@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/src/shared/__tests__/mcp-enabled-tools.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  effectiveEnabledTools,
+  filterToolsByEnabledTools,
+  enabledToolsBySlug,
+} from "../mcp-enabled-tools.js";
+
+describe("effectiveEnabledTools", () => {
+  it("uses the usage's non-empty enabled_tools verbatim", () => {
+    expect(effectiveEnabledTools(["a", "b"], ["c"])).toEqual(["a", "b"]);
+  });
+
+  it("falls back to default_enabled_tools when the usage list is empty", () => {
+    expect(effectiveEnabledTools([], ["c", "d"])).toEqual(["c", "d"]);
+  });
+
+  it("falls back to default_enabled_tools when the usage list is absent", () => {
+    expect(effectiveEnabledTools(undefined, ["c"])).toEqual(["c"]);
+  });
+
+  it("returns undefined (unrestricted) when both lists are empty or absent", () => {
+    expect(effectiveEnabledTools([], [])).toBeUndefined();
+    expect(effectiveEnabledTools(undefined, undefined)).toBeUndefined();
+    expect(effectiveEnabledTools([], undefined)).toBeUndefined();
+  });
+
+  it("returns copies, never the caller's arrays", () => {
+    const usage = ["a"];
+    const result = effectiveEnabledTools(usage, undefined)!;
+    result.push("b");
+    expect(usage).toEqual(["a"]);
+  });
+});
+
+describe("filterToolsByEnabledTools", () => {
+  const tool = (name: string) => ({ name });
+
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  it("passes every tool through untouched when unrestricted (undefined)", () => {
+    const tools = [tool("a"), tool("b")];
+    expect(filterToolsByEnabledTools("srv", tools, undefined)).toEqual(tools);
+  });
+
+  it("keeps only the tools on the allow-list (exact bare-name match)", () => {
+    const tools = [tool("read"), tool("write"), tool("delete")];
+    expect(
+      filterToolsByEnabledTools("srv", tools, ["read"]).map((t) => t.name),
+    ).toEqual(["read"]);
+  });
+
+  it("warns and intersects when an enabled name is not among the discovered tools", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const tools = [tool("read"), tool("write")];
+
+    const filtered = filterToolsByEnabledTools("srv", tools, ["read", "reed"]);
+
+    // The restriction still holds (intersection), the run is not failed,
+    // and the operator gets a loud pointer at the mismatched name.
+    expect(filtered.map((t) => t.name)).toEqual(["read"]);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("reed"));
+  });
+
+  it("yields an empty toolset when no enabled name matches (restriction over availability)", () => {
+    const tools = [tool("read")];
+    expect(filterToolsByEnabledTools("srv", tools, ["ghost"])).toEqual([]);
+  });
+});
+
+describe("enabledToolsBySlug", () => {
+  it("collects only restricted servers, keyed by slug", () => {
+    const map = enabledToolsBySlug([
+      { slug: "restricted", enabledTools: ["a"] },
+      { slug: "open" },
+    ]);
+    expect(map).toEqual({ restricted: ["a"] });
+  });
+
+  it("returns an empty object when nothing is restricted (the common case)", () => {
+    expect(enabledToolsBySlug([{ slug: "open" }])).toEqual({});
+  });
+});

package/src/shared/__tests__/mcp-manager.test.ts

@@ -1,14 +1,32 @@
-import { describe, it, expect, vi, afterEach } from "vitest";
+import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
 import type { Connection } from "@langchain/mcp-adapters";
-import { toMcpClientConfig } from "../mcp-manager.js";
+import { connectMcpServers, toMcpClientConfig } from "../mcp-manager.js";
+import { RUNNER_CREDENTIAL_ENV_KEYS } from "../runner-credential-keys.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
 
