Remove temporary OAuth probe from production image

Dockerfile

@@ -4,7 +4,6 @@ WORKDIR /src
 COPY annonet-arrowstack-ready.zip /tmp/annonet.zip
 RUN unzip -q /tmp/annonet.zip -d /src
 COPY mcpAuthMiddleware.js /src/src/auth/mcpAuthMiddleware.js
-COPY oauthProbe.js /src/oauthProbe.js
 # Arrowstack's database-per-tenant runtime role intentionally cannot install
 # extensions. PostgreSQL 13+ provides gen_random_uuid() in core, and annoNet
 # does not use any other pgcrypto functions.
@@ -33,7 +32,6 @@ COPY --from=source /src/src ./src
 COPY --from=source /src/sql ./sql
 COPY --from=source /src/scripts ./scripts
 COPY --from=source /src/frontend ./frontend
-COPY --from=source /src/oauthProbe.js ./oauthProbe.js
 COPY --from=frontend-build /build/frontend-astro/dist ./public
 
 RUN npm run check \

oauthProbe.js

@@ -1,68 +1 @@
-const decodePayload = (token) => {
-  try {
-    const part = String(token || "").split(".")[1] || "";
-    return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
-  } catch {
-    return {};
-  }
-};
-
-const call = async (label, token) => {
-  const headers = token === undefined ? {} : { Authorization: `Bearer ${token}` };
-  const response = await fetch("http://127.0.0.1:8787/api/mcp/annotations?limit=1", { headers });
-  const body = await response.text();
-  console.log("[oauth-probe]", JSON.stringify({
-    test: label,
-    status: response.status,
-    body: body.slice(0, 240)
-  }));
-  return response.status;
-};
-
-(async () => {
-  const issuer = String(process.env.MCP_TEST_ISSUER || "").replace(/\/$/, "");
-  const clientId = String(process.env.MCP_TEST_CLIENT_ID || "");
-  const clientSecret = String(process.env.MCP_TEST_CLIENT_SECRET || "");
-  if (!issuer || !clientId || !clientSecret) {
-    throw new Error("temporary MCP test credentials are not configured");
-  }
-
-  const tokenResponse = await fetch(`${issuer}/protocol/openid-connect/token`, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "client_credentials",
-      client_id: clientId,
-      client_secret: clientSecret
-    })
-  });
-  const tokenBody = await tokenResponse.json().catch(() => ({}));
-  console.log("[oauth-probe]", JSON.stringify({
-    test: "client_credentials",
-    status: tokenResponse.status,
-    tokenType: tokenBody.token_type || null,
-    expiresIn: tokenBody.expires_in || null
-  }));
-  if (!tokenResponse.ok || !tokenBody.access_token) {
-    process.exitCode = 2;
-    return;
-  }
-
-  const claims = decodePayload(tokenBody.access_token);
-  console.log("[oauth-probe]", JSON.stringify({
-    test: "safe_claims",
-    iss: claims.iss || null,
-    azp: claims.azp || claims.client_id || null,
-    aud: claims.aud || null,
-    preferredUsername: claims.preferred_username || null,
-    realmRoles: claims.realm_access && claims.realm_access.roles || [],
-    resourceAccess: claims.resource_access || {}
-  }));
-
-  await call("missing_token", undefined);
-  await call("invalid_token", "not-a-jwt");
-  await call("service_account", tokenBody.access_token);
-})().catch((error) => {
-  console.error("[oauth-probe-error]", error && error.message ? error.message : error);
-  process.exitCode = 3;
-});
+// Historical deployment diagnostic placeholder. Not copied into the production image.\n

scopeProbe.js

@@ -1,21 +1 @@
-const { pool } = require("./src/db/pool");
-
-(async () => {
-  try {
-    const { rows } = await pool.query(
-      `SELECT o.id AS org_id, t.id AS team_id
-       FROM orgs o
-       JOIN teams t ON t.org_id = o.id
-       WHERE o.name = 'Default Organization'
-         AND t.name = 'Default Team'
-       LIMIT 1`
-    );
-    console.error("[bootstrap-scope]", JSON.stringify(rows[0] || null));
-    process.exitCode = 42;
-  } finally {
-    await pool.end();
-  }
-})().catch((error) => {
-  console.error("[bootstrap-scope-error]", error);
-  process.exit(43);
-});
+// Historical deployment diagnostic placeholder. Not copied into the production image.\n