserstack-binary#1984 build with the patched npm pack service (8.x line, wdio 8.46 mocha, 2 workers):

Run	Result	Outside call (no token / wrong token / right token)
Patched	3/3, 2/2 workers connected	UNAUTHENTICATED / UNAUTHENTICATED / OK
Patched + BROWSERSTACK_CLI_AUTH_DISABLE=true exported	3/3, 2/2 connected, token still generated	UNAUTHENTICATED / UNAUTHENTICATED / OK

• Socket and token: the socket is srw------- in both runs. The token is not in any log.
• Static checks: build, tsc --noEmit and eslint on the changed files are clean.
• Unit tests: tests/cli 367/367, full suite 1171/1171.