+// The adapter client is mocked ONLY for the connectMcpServers tests below
+// (initializeConnections returns the canned per-server tool map); the
+// toMcpClientConfig suites are pure and never construct it.
+const mockMcpClient = vi.hoisted(() => ({
+  toolMap: {} as Record<string, { name: string }[]>,
+}));
+
+vi.mock("@langchain/mcp-adapters", () => ({
+  MultiServerMCPClient: class {
+    async initializeConnections() {
+      return mockMcpClient.toolMap;
+    }
+    async close() {}
+  },
+}));
+
 function makeServer(overrides: Partial<ResolvedMcpServer>): ResolvedMcpServer {
   return {
     slug: "test-server",
     connectionType: "stdio",
     toolApprovals: [],
     pinnedToolApprovals: [],
+    toolApprovalOverrides: [],
     discoveredCapabilitiesEmpty: false,
     ...overrides,
   };
@@ -95,25 +113,15 @@ describe("toMcpClientConfig", () => {
   });
 });
 
-// Runner-internal credentials that must never reach an MCP stdio subprocess
-// (oss#256). Names mirror what the runner actually reads: config.ts,
-// fingerprint-secret.ts, model-client.ts, registry-endpoint.ts.
-const RUNNER_CREDENTIAL_KEYS = [
-  "STIGMER_RUNNER_HITL_SECRET",
-  "STIGMER_TOKEN",
-  "STIGMER_AUTH_TOKEN",
-  "CURSOR_API_KEY",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-] as const;
-
 describe("toMcpClientConfig — stdio env isolation (oss#256)", () => {
   afterEach(() => {
     vi.unstubAllEnvs();
   });
 
   it("gives a stdio server with no declared env none of the runner's variables", () => {
-    for (const key of RUNNER_CREDENTIAL_KEYS) {
+    // The canaries are the runner's real credential names (oss#385's single
+    // source of truth), so a key added there is automatically covered here.
+    for (const key of RUNNER_CREDENTIAL_ENV_KEYS) {
       vi.stubEnv(key, `leaked-${key}`);
     }
     vi.stubEnv("STIGMER_TEST_LEAK_SENTINEL", "canary");
@@ -167,3 +175,117 @@ describe("toMcpClientConfig — stdio env isolation (oss#256)", () => {
     expect(stdioEnv(config, "empty")).toEqual({});
   });
 });
+
+describe("connectMcpServers — enabled_tools enforcement (issue #350)", () => {
+  const tool = (name: string) => ({ name }) as any;
+
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = {};
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("filters a restricted server's discovered tools down to the allow-list, in BOTH the flat list and the per-server map", async () => {
+    mockMcpClient.toolMap = { planton: [tool("get"), tool("apply"), tool("destroy")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "planton", command: "npx", enabledTools: ["get"] }),
+    ]);
+
+    // Both result shapes must narrow together: `tools` feeds the model and
+    // the built-in general-purpose sub-agent, `serverToolMap` feeds the
+    // approval gate's toolServerMap and the sub-agent McpAccess subset check.
+    expect(result.tools.map((t) => t.name)).toEqual(["get"]);
+    expect(result.serverToolMap.planton.map((t) => t.name)).toEqual(["get"]);
+  });
+
+  it("leaves an unrestricted server (enabledTools absent — e.g. a synthesized attachment) untouched", async () => {
+    mockMcpClient.toolMap = { open: [tool("a"), tool("b")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "open", command: "npx" }),
+    ]);
+
+    expect(result.tools.map((t) => t.name)).toEqual(["a", "b"]);
+  });
+
+  it("restricts per server: one restricted server never narrows its unrestricted sibling", async () => {
+    mockMcpClient.toolMap = {
+      restricted: [tool("get"), tool("apply")],
+      open: [tool("get"), tool("apply")],
+    };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "restricted", command: "npx", enabledTools: ["get"] }),
+      makeServer({ slug: "open", command: "npx" }),
+    ]);
+
+    expect(result.serverToolMap.restricted.map((t) => t.name)).toEqual(["get"]);
+    expect(result.serverToolMap.open.map((t) => t.name)).toEqual(["get", "apply"]);
+  });
+
+  it("warns and intersects an allow-list naming a tool the server does not expose", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = { planton: [tool("get")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "planton", command: "npx", enabledTools: ["get", "ghost"] }),
+    ]);
+
+    expect(result.tools.map((t) => t.name)).toEqual(["get"]);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("ghost"));
+  });
+});
+
+describe("connectMcpServers — schema sanitization (issue #420)", () => {
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = {};
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("drops unicode-invalid regex patterns from every discovered tool's schema and warns per tool", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const toxic = {
+      name: "toxic",
+      schema: {
+        type: "object",
+        // PayPal's issue-#420 shape: legal plain regex, invalid under /u.
+        properties: { url: { type: "string", pattern: "^https\\:\\/\\/" } },
+      },
+    } as any;
+    const clean = {
+      name: "clean",
+      schema: {
+        type: "object",
+        properties: { id: { type: "string", pattern: "^[a-z]+$" } },
+      },
+    } as any;
+    mockMcpClient.toolMap = { paypal: [toxic, clean] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "paypal", connectionType: "http", url: "https://mcp.example.com/mcp" }),
+    ]);
+
+    // Sanitization happens on the discovered tool objects themselves, so
+    // every downstream consumer (model binding, approval gate, sub-agent
+    // filter) sees the sanitized schema.
+    expect(result.serverToolMap.paypal[0].schema).toEqual({
+      type: "object",
+      properties: { url: { type: "string" } },
+    });
+    expect(result.serverToolMap.paypal[1].schema).toEqual(clean.schema);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("Server 'paypal' tool 'toxic'"),
+    );
+  });
+});

