@stigmer/runner 3.11.0 → 3.12.0

package/src/shared/__tests__/artifact-storage.test.ts

@@ -49,6 +49,10 @@ describe("LocalArtifactStorage", () => {
     expect(url).toBe("http://localhost:7235/artifacts/file.txt");
   });
 
+  it("self-describes its URLs as local-serve (loopback reach, no expiry — issue #532)", () => {
+    expect(storage.downloadUrlKind).toBe("local-serve");
+  });
+
   it("returns true for existing keys", async () => {
     const key = "artifacts/exec-1/file.bin";
     await storage.upload(key, Buffer.from("data"));
@@ -167,6 +171,11 @@ describe("ProxyArtifactStorage", () => {
     globalThis.fetch = originalFetch;
   });
 
+  it("self-describes its URLs as presigned (time-limited, remotely fetchable — issue #532)", () => {
+    const s = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    expect(s.downloadUrlKind).toBe("presigned");
+  });
+
   it("uploads via presigned URL flow", async () => {
     const calls: { url: string; method: string; body?: string }[] = [];
 
@@ -294,7 +303,13 @@ describe("ProxyArtifactStorage", () => {
       return new Response("server error", { status: 500 });
     }) as typeof fetch;
 
-    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    // 500 is retryable, so this persistent failure exhausts the budget —
+    // delayFn injected to skip the real ~7.75 s of backoff (#468). The
+    // degrade contract under test (budget exhaustion still throws the
+    // caller-visible error) is unchanged.
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+      delayFn: async () => {},
+    });
     await expect(
       storage.upload("key", Buffer.from("x")),
     ).rejects.toThrow("Presigned upload failed (HTTP 500)");
@@ -411,11 +426,148 @@ describe("ProxyArtifactStorage", () => {
 
