@stigmer/runner 3.9.0 → 3.11.0

package/src/__tests__/history-encryption-e2e.test.ts

@@ -0,0 +1,243 @@
+/**
+ * History-encryption tripwire (stigmer-cloud#227).
+ *
+ * Runs a secret-bearing workflow through a real Temporal server with the
+ * encryption codec installed, then scans the RAW workflow history and
+ * asserts the secret bytes appear in no payload. This is the test that
+ * proves the issue's claim is closed: without the codec, the secret
+ * appears in the hydrate activity result, in every per-task activity
+ * input (the engine passes the full env map), and in local-activity
+ * markers from expression evaluation.
+ *
+ * Also pins the cross-language completion contract: the
+ * execute-from-execution workflow must complete with a data-less result
+ * (void), because the Java parent awaits it as Void and Temporal Java's
+ * converter has no Void special-case — a data-bearing encrypted result
+ * would fail its converter lookup.
+ *
+ * Follows the golden-e2e pattern: tests skip gracefully when the
+ * Temporal test server cannot start.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { randomBytes } from "node:crypto";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
+import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
+import { EncryptionPayloadCodec } from "../encryption/payload-codec.js";
+import type { ExecuteServerlessWorkflowInput } from "../workflows/execute-serverless-workflow.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const WORKFLOWS_PATH = join(__dirname, "../workflows/index.ts");
+const TASK_QUEUE = "history-encryption-e2e";
+
+const SECRET = "sup3r-s3cret-t0ken-do-not-persist";
+
+const SECRET_BEARING_YAML = `
+document:
+  dsl: '1.0.0'
+  namespace: tripwire
+  name: secret-bearing
+  version: '1.0.0'
+  description: Exercises every env-to-history crossing with a secret value
+do:
+  # Expression evaluation: the secret flows through an EvaluateExpressions
+  # local activity whose result is recorded as a history marker.
+  - stampToken:
+      set:
+        authHeader: \${ "Bearer " + $env.API_TOKEN }
+  # Per-task activity: CallHttp receives the interpolated config AND the
+  # full runtime env map as activity input.
+  - callApi:
+      call: http
+      with:
+        method: GET
+        endpoint:
+          uri: https://example.com/data
+        headers:
+          Authorization: \${ $context.authHeader }
+  - done:
+      set:
+        finished: true
+`;
+
+type TestWorkflowEnvironment = import("@temporalio/testing").TestWorkflowEnvironment;
+type Worker = import("@temporalio/worker").Worker;
+
+let env: TestWorkflowEnvironment | null = null;
+let worker: Worker | null = null;
+let workerRunPromise: Promise<void> | null = null;
+let envReady = false;
+
+function createMockActivities() {
+  return {
+    HydrateWorkflowExecution: async (): Promise<ExecuteServerlessWorkflowInput> => ({
+      model: loadWorkflowFromYaml(SECRET_BEARING_YAML),
+      workflow_input: null,
+      env: { API_TOKEN: SECRET },
+      metadata: { execution_id: "tripwire-exec", org_id: "tripwire-org" },
+    }),
+    EvaluateExpressions: async (
+      expressions: Record<string, string>,
+      input: unknown,
+      stateVars: Record<string, unknown>,
+    ): Promise<Record<string, unknown>> => {
+      return evaluateExpressionBatch(expressions, input, stateVars);
+    },
+    CallHttp: async (): Promise<unknown> => ({ ok: true }),
+    ResetEventSequence: async (): Promise<number> => 0,
+    EmitWorkflowEvents: async (): Promise<void> => {},
+    LoadRecoveryContext: async (): Promise<unknown[]> => [],
+    PromoteTaskOutput: async (): Promise<void> => {},
+  };
+}
+
+/** Recursively collects every byte field in the raw history proto. */
+function collectByteFields(value: unknown, out: Uint8Array[]): void {
+  if (value instanceof Uint8Array) {
+    out.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectByteFields(item, out);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const item of Object.values(value)) collectByteFields(item, out);
+  }
+}
+
+describe("History encryption tripwire — Temporal TestWorkflowEnvironment", () => {
+  beforeAll(async () => {
+    try {
+      const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
+      const { Worker: W } = await import("@temporalio/worker");
+
+      env = await TWE.createLocal();
+      worker = await W.create({
