Addresses three Copilot review comments on merged PR #8139:

1. exec.go authorizePodExec: the SAR-call-failed branch formatted the
   underlying error with `%v`, so `errors.Is(err, underlyingSARError)`
   silently returned false despite surrounding comments and the test
   name implying the underlying error was recoverable. Switched to
   double-%w (Go 1.20+): `fmt.Errorf("%w: %w", errExecSARFailed, err)`
   so callers can recover BOTH the sentinel AND the underlying SAR
   error via errors.Is.

2. exec_test.go TestAuthorizePodExec_SARError: the comment claimed the
   underlying error was recoverable, but the test only asserted the
   sentinel. Added `require.ErrorIs(t, err, sentinel)` so the
   double-%w contract is locked in by a test, not just a comment.

3. exec.go HandleExec deny branch: pre-#8139 logged the SAR deny
   reason under a structured `"reason"` slog key; #8139 accidentally
   embedded it only in the error string, breaking operator log
   queries that filter by the `reason` attribute. To restore the
   structured field without re-parsing error strings, authorizePodExec
   now returns `(execAuthzResult, error)` where execAuthzResult.reason
   is populated ONLY on errExecRBACDenied (empty on every other
   branch — allow, nil authorizer, missing subject, SAR failure).
   HandleExec passes authzResult.reason to slog.String("reason", ...)
   on the deny branch, alongside the wrapped error. Added
   TestAuthorizePodExec_Deny assertion that res.reason is the exact
   apiserver reason string (non-empty, distinct from the error), and
   a new TestAuthorizePodExec_DenyNoReason covering the empty-reason
   subcase. Non-deny branches assert res.reason stays empty so
   callers never accidentally log a synthesized reason.

No behavior change to the security decision: every fail-closed branch
from #8134/#8137/#8139 still denies the exec before the executor is
built. The `h.authorizer == nil` typed-nil guard from #8139 is
untouched.

build/vet/go test ./pkg/api/handlers/... -run Exec: all 13 tests pass.

Fixes #8140

Signed-off-by: Andy Anderson <[email protected]>

)

Addresses three Copilot review comments on merged PR #8139:

1. exec.go authorizePodExec: the SAR-call-failed branch formatted the
   underlying error with `%v`, so `errors.Is(err, underlyingSARError)`
   silently returned false despite surrounding comments and the test
   name implying the underlying error was recoverable. Switched to
   double-%w (Go 1.20+): `fmt.Errorf("%w: %w", errExecSARFailed, err)`
   so callers can recover BOTH the sentinel AND the underlying SAR
   error via errors.Is.

2. exec_test.go TestAuthorizePodExec_SARError: the comment claimed the
   underlying error was recoverable, but the test only asserted the
   sentinel. Added `require.ErrorIs(t, err, sentinel)` so the
   double-%w contract is locked in by a test, not just a comment.

3. exec.go HandleExec deny branch: pre-#8139 logged the SAR deny
   reason under a structured `"reason"` slog key; #8139 accidentally
   embedded it only in the error string, breaking operator log
   queries that filter by the `reason` attribute. To restore the
   structured field without re-parsing error strings, authorizePodExec
   now returns `(execAuthzResult, error)` where execAuthzResult.reason
   is populated ONLY on errExecRBACDenied (empty on every other
   branch — allow, nil authorizer, missing subject, SAR failure).
   HandleExec passes authzResult.reason to slog.String("reason", ...)
   on the deny branch, alongside the wrapped error. Added
   TestAuthorizePodExec_Deny assertion that res.reason is the exact
   apiserver reason string (non-empty, distinct from the error), and
   a new TestAuthorizePodExec_DenyNoReason covering the empty-reason
   subcase. Non-deny branches assert res.reason stays empty so
   callers never accidentally log a synthesized reason.

No behavior change to the security decision: every fail-closed branch
from #8134/#8137/#8139 still denies the exec before the executor is
built. The `h.authorizer == nil` typed-nil guard from #8139 is
untouched.

build/vet/go test ./pkg/api/handlers/... -run Exec: all 13 tests pass.

Fixes #8140

Signed-off-by: Andy Anderson <[email protected]>

…5406)

Phase 3d of the pod-SA → kc-agent refactor. The /ws/exec WebSocket now
runs under kc-agent using the user's own kubeconfig rather than the
backend pod ServiceAccount. The target cluster's apiserver enforces RBAC
natively against the caller's identity, so the SubjectAccessReview
workaround the backend handler had to simulate (#8120, #5406) is no
longer needed — the shell fails synchronously at stream-open time if
the user's kubeconfig doesn't permit pods/exec on the target pod.