package/src/shared/__tests__/mcp-resolver.test.ts

@@ -1,11 +1,17 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { resolveMcpServers } from "../mcp-resolver.js";
+import { mcpServerToResolved, mergeMcpServerUsages, resolveMcpServers } from "../mcp-resolver.js";
 import { McpTransportError } from "../mcp-transport-guard.js";
 
-function makeUsage(slug: string, org = "test-org") {
+function makeUsage(
+  slug: string,
+  org = "test-org",
+  enabledTools: string[] = [],
+  toolApprovalOverrides: Array<{ toolName: string; requiresApproval: boolean }> = [],
+) {
   return {
     mcpServerRef: { slug, org, kind: 0 },
-    toolApprovalOverrides: [],
+    enabledTools,
+    toolApprovalOverrides,
   } as any;
 }
 
@@ -106,3 +112,140 @@ describe("resolveMcpServers — transport guard integration", () => {
     expect(result.resolvedServers).toHaveLength(0);
   });
 });
+
+describe("resolveMcpServers — enabled_tools threading (issue #350)", () => {
+  function withDefaults(server: any, defaultEnabledTools: string[]) {
+    server.spec.defaultEnabledTools = defaultEnabledTools;
+    return server;
+  }
+
+  it("carries the usage's enabled_tools as the effective allow-list", async () => {
+    const client = clientReturning({ github: httpMcpServer("github") });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github", "test-org", ["create_pr"])], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toEqual(["create_pr"]);
+  });
+
+  it("falls back to the server's default_enabled_tools for an empty usage list", async () => {
+    const client = clientReturning({
+      github: withDefaults(httpMcpServer("github"), ["search_code"]),
+    });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github")], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toEqual(["search_code"]);
+  });
+
+  it("resolves unrestricted (absent field) when both lists are empty", async () => {
+    const client = clientReturning({ github: httpMcpServer("github") });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github")], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toBeUndefined();
+  });
+
+  it("mcpServerToResolved without a usage keeps only the default fallback (the discovery path)", () => {
+    const server = withDefaults(httpMcpServer("github"), ["search_code"]);
+
+    const resolved = mcpServerToResolved(server, "github", {});
+
+    // No usage in hand (discovery) — a per-agent restriction cannot apply,
+    // only the server-declared default does.
+    expect(resolved?.enabledTools).toEqual(["search_code"]);
+  });
+});
+
+describe("resolveMcpServers — tool_approval_overrides threading (issue #349)", () => {
+  it("carries the usage's overrides on its own resolved server only", async () => {
+    // Riding the server is the scoping mechanism: an override can no longer
+    // reach a same-named tool on another server, because it never exists
+    // anywhere but its own server's object.
+    const client = clientReturning({
+      github: httpMcpServer("github"),
+      slack: httpMcpServer("slack"),
+    });
+