   it("exists throws on an unexpected object status (a fault, not an existence answer)", async () => {
     mockProxyFetch(() => new Response("boom", { status: 500 }));
-    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    // Persistent 500 exhausts the retry budget; delayFn skips the real
+    // backoff (#468). The fault-not-an-answer contract is unchanged.
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+      delayFn: async () => {},
+    });
     await expect(storage.exists("key")).rejects.toThrow(
       /Artifact existence check failed \(HTTP 500\) for key 'key'/,
     );
   });
+
+  // The bounded-backoff adoption (stigmer/stigmer#468). Classification policy
+  // is covered by shared/__tests__/http-retry.test.ts; these cases pin the
+  // loop's behavior at this client's call sites: transient failures recover
+  // (each of these fails on pre-#468 code, which threw on the first error),
+  // deterministic failures never retry, and a hung request is aborted at the
+  // per-request bound instead of stalling forever.
+  describe("retry behavior (#468)", () => {
+    let recordedDelays: number[];
+
+    beforeEach(() => {
+      recordedDelays = [];
+    });
+
+    function makeStorage() {
+      return new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+        delayFn: async (ms) => {
+          recordedDelays.push(ms);
+        },
+      });
+    }
+
+    it("upload recovers from a transient presign failure", async () => {
+      let presignCalls = 0;
+      const fetchSpy = vi.fn(async (input: string | URL | Request) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-upload-url")) {
+          presignCalls++;
+          if (presignCalls === 1) {
+            return new Response("bad gateway", { status: 502 });
+          }
+          return new Response(JSON.stringify({ url: "https://r2.example.com/put" }), { status: 200 });
+        }
+        return new Response("", { status: 200 });
+      });
+      globalThis.fetch = fetchSpy as unknown as typeof fetch;
+
+      const key = await makeStorage().upload("artifacts/e/f.txt", Buffer.from("x"));
+
+      expect(key).toBe("artifacts/e/f.txt");
+      expect(presignCalls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("upload recovers from a transient R2 PUT failure, re-sending identical bytes", async () => {
+      const putBodies: string[] = [];
+      let putCalls = 0;
+      globalThis.fetch = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-upload-url")) {
+          return new Response(JSON.stringify({ url: "https://r2.example.com/put" }), { status: 200 });
+        }
+        putCalls++;
+        putBodies.push(String(init?.body));
+        if (putCalls === 1) {
+          return new Response("unavailable", { status: 503 });
+        }
+        return new Response("", { status: 200 });
+      }) as typeof fetch;
+
+      await makeStorage().upload("k", Buffer.from("same-bytes"));
+
+      expect(putCalls).toBe(2);
+      expect(putBodies[0]).toBe(putBodies[1]);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("download recovers from a transient network failure on the R2 GET", async () => {
+      let getCalls = 0;
+      globalThis.fetch = vi.fn(async (input: string | URL | Request) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-download-url")) {
+          return new Response(JSON.stringify({ url: "https://r2.example.com/dl" }), { status: 200 });
+        }
+        getCalls++;
+        if (getCalls === 1) {
+          // undici's network-failure shape (retryable).
+          throw new TypeError("fetch failed");
+        }
+        return new Response(Buffer.from("payload"), { status: 200 });
+      }) as typeof fetch;
+
+      const got = await makeStorage().download("k");
+
+      expect(got.toString()).toBe("payload");
+      expect(getCalls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("never retries a deterministic presign refusal (403)", async () => {
+      const fetchSpy = vi.fn(async () => new Response("forbidden", { status: 403 }));
+      globalThis.fetch = fetchSpy as unknown as typeof fetch;
+
+      await expect(makeStorage().upload("k", Buffer.from("x"))).rejects.toThrow(
+        "Failed to get presigned upload URL (HTTP 403)",
+      );
+      expect(fetchSpy).toHaveBeenCalledTimes(1);
+      expect(recordedDelays).toEqual([]);
+    });
+
+    it("aborts a hung request at the per-request bound and retries it", async () => {
+      let calls = 0;
+      globalThis.fetch = vi.fn((input: string | URL | Request, init?: RequestInit) => {
+        calls++;
+        if (calls === 1) {
+          // Hang until the AbortSignal.timeout fires, then reject the way
+          // undici does — proving the bound converts a stall into a
+          // retryable attempt instead of waiting forever.
+          return new Promise<Response>((_, reject) => {
+            init?.signal?.addEventListener("abort", () =>
+              reject(init.signal!.reason as Error),
+            );
+          });
+        }
+        return Promise.resolve(
+          new Response(JSON.stringify({ url: "https://r2.example.com/dl" }), { status: 200 }),
+        );
+      }) as typeof fetch;
+
+      const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+        requestTimeoutMs: 20,
+        delayFn: async (ms) => {
+          recordedDelays.push(ms);
+        },
+      });
+
+      const url = await storage.getDownloadUrl("k");
+
+      expect(url).toBe("https://r2.example.com/dl");
+      expect(calls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+  });
 });
 
 // ── Factory ──────────────────────────────────────────────────────────

package/src/shared/__tests__/attachment-download-urls.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Tests for the attachment download-URL hand-off policy (issue #532):
+ * the branch-independent mint rule, the non-fatal degrade, and the
+ * per-kind disclosure wording both harnesses embed.
+ */
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import {
+  mintAttachmentDownloadUrl,
+  downloadUrlDisclosureLine,
+} from "../attachment-download-urls.js";
+import { makeInMemoryArtifactStorage } from "../../__test-utils__/fake-artifact-storage.js";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("mintAttachmentDownloadUrl", () => {
+  it("mints a URL for a storage key", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+
+    const url = await mintAttachmentDownloadUrl(storage, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBe("mem://attachments/01A/lease.pdf");
+  });
+
+  it("returns undefined when the attachment has no storage key", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+
+    const url = await mintAttachmentDownloadUrl(storage, "", "local.csv");
+
+    expect(url).toBeUndefined();
+    expect(storage.getDownloadUrl).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined when no storage is available", async () => {
+    const url = await mintAttachmentDownloadUrl(undefined, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBeUndefined();
+  });
+
+  it("degrades to undefined on a mint failure and logs the degrade (never throws)", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+    storage.getDownloadUrl.mockRejectedValueOnce(new Error("presign endpoint unreachable"));
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const url = await mintAttachmentDownloadUrl(storage, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBeUndefined();
+    expect(warn).toHaveBeenCalledOnce();
+    expect(warn.mock.calls[0][0]).toContain("lease.pdf");
+  });
+});
+
+describe("downloadUrlDisclosureLine", () => {
+  it("promises time-limited single-object access for presigned URLs", () => {
+    const line = downloadUrlDisclosureLine("presigned");
+
+    expect(line).toContain("time-limited");
+    expect(line).toContain("single file");
+    expect(line).not.toContain("this machine");
+  });
+
+  it("is honest about local-serve reach — same machine only, no expiry claim", () => {
+    const line = downloadUrlDisclosureLine("local-serve");
+
+    expect(line).toContain("reachable only from this machine");
+    expect(line).not.toContain("time-limited");
+  });
+});