+        connection: env.nativeConnection,
+        taskQueue: TASK_QUEUE,
+        workflowsPath: WORKFLOWS_PATH,
+        activities: createMockActivities(),
+        dataConverter: {
+          payloadCodecs: [
+            new EncryptionPayloadCodec({
+              primary: { keyId: "tripwire-key", key: randomBytes(32) },
+            }),
+          ],
+        },
+      });
+      workerRunPromise = worker.run();
+      envReady = true;
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`Temporal test server unavailable (tests will be skipped): ${msg}`);
+      envReady = false;
+    }
+  }, 60_000);
+
+  afterAll(async () => {
+    if (worker) {
+      worker.shutdown();
+      await workerRunPromise?.catch(() => {});
+    }
+    if (env) await env.teardown();
+  }, 30_000);
+
+  it("records no plaintext secret bytes anywhere in workflow history", async () => {
+    if (!envReady || !env) return;
+
+    const workflowId = `tripwire-${Date.now()}`;
+    // The starting client has NO codec, mirroring the Java/Go
+    // orchestrators: the slim input is plaintext and the void result must
+    // be readable without a key.
+    const result = await env.client.workflow.execute(
+      "stigmer/workflow/execute-from-execution",
+      {
+        taskQueue: TASK_QUEUE,
+        workflowId,
+        args: [
+          {
+            execution_id: "tripwire-exec",
+            workflow_instance_id: "",
+            workflow_id: "tripwire-wf",
+            org_id: "tripwire-org",
+          },
+        ],
+        workflowExecutionTimeout: "30s",
+      },
+    );
+    expect(result).toBeUndefined();
+
+    // Fetch the RAW history (no codec on this read — we want the bytes
+    // exactly as Temporal persisted them).
+    const secretBytes = Buffer.from(SECRET);
+    const byteFields: Uint8Array[] = [];
+    let encryptedPayloadCount = 0;
+    let completedResultHasData = false;
+
+    let nextPageToken: Uint8Array | undefined;
+    do {
+      const response = await env.client.workflowService.getWorkflowExecutionHistory({
+        namespace: "default",
+        execution: { workflowId },
+        nextPageToken,
+      });
+      for (const event of response.history?.events ?? []) {
+        collectByteFields(event, byteFields);
+
+        const completed = event.workflowExecutionCompletedEventAttributes;
+        if (completed?.result?.payloads?.some((p) => p.data && p.data.length > 0)) {
+          completedResultHasData = true;
+        }
+      }
+      encryptedPayloadCount += countEncryptedEncodings(response.history?.events ?? []);
+      nextPageToken =
+        response.nextPageToken && response.nextPageToken.length > 0
+          ? response.nextPageToken
+          : undefined;
+    } while (nextPageToken);
+
+    // The tripwire itself: the secret must not appear in any byte field
+    // of any history event — payload data, marker details, anywhere.
+    expect(byteFields.length).toBeGreaterThan(0);
+    for (const bytes of byteFields) {
+      expect(Buffer.from(bytes).includes(secretBytes)).toBe(false);
+    }
+
+    // Sanity: encryption was actually active (otherwise this test would
+    // pass vacuously against a broken codec setup).
+    expect(encryptedPayloadCount).toBeGreaterThan(0);
+
+    // Cross-language completion contract: void result, no data payload.
+    expect(completedResultHasData).toBe(false);
+  }, 60_000);
+});
+
+function countEncryptedEncodings(events: unknown[]): number {
+  let count = 0;
+  const encodings: Uint8Array[] = [];
+  for (const event of events) {
+    collectEncodingMetadata(event, encodings);
+  }
+  for (const encoding of encodings) {
+    if (Buffer.from(encoding).toString("utf-8") === "binary/encrypted") count++;
+  }
+  return count;
+}
+
+function collectEncodingMetadata(value: unknown, out: Uint8Array[]): void {
+  if (!value || typeof value !== "object") return;
+  if (Array.isArray(value)) {
+    for (const item of value) collectEncodingMetadata(item, out);
+    return;
+  }
+  const record = value as Record<string, unknown>;
+  const metadata = record["metadata"];
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    const encoding = (metadata as Record<string, unknown>)["encoding"];
+    if (encoding instanceof Uint8Array) out.push(encoding);
+  }
+  for (const item of Object.values(record)) collectEncodingMetadata(item, out);
+}