+    const result = await resolveMcpServers(
+      client,
+      [
+        makeUsage("github", "test-org", [], [{ toolName: "delete_item", requiresApproval: false }]),
+        makeUsage("slack"),
+      ],
+      {},
+      "stdio-allowed",
+    );
+
+    const bySlug = new Map(result.resolvedServers.map((s) => [s.slug, s]));
+    expect(bySlug.get("github")!.toolApprovalOverrides).toEqual([
+      { toolName: "delete_item", requiresApproval: false },
+    ]);
+    expect(bySlug.get("slack")!.toolApprovalOverrides).toEqual([]);
+  });
+
+  it("mcpServerToResolved without a usage carries no overrides (the discovery path)", () => {
+    const resolved = mcpServerToResolved(httpMcpServer("github"), "github", {});
+
+    // No usage in hand (discovery) — there is no agent context, so no
+    // layer-3 overrides can exist.
+    expect(resolved?.toolApprovalOverrides).toEqual([]);
+  });
+
+  it("session-wins merge feeds the SESSION usage's overrides to the resolver (native-harness parity)", async () => {
+    // Pins the end-to-end path that was broken before #349: the deep-agent
+    // harness resolved servers from the merged usages but flattened
+    // overrides from the AGENT usages only, so a session's overrides were
+    // silently ignored there (and honored by the Cursor harness).
+    const client = clientReturning({ github: httpMcpServer("github") });
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", [], [{ toolName: "push", requiresApproval: true }])],
+      [makeUsage("github", "test-org", [], [{ toolName: "push", requiresApproval: false }])],
+    );
+
+    const result = await resolveMcpServers(client, merged, {}, "stdio-allowed");
+
+    expect(result.resolvedServers[0].toolApprovalOverrides).toEqual([
+      { toolName: "push", requiresApproval: false },
+    ]);
+  });
+});
+
+describe("mergeMcpServerUsages — session-wins-per-slug (shared by both harnesses)", () => {
+  it("session usage replaces the agent's WHOLE usage for the same slug, including enabled_tools", () => {
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", ["create_pr"])],
+      [makeUsage("github", "test-org", ["search_code"])],
+    );
+
+    expect(merged).toHaveLength(1);
+    expect(merged[0].enabledTools).toEqual(["search_code"]);
+  });
+
+  it("a session usage with an empty list overrides to the server-default/unrestricted shape", () => {
+    // Session-wins is whole-usage precedence, not a list union: an empty
+    // session list means "back to the server's defaults", exactly as if the
+    // agent-level usage did not exist.
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", ["create_pr"])],
+      [makeUsage("github")],
+    );
+
+    expect(merged).toHaveLength(1);
+    expect(merged[0].enabledTools).toEqual([]);
+  });
+
+  it("unions distinct slugs and skips usages without one", () => {
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github"), { toolApprovalOverrides: [] } as any],
+      [makeUsage("planton")],
+    );
+
+    expect(merged.map((u) => u.mcpServerRef?.slug)).toEqual(["github", "planton"]);
+  });
+});