package/src/shared/__tests__/channel-attachment.test.ts

@@ -1,8 +1,8 @@
 /**
  * The channel messaging attachment (proactive-messaging DD-006 D7/D8):
  * discovery with the never-throw failure posture, both connection
- * shapes, the structural approval-freedom the datastore attachment
- * pinned before it, and the prompt section's filter/order/cap rules
+ * shapes, the structural approval-freedom of synthesized attachments,
+ * and the prompt section's filter/order/cap rules
  * (DD-006 D6). The route is the cross-repo string, guarded here and in
  * the mcp-server integration test (the TOOL_CALL_LIMIT precedent); the
  * slug and roster are runner-internal and guarded here alone.

package/src/shared/__tests__/conversation-catchup.test.ts

@@ -55,6 +55,30 @@ describe("formatConversationCatchupText", () => {
     expect(framed).toContain("Continue from the customer's newest message.");
   });
 
+  it("defines the send-status annotations — undelivered words are not settled history (cloud#347)", () => {
+    // The cloud composer marks lines the customer never got or may not
+    // have gotten yet; the preamble must define both annotations and
+    // carve them out of the don't-re-answer contract, or the agent would
+    // silently abandon whatever a failed teammate reply meant to convey.
+    expect(framed).toContain("(not delivered)");
+    expect(framed).toContain("never reached the customer");
+    expect(framed).toContain("(sending)");
+    expect(framed).toContain("still on their way");
+    expect(framed).toContain("weigh that when deciding what still needs saying");
+  });
+
+  it("defines the send-outcome lines and the no-verbatim-resend contract (cloud#352, DD-009 Q-4)", () => {
+    // The agent's own failed sends reach it as `You (not delivered):`
+    // lines and `System:` delivery-failure notices. The owner-ruled
+    // behavior: unfinished business, re-said naturally — never a
+    // word-for-word resend (a multi-chunk send can partially land, and an
+    // exact repeat reads as a duplicate).
+    expect(framed).toContain("You (not delivered)");
+    expect(framed).toContain("was not delivered");
+    expect(framed).toContain("unfinished business");
+    expect(framed).toContain("never resend the failed text word-for-word");
+  });
+
   it("asserts no takeover — a digest can exist with no human handoff at all (the A15/A20 honesty bar)", () => {
     // The preamble may DESCRIBE what the digest can contain ("may include"),
     // but must never state that a handoff happened on THIS conversation: a

package/src/shared/__tests__/http-retry.test.ts

@@ -1,10 +1,11 @@
 import { describe, it, expect } from "vitest";
 import { isRetryableHttpStatus, isRetryableFetchError } from "../http-retry.js";
 
-// The bounded-backoff loop that consumes these classifiers lives in
-// checkpointer/http-saver.ts (fetchWithRetry) and is exercised by
-// http-saver.test.ts ("retry behavior"). This file covers the classification
-// policy in isolation — the grpc-retry.test.ts twin.
+// The shared bounded-backoff loop (fetchWithRetry, same module) is exercised
+// through its consumers' suites — http-saver.test.ts ("retry behavior"),
+// artifact-storage.test.ts, registry-fetch tests — which pin the loop's
+// behavior at real call sites rather than in the abstract. This file covers
+// the classification policy in isolation — the grpc-retry.test.ts twin.
 