Fixes #5406.

pkg/agent/server_exec.go (new file, ~520 lines):
  handleExec is the kc-agent side of the pod exec WebSocket. The flow
  mirrors the backend handler minus the pod-SA-specific layers:
    1. Token validation via the standard s.validateToken(r) path
       (Authorization header or ?token= query param fallback that
       kc-agent's /ws already uses) — no first-message JWT handshake.
    2. Gorilla WebSocket upgrade.
    3. Read the exec_init JSON frame (cluster/namespace/pod/container/
       command/tty/cols/rows).
    4. Resolve the clientset + REST config from the shared
       *k8s.MultiClusterClient (the user's kubeconfig).
    5. Build the SPDY exec stream and spin up ping ticker + read loop
       goroutines under a shared writeMu.
    6. Block on executor.StreamWithContext; on exit, drain the reader
       goroutine (#7048 / #7778 ordering preserved) and send the exit
       frame.

  What we kept from the backend handler because it's independent of
  the pod-SA problem:
    - The stdin drop telemetry (agentExecStdinDropCount +
      rate-limited WARN log on power-of-two session counts) from PR 7995.
    - The agentExecMaxStdinBytes frame cap (1 MiB).
    - The #7048 / #7778 ordering: drain reader before closing the
      resize queue channel to avoid send-on-closed panic.
    - Ping/pong keepalive so half-open TCP is detected within
      agentExecPongTimeout.
    - Terminal size queue for TTY resize events.
    - writeMu serializing every WriteMessage so stdout/stderr/ping/
      exit/error frames never race.

  What we dropped because kc-agent uses the user's kubeconfig:
    - First-message JWT auth handshake (authMessage type). Auth is on
      the HTTP upgrade now.
    - execAuthorizer interface + authorizePodExec + the four sentinel
      errors errExecAuthorizerUnavailable / errExecMissingUserSubject
      / errExecSARFailed / errExecRBACDenied. The whole SubjectAccess-
      Review dance was there to simulate the user's identity against
      the pod SA's clientset (#8120, #8137, #8139, #8140); kc-agent's
      clientset IS the user's identity, so the apiserver enforces
      natively.
    - Per-user execSessionsRegistry / registerExecSession /
      unregisterExecSession / CancelUserExecSessions. kc-agent is a
      per-user local process with no logout concept — if the user
      closes their browser tab the WebSocket closes, the read loop
      exits, and execCancel fires via defer. #6024's cross-session
      cleanup is no longer needed.

  Named constants instead of literals per the repo rule:
  agentExecMaxStdinBytes (1 MiB), agentExecPingInterval (30s),
  agentExecPongTimeout (45s), agentExecWriteDeadline (10s — explicit
  because gorilla unlike gofiber does not have an implicit write
  timeout), agentExecStdinBufferSize (32), agentExecResizeBufferSize
  (4), agentExecDefaultCols (80), agentExecDefaultRows (24).

pkg/agent/server.go:
  mux.HandleFunc("/ws/exec", s.handleExec) registered next to /ws with
  an explanatory comment.

pkg/api/handlers/exec.go + exec_test.go (deleted):
  The entire 791-line backend handler and its 395-line test file are
  gone. The architecture is cleaner now — there's one code path for
  exec, it runs against the user's identity, and the whole class of
  "who is the console SA and what can it impersonate" concerns is
  retired alongside the code.

pkg/api/handlers/auth.go:
  The Logout handler used to call CancelUserExecSessions (#6024) to
  tear down exec streams that were running as the pod SA when the
  user's JWT was revoked. kc-agent exec is per-user local, so there
  are no cross-session exec streams to cancel on logout. The SSE
  cancellation (#6029) stays; it's unrelated.

pkg/api/server.go:
  The backend /ws/exec route registration is gone. A comment at the
  same line points readers at pkg/agent/server_exec.go and
  web/src/hooks/useExecSession.ts for the replacement.

web/src/hooks/useExecSession.ts:
  The WebSocket URL is now LOCAL_AGENT_WS_URL.replace(/\/ws$/, '/ws/exec')
  instead of ${window.location.host}/ws/exec so the browser connects
  to the user's own kc-agent at 127.0.0.1:8585. The first-message
  auth send is removed (kc-agent validates on upgrade). STORAGE_KEY_TOKEN
  import dropped; LOCAL_AGENT_WS_URL added.

web/src/hooks/__tests__/useExecSession.test.ts (40/40 pass):
  Three assertion updates — sentMessages[0] is now exec_init (not
  auth), sentMessages[1] is no longer used. The "no auth token on
  connect" test is removed (that failure mode no longer exists on the
  frontend; kc-agent would 401 on upgrade instead, which the
  "constructor throwing" test already covers).

Refs #7993. Fixes #5406.

Signed-off-by: Andrew Anderson <[email protected]>

…5406) (#8168)

Phase 3d of the pod-SA → kc-agent refactor. The /ws/exec WebSocket now
runs under kc-agent using the user's own kubeconfig rather than the
backend pod ServiceAccount. The target cluster's apiserver enforces RBAC
natively against the caller's identity, so the SubjectAccessReview
workaround the backend handler had to simulate (#8120, #5406) is no
longer needed — the shell fails synchronously at stream-open time if
the user's kubeconfig doesn't permit pods/exec on the target pod.