package/src/shared/__tests__/mcp-schema-sanitizer.test.ts

@@ -0,0 +1,267 @@
+import { describe, it, expect } from "vitest";
+import { loadMcpTools } from "@langchain/mcp-adapters";
+import { DynamicStructuredTool } from "@langchain/core/tools";
+import { sanitizeSchemaPatterns } from "../mcp-schema-sanitizer.js";
+
+// PayPal's real-world specimen from issue #420: legal as a plain ECMAScript
+// regex (Annex B identity escapes), invalid under the /u flag.
+const TOXIC_PATTERN = "^https\\:\\/\\/";
+
+describe("sanitizeSchemaPatterns — walker semantics", () => {
+  it("drops a unicode-invalid pattern and reports it", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        url: { type: "string", pattern: TOXIC_PATTERN },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(schema.properties.url).toEqual({ type: "string" });
+    expect(dropped).toEqual([
+      {
+        location: "/properties/url/pattern",
+        pattern: TOXIC_PATTERN,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+  });
+
+  it("flags patterns that are broken outright (invalid without /u too)", () => {
+    const schema = {
+      type: "object",
+      properties: { name: { type: "string", pattern: "(unclosed" } },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(schema.properties.name).toEqual({ type: "string" });
+    expect(dropped[0].compilesWithoutUnicodeFlag).toBe(false);
+  });
+
+  it("leaves clean schemas byte-identical", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        url: { type: "string", pattern: "^https://" },
+        tags: { type: "array", items: { type: "string", pattern: "^[a-z]+$" } },
+      },
+      patternProperties: { "^x-": { type: "string" } },
+      additionalProperties: false,
+      required: ["url"],
+    };
+    const before = JSON.parse(JSON.stringify(schema));
+
+    expect(sanitizeSchemaPatterns(schema)).toEqual([]);
+    expect(schema).toEqual(before);
+  });
+
+  it("never touches a property literally named 'pattern'", () => {
+    // 'pattern' as a property NAME is data, not a keyword — but the pattern
+    // KEYWORD on that property's own schema is still sanitized.
+    const schema = {
+      type: "object",
+      properties: {
+        pattern: { type: "string", pattern: TOXIC_PATTERN },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(Object.keys(schema.properties)).toEqual(["pattern"]);
+    expect(schema.properties.pattern).toEqual({ type: "string" });
+    expect(dropped[0].location).toBe("/properties/pattern/pattern");
+  });
+
+  it("leaves a non-string pattern value alone", () => {
+    const schema = { type: "object", properties: { n: { pattern: 123 } } };
+    expect(sanitizeSchemaPatterns(schema)).toEqual([]);
+    expect((schema.properties.n as { pattern: unknown }).pattern).toBe(123);
+  });
+
+  it("reaches nested schema positions", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        choice: {
+          anyOf: [
+            { type: "string", pattern: TOXIC_PATTERN },
+            { type: "number" },
+          ],
+        },
+        tuple: {
+          type: "array",
+          items: [{ type: "string", pattern: TOXIC_PATTERN }],
+        },
+        names: { propertyNames: { pattern: TOXIC_PATTERN } },
+      },
+      $defs: {
+        link: { type: "string", pattern: TOXIC_PATTERN },
+      },
+      dependencies: {
+        // Array form is dependentRequired (names, not schemas) — untouched.
+        a: ["b"],
+        c: { properties: { d: { type: "string", pattern: TOXIC_PATTERN } } },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(dropped.map((d) => d.location).sort()).toEqual([
+      "/$defs/link/pattern",
+      "/dependencies/c/properties/d/pattern",
+      "/properties/choice/anyOf/0/pattern",
+      "/properties/names/propertyNames/pattern",
+      "/properties/tuple/items/0/pattern",
+    ]);
+    expect(schema.dependencies.a).toEqual(["b"]);
+  });
+
+  it("terminates on a cyclic schema graph", () => {
+    const node: Record<string, unknown> = {
+      type: "object",
+      properties: { url: { type: "string", pattern: TOXIC_PATTERN } },
+    };
+    node.not = node;
+
+    const dropped = sanitizeSchemaPatterns(node);
+    expect(dropped).toHaveLength(1);
+  });
+
+  it("ignores non-object input", () => {
+    expect(sanitizeSchemaPatterns(undefined)).toEqual([]);
+    expect(sanitizeSchemaPatterns("pattern")).toEqual([]);
+    expect(sanitizeSchemaPatterns([{ pattern: TOXIC_PATTERN }])).toEqual([]);
+  });
+});
+