 describe("isRetryableHttpStatus", () => {
   it("returns true for 408 (request timeout)", () => {

package/src/shared/__tests__/mcp-manager.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
 import type { Connection } from "@langchain/mcp-adapters";
 import { connectMcpServers, toMcpClientConfig } from "../mcp-manager.js";
+import { RUNNER_CREDENTIAL_ENV_KEYS } from "../runner-credential-keys.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
 
 // The adapter client is mocked ONLY for the connectMcpServers tests below
@@ -112,25 +113,15 @@ describe("toMcpClientConfig", () => {
   });
 });
 
-// Runner-internal credentials that must never reach an MCP stdio subprocess
-// (oss#256). Names mirror what the runner actually reads: config.ts,
-// fingerprint-secret.ts, model-client.ts, registry-endpoint.ts.
-const RUNNER_CREDENTIAL_KEYS = [
-  "STIGMER_RUNNER_HITL_SECRET",
-  "STIGMER_TOKEN",
-  "STIGMER_AUTH_TOKEN",
-  "CURSOR_API_KEY",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-] as const;
-
 describe("toMcpClientConfig — stdio env isolation (oss#256)", () => {
   afterEach(() => {
     vi.unstubAllEnvs();
   });
 
   it("gives a stdio server with no declared env none of the runner's variables", () => {
-    for (const key of RUNNER_CREDENTIAL_KEYS) {
+    // The canaries are the runner's real credential names (oss#385's single
+    // source of truth), so a key added there is automatically covered here.
+    for (const key of RUNNER_CREDENTIAL_ENV_KEYS) {
       vi.stubEnv(key, `leaked-${key}`);
     }
     vi.stubEnv("STIGMER_TEST_LEAK_SENTINEL", "canary");
@@ -249,3 +240,52 @@ describe("connectMcpServers — enabled_tools enforcement (issue #350)", () => {
     expect(warn).toHaveBeenCalledWith(expect.stringContaining("ghost"));
   });
 });
+
+describe("connectMcpServers — schema sanitization (issue #420)", () => {
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = {};
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("drops unicode-invalid regex patterns from every discovered tool's schema and warns per tool", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const toxic = {
+      name: "toxic",
+      schema: {
+        type: "object",
+        // PayPal's issue-#420 shape: legal plain regex, invalid under /u.
+        properties: { url: { type: "string", pattern: "^https\\:\\/\\/" } },
+      },
+    } as any;
+    const clean = {
+      name: "clean",
+      schema: {
+        type: "object",
+        properties: { id: { type: "string", pattern: "^[a-z]+$" } },
+      },
+    } as any;
+    mockMcpClient.toolMap = { paypal: [toxic, clean] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "paypal", connectionType: "http", url: "https://mcp.example.com/mcp" }),
+    ]);
+
+    // Sanitization happens on the discovered tool objects themselves, so
+    // every downstream consumer (model binding, approval gate, sub-agent
+    // filter) sees the sanitized schema.
+    expect(result.serverToolMap.paypal[0].schema).toEqual({
+      type: "object",
+      properties: { url: { type: "string" } },
+    });
+    expect(result.serverToolMap.paypal[1].schema).toEqual(clean.schema);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("Server 'paypal' tool 'toxic'"),
+    );
+  });
+});