Fixes #5406.

pkg/agent/server_exec.go (new file, ~520 lines):
  handleExec is the kc-agent side of the pod exec WebSocket. The flow
  mirrors the backend handler minus the pod-SA-specific layers:
    1. Token validation via the standard s.validateToken(r) path
       (Authorization header or ?token= query param fallback that
       kc-agent's /ws already uses) — no first-message JWT handshake.
    2. Gorilla WebSocket upgrade.
    3. Read the exec_init JSON frame (cluster/namespace/pod/container/
       command/tty/cols/rows).
    4. Resolve the clientset + REST config from the shared
       *k8s.MultiClusterClient (the user's kubeconfig).
    5. Build the SPDY exec stream and spin up ping ticker + read loop
       goroutines under a shared writeMu.
    6. Block on executor.StreamWithContext; on exit, drain the reader
       goroutine (#7048 / #7778 ordering preserved) and send the exit
       frame.

  What we kept from the backend handler because it's independent of
  the pod-SA problem:
    - The stdin drop telemetry (agentExecStdinDropCount +
      rate-limited WARN log on power-of-two session counts) from PR 7995.
    - The agentExecMaxStdinBytes frame cap (1 MiB).
    - The #7048 / #7778 ordering: drain reader before closing the
      resize queue channel to avoid send-on-closed panic.
    - Ping/pong keepalive so half-open TCP is detected within
      agentExecPongTimeout.
    - Terminal size queue for TTY resize events.
    - writeMu serializing every WriteMessage so stdout/stderr/ping/
      exit/error frames never race.

  What we dropped because kc-agent uses the user's kubeconfig:
    - First-message JWT auth handshake (authMessage type). Auth is on
      the HTTP upgrade now.
    - execAuthorizer interface + authorizePodExec + the four sentinel
      errors errExecAuthorizerUnavailable / errExecMissingUserSubject
      / errExecSARFailed / errExecRBACDenied. The whole SubjectAccess-
      Review dance was there to simulate the user's identity against
      the pod SA's clientset (#8120, #8137, #8139, #8140); kc-agent's
      clientset IS the user's identity, so the apiserver enforces
      natively.
    - Per-user execSessionsRegistry / registerExecSession /
      unregisterExecSession / CancelUserExecSessions. kc-agent is a
      per-user local process with no logout concept — if the user
      closes their browser tab the WebSocket closes, the read loop
      exits, and execCancel fires via defer. #6024's cross-session
      cleanup is no longer needed.

  Named constants instead of literals per the repo rule:
  agentExecMaxStdinBytes (1 MiB), agentExecPingInterval (30s),
  agentExecPongTimeout (45s), agentExecWriteDeadline (10s — explicit
  because gorilla unlike gofiber does not have an implicit write
  timeout), agentExecStdinBufferSize (32), agentExecResizeBufferSize
  (4), agentExecDefaultCols (80), agentExecDefaultRows (24).

pkg/agent/server.go:
  mux.HandleFunc("/ws/exec", s.handleExec) registered next to /ws with
  an explanatory comment.

pkg/api/handlers/exec.go + exec_test.go (deleted):
  The entire 791-line backend handler and its 395-line test file are
  gone. The architecture is cleaner now — there's one code path for
  exec, it runs against the user's identity, and the whole class of
  "who is the console SA and what can it impersonate" concerns is
  retired alongside the code.

pkg/api/handlers/auth.go:
  The Logout handler used to call CancelUserExecSessions (#6024) to
  tear down exec streams that were running as the pod SA when the
  user's JWT was revoked. kc-agent exec is per-user local, so there
  are no cross-session exec streams to cancel on logout. The SSE
  cancellation (#6029) stays; it's unrelated.

pkg/api/server.go:
  The backend /ws/exec route registration is gone. A comment at the
  same line points readers at pkg/agent/server_exec.go and
  web/src/hooks/useExecSession.ts for the replacement.

web/src/hooks/useExecSession.ts:
  The WebSocket URL is now LOCAL_AGENT_WS_URL.replace(/\/ws$/, '/ws/exec')
  instead of ${window.location.host}/ws/exec so the browser connects
  to the user's own kc-agent at 127.0.0.1:8585. The first-message
  auth send is removed (kc-agent validates on upgrade). STORAGE_KEY_TOKEN
  import dropped; LOCAL_AGENT_WS_URL added.

web/src/hooks/__tests__/useExecSession.test.ts (40/40 pass):
  Three assertion updates — sentMessages[0] is now exec_init (not
  auth), sentMessages[1] is no longer used. The "no auth token on
  connect" test is removed (that failure mode no longer exists on the
  frontend; kc-agent would 401 on upgrade instead, which the
  "constructor throwing" test already covers).

Refs #7993. Fixes #5406.

Signed-off-by: Andrew Anderson <[email protected]>