+describe("sanitizeSchemaPatterns — never-tighten invariant (patternProperties)", () => {
+  // Slash-free /u-invalid key so the expected report location needs no
+  // JSON-pointer escaping (the walker escapes `/` in map keys as `~1`).
+  const TOXIC_KEY = "^x\\:";
+
+  it("drops a broken patternProperties key and relaxes restrictive additionalProperties", () => {
+    const schema = {
+      type: "object",
+      patternProperties: {
+        [TOXIC_KEY]: { type: "string" },
+        "^clean-": { type: "number" },
+      },
+      additionalProperties: false,
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(dropped).toEqual([
+      {
+        location: `/patternProperties/${TOXIC_KEY}`,
+        pattern: TOXIC_KEY,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+    expect(schema.patternProperties).toEqual({ "^clean-": { type: "number" } });
+    // Keys the dropped pattern used to match would fall through to
+    // additionalProperties: false and be falsely REJECTED — the relaxation
+    // is what keeps sanitization strictly loosening.
+    expect("additionalProperties" in schema).toBe(false);
+  });
+
+  it("removes an emptied patternProperties and relaxes a restrictive subschema additionalProperties", () => {
+    const schema = {
+      type: "object",
+      patternProperties: { [TOXIC_KEY]: { type: "string" } },
+      additionalProperties: { type: "number" },
+      unevaluatedProperties: false,
+    };
+
+    sanitizeSchemaPatterns(schema);
+
+    expect("patternProperties" in schema).toBe(false);
+    expect("additionalProperties" in schema).toBe(false);
+    expect("unevaluatedProperties" in schema).toBe(false);
+  });
+
+  it("keeps additionalProperties when no patternProperties entry was dropped", () => {
+    const schema = {
+      type: "object",
+      patternProperties: { "^clean-": { type: "string" } },
+      additionalProperties: false,
+    };
+
+    sanitizeSchemaPatterns(schema);
+
+    expect(schema.additionalProperties).toBe(false);
+  });
+
+  it("proves the loosened schema through the real validator: previously matched keys stay accepted", async () => {
+    // End-to-end through @langchain/core's own validation path (the exact
+    // consumer that compiles patterns with /u): after sanitization, an input
+    // whose key only the dropped pattern used to match must validate — not
+    // fall through to additionalProperties: false.
+    const schema = {
+      type: "object" as const,
+      patternProperties: { "^x\\:": { type: "string" as const } },
+      additionalProperties: false,
+    };
+    sanitizeSchemaPatterns(schema);
+
+    // Default generics: the JSON-schema constructor arm types invoke input
+    // as ToolCall otherwise, rejecting the pattern-shaped key at compile time.
+    const tool: DynamicStructuredTool = new DynamicStructuredTool({
+      name: "probe",
+      description: "d",
+      schema,
+      func: async () => "ok",
+    });
+
+    await expect(tool.invoke({ "x:key": "value" })).resolves.toBe("ok");
+  });
+});
+
+describe("sanitizeSchemaPatterns — issue #420 regression pin", () => {
+  // The issue's exact repro: a tool loaded through the real adapter with the
+  // PayPal pattern shape loads fine but fails EVERY invocation with
+  // "SyntaxError: Invalid regular expression: /^https\:\/\//u".
+  const toxicTool = {
+    name: "toxic",
+    description: "d",
+    inputSchema: {
+      type: "object",
+      properties: { url: { type: "string", pattern: TOXIC_PATTERN } },
+    },
+  };
+  const fakeClient = {
+    listTools: async () => ({ tools: [toxicTool] }),
+    callTool: async () => ({ content: [{ type: "text", text: "called" }] }),
+  };
+
+  it("negative control: without sanitization the tool is uncallable (the defect)", async () => {
+    const tools = await loadMcpTools("srv", fakeClient as never, {
+      throwOnLoadError: true,
+    });
+
+    await expect(tools[0].invoke({ url: "https://x.com" })).rejects.toThrow(
+      /Invalid regular expression/,
+    );
+  });
+
+  it("after sanitization the same tool invokes successfully", async () => {
+    const tools = await loadMcpTools("srv", fakeClient as never, {
+      throwOnLoadError: true,
+    });
+
+    const dropped = sanitizeSchemaPatterns(tools[0].schema);
+
+    expect(dropped).toEqual([
+      {
+        location: "/properties/url/pattern",
+        pattern: TOXIC_PATTERN,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+    await expect(tools[0].invoke({ url: "https://x.com" })).resolves.toBe(
+      "called",
+    );
+  });
+});