package/src/shared/__tests__/mcp-schema-sanitizer.test.ts

@@ -0,0 +1,267 @@
+import { describe, it, expect } from "vitest";
+import { loadMcpTools } from "@langchain/mcp-adapters";
+import { DynamicStructuredTool } from "@langchain/core/tools";
+import { sanitizeSchemaPatterns } from "../mcp-schema-sanitizer.js";
+
+// PayPal's real-world specimen from issue #420: legal as a plain ECMAScript
+// regex (Annex B identity escapes), invalid under the /u flag.
+const TOXIC_PATTERN = "^https\\:\\/\\/";
+
+describe("sanitizeSchemaPatterns — walker semantics", () => {
+  it("drops a unicode-invalid pattern and reports it", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        url: { type: "string", pattern: TOXIC_PATTERN },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(schema.properties.url).toEqual({ type: "string" });
+    expect(dropped).toEqual([
+      {
+        location: "/properties/url/pattern",
+        pattern: TOXIC_PATTERN,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+  });
+
+  it("flags patterns that are broken outright (invalid without /u too)", () => {
+    const schema = {
+      type: "object",
+      properties: { name: { type: "string", pattern: "(unclosed" } },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(schema.properties.name).toEqual({ type: "string" });
+    expect(dropped[0].compilesWithoutUnicodeFlag).toBe(false);
+  });
+
+  it("leaves clean schemas byte-identical", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        url: { type: "string", pattern: "^https://" },
+        tags: { type: "array", items: { type: "string", pattern: "^[a-z]+$" } },
+      },
+      patternProperties: { "^x-": { type: "string" } },
+      additionalProperties: false,
+      required: ["url"],
+    };
+    const before = JSON.parse(JSON.stringify(schema));
+
+    expect(sanitizeSchemaPatterns(schema)).toEqual([]);
+    expect(schema).toEqual(before);
+  });
+
+  it("never touches a property literally named 'pattern'", () => {
+    // 'pattern' as a property NAME is data, not a keyword — but the pattern
+    // KEYWORD on that property's own schema is still sanitized.
+    const schema = {
+      type: "object",
+      properties: {
+        pattern: { type: "string", pattern: TOXIC_PATTERN },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(Object.keys(schema.properties)).toEqual(["pattern"]);
+    expect(schema.properties.pattern).toEqual({ type: "string" });
+    expect(dropped[0].location).toBe("/properties/pattern/pattern");
+  });
+
+  it("leaves a non-string pattern value alone", () => {
+    const schema = { type: "object", properties: { n: { pattern: 123 } } };
+    expect(sanitizeSchemaPatterns(schema)).toEqual([]);
+    expect((schema.properties.n as { pattern: unknown }).pattern).toBe(123);
+  });
+
+  it("reaches nested schema positions", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        choice: {
+          anyOf: [
+            { type: "string", pattern: TOXIC_PATTERN },
+            { type: "number" },
+          ],
+        },
+        tuple: {
+          type: "array",
+          items: [{ type: "string", pattern: TOXIC_PATTERN }],
+        },
+        names: { propertyNames: { pattern: TOXIC_PATTERN } },
+      },
+      $defs: {
+        link: { type: "string", pattern: TOXIC_PATTERN },
+      },
+      dependencies: {
+        // Array form is dependentRequired (names, not schemas) — untouched.
+        a: ["b"],
+        c: { properties: { d: { type: "string", pattern: TOXIC_PATTERN } } },
+      },
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(dropped.map((d) => d.location).sort()).toEqual([
+      "/$defs/link/pattern",
+      "/dependencies/c/properties/d/pattern",
+      "/properties/choice/anyOf/0/pattern",
+      "/properties/names/propertyNames/pattern",
+      "/properties/tuple/items/0/pattern",
+    ]);
+    expect(schema.dependencies.a).toEqual(["b"]);
+  });
+
+  it("terminates on a cyclic schema graph", () => {
+    const node: Record<string, unknown> = {
+      type: "object",
+      properties: { url: { type: "string", pattern: TOXIC_PATTERN } },
+    };
+    node.not = node;
+
+    const dropped = sanitizeSchemaPatterns(node);
+    expect(dropped).toHaveLength(1);
+  });
+
+  it("ignores non-object input", () => {
+    expect(sanitizeSchemaPatterns(undefined)).toEqual([]);
+    expect(sanitizeSchemaPatterns("pattern")).toEqual([]);
+    expect(sanitizeSchemaPatterns([{ pattern: TOXIC_PATTERN }])).toEqual([]);
+  });
+});
+
+describe("sanitizeSchemaPatterns — never-tighten invariant (patternProperties)", () => {