package/src/__tests__/preflight.test.ts

@@ -11,8 +11,12 @@
  *   the desktop Run dialog via the IPC handshake.
  */
 
-import { describe, expect, it } from "vitest";
-import { isNodeSqliteAvailable, preflightNodeRuntime } from "../preflight.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  isNodeSqliteAvailable,
+  preflightNodeRuntime,
+  assertLlmBackendsPreflight,
+} from "../preflight.js";
 
 describe("preflightNodeRuntime", () => {
   it("passes (returns null) when node:sqlite is available", () => {
@@ -39,3 +43,47 @@ describe("preflightNodeRuntime", () => {
     expect(preflightNodeRuntime() === null).toBe(isNodeSqliteAvailable());
   });
 });
+
+describe("assertLlmBackendsPreflight", () => {
+  // This is the gate both runner factories run at construction — the throw
+  // is what a misconfigured deployment sees instead of accepting work. The
+  // per-case parse/prereq tables live in shared/__tests__/llm-backend.test.ts;
+  // here we pin the wrapper's contract: throw on fatal, warn on precedence,
+  // silent when clean, and options-proxy treated like the env proxy.
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
+  /** Pin the vars this gate reads so ambient shell env cannot leak in. */
+  function stubBackendEnv(vars: Record<string, string>) {
+    vi.stubEnv("STIGMER_PROXY_ENDPOINT", "");
+    vi.stubEnv("STIGMER_ANTHROPIC_BACKEND", "");
+    vi.stubEnv("STIGMER_OPENAI_BACKEND", "");
+    vi.stubEnv("CLOUD_ML_REGION", "");
+    for (const [key, value] of Object.entries(vars)) {
+      vi.stubEnv(key, value);
+    }
+  }
+
+  it("passes silently for an unconfigured deployment", () => {
+    stubBackendEnv({});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(() => assertLlmBackendsPreflight(null)).not.toThrow();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("throws the actionable message for a misconfigured backend", () => {
+    stubBackendEnv({ STIGMER_ANTHROPIC_BACKEND: "vertex" });
+    expect(() => assertLlmBackendsPreflight(null)).toThrow(/CLOUD_ML_REGION/);
+  });
+
+  it("warns instead of throwing when an options-supplied proxy makes the var inert", () => {
+    stubBackendEnv({ STIGMER_ANTHROPIC_BACKEND: "vertex" });
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(() => assertLlmBackendsPreflight("https://api.stigmer.ai")).not.toThrow();
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("STIGMER_ANTHROPIC_BACKEND=vertex is ignored"),
+    );
+  });
+});

package/src/activities/__tests__/call-llm.test.ts

@@ -5,6 +5,45 @@ import { _resetRegistryCache } from "../../shared/model-registry.js";
 const originalFetch = globalThis.fetch;
 const originalEnv = { ...process.env };
 
+const { vertexCreateRequests } = vi.hoisted(() => ({
+  vertexCreateRequests: [] as Array<Record<string, unknown>>,
+}));
+
+// Mocked at the SDK class (the vertex-adapter.test.ts pattern) so no real
+// google-auth credential resolution ever runs inside a unit test — locally
+// it fails fast, but in CI it can probe the GCE metadata server. ChatAnthropic
+// consumes the client's parsed event stream, so the streaming arm returns a
+// plain async generator of Anthropic stream events.
+vi.mock("@anthropic-ai/vertex-sdk", () => ({
+  AnthropicVertex: class {
+    readonly messages = {
+      create: async (request: Record<string, unknown>) => {
+        vertexCreateRequests.push(request);
+        if (request.stream === true) {
+          return (async function* () {
+            yield { type: "message_start", message: { id: "msg_vertex_call_llm", type: "message", role: "assistant", model: request.model, content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: 11, output_tokens: 1 } } };
+            yield { type: "content_block_start", index: 0, content_block: { type: "text", text: "" } };
+            yield { type: "content_block_delta", index: 0, delta: { type: "text_delta", text: "Vertex direct." } };
+            yield { type: "content_block_stop", index: 0 };
+            yield { type: "message_delta", delta: { stop_reason: "end_turn", stop_sequence: null }, usage: { output_tokens: 4 } };
+            yield { type: "message_stop" };
+          })();
+        }
+        return {
+          id: "msg_vertex_call_llm",
+          type: "message",
+          role: "assistant",
+          model: request.model,
+          content: [{ type: "text", text: "Vertex direct." }],
+          stop_reason: "end_turn",
+          stop_sequence: null,
+          usage: { input_tokens: 11, output_tokens: 4 },
+        };
+      },
+    };
+  },
+}));
+
 describe("callLlmAction", () => {
   let mockFetch: ReturnType<typeof vi.fn>;
 
@@ -16,6 +55,12 @@ describe("callLlmAction", () => {
     delete process.env.STIGMER_TOKEN;
     