+  // Slash-free /u-invalid key so the expected report location needs no
+  // JSON-pointer escaping (the walker escapes `/` in map keys as `~1`).
+  const TOXIC_KEY = "^x\\:";
+
+  it("drops a broken patternProperties key and relaxes restrictive additionalProperties", () => {
+    const schema = {
+      type: "object",
+      patternProperties: {
+        [TOXIC_KEY]: { type: "string" },
+        "^clean-": { type: "number" },
+      },
+      additionalProperties: false,
+    };
+
+    const dropped = sanitizeSchemaPatterns(schema);
+
+    expect(dropped).toEqual([
+      {
+        location: `/patternProperties/${TOXIC_KEY}`,
+        pattern: TOXIC_KEY,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+    expect(schema.patternProperties).toEqual({ "^clean-": { type: "number" } });
+    // Keys the dropped pattern used to match would fall through to
+    // additionalProperties: false and be falsely REJECTED — the relaxation
+    // is what keeps sanitization strictly loosening.
+    expect("additionalProperties" in schema).toBe(false);
+  });
+
+  it("removes an emptied patternProperties and relaxes a restrictive subschema additionalProperties", () => {
+    const schema = {
+      type: "object",
+      patternProperties: { [TOXIC_KEY]: { type: "string" } },
+      additionalProperties: { type: "number" },
+      unevaluatedProperties: false,
+    };
+
+    sanitizeSchemaPatterns(schema);
+
+    expect("patternProperties" in schema).toBe(false);
+    expect("additionalProperties" in schema).toBe(false);
+    expect("unevaluatedProperties" in schema).toBe(false);
+  });
+
+  it("keeps additionalProperties when no patternProperties entry was dropped", () => {
+    const schema = {
+      type: "object",
+      patternProperties: { "^clean-": { type: "string" } },
+      additionalProperties: false,
+    };
+
+    sanitizeSchemaPatterns(schema);
+
+    expect(schema.additionalProperties).toBe(false);
+  });
+
+  it("proves the loosened schema through the real validator: previously matched keys stay accepted", async () => {
+    // End-to-end through @langchain/core's own validation path (the exact
+    // consumer that compiles patterns with /u): after sanitization, an input
+    // whose key only the dropped pattern used to match must validate — not
+    // fall through to additionalProperties: false.
+    const schema = {
+      type: "object" as const,
+      patternProperties: { "^x\\:": { type: "string" as const } },
+      additionalProperties: false,
+    };
+    sanitizeSchemaPatterns(schema);
+
+    // Default generics: the JSON-schema constructor arm types invoke input
+    // as ToolCall otherwise, rejecting the pattern-shaped key at compile time.
+    const tool: DynamicStructuredTool = new DynamicStructuredTool({
+      name: "probe",
+      description: "d",
+      schema,
+      func: async () => "ok",
+    });
+
+    await expect(tool.invoke({ "x:key": "value" })).resolves.toBe("ok");
+  });
+});
+
+describe("sanitizeSchemaPatterns — issue #420 regression pin", () => {
+  // The issue's exact repro: a tool loaded through the real adapter with the
+  // PayPal pattern shape loads fine but fails EVERY invocation with
+  // "SyntaxError: Invalid regular expression: /^https\:\/\//u".
+  const toxicTool = {
+    name: "toxic",
+    description: "d",
+    inputSchema: {
+      type: "object",
+      properties: { url: { type: "string", pattern: TOXIC_PATTERN } },
+    },
+  };
+  const fakeClient = {
+    listTools: async () => ({ tools: [toxicTool] }),
+    callTool: async () => ({ content: [{ type: "text", text: "called" }] }),
+  };
+
+  it("negative control: without sanitization the tool is uncallable (the defect)", async () => {
+    const tools = await loadMcpTools("srv", fakeClient as never, {
+      throwOnLoadError: true,
+    });
+
+    await expect(tools[0].invoke({ url: "https://x.com" })).rejects.toThrow(
+      /Invalid regular expression/,
+    );
+  });
+
+  it("after sanitization the same tool invokes successfully", async () => {
+    const tools = await loadMcpTools("srv", fakeClient as never, {
+      throwOnLoadError: true,
+    });
+
+    const dropped = sanitizeSchemaPatterns(tools[0].schema);
+
+    expect(dropped).toEqual([
+      {
+        location: "/properties/url/pattern",
+        pattern: TOXIC_PATTERN,
+        compilesWithoutUnicodeFlag: true,
+      },
+    ]);
+    await expect(tools[0].invoke({ url: "https://x.com" })).resolves.toBe(
+      "called",
+    );
+  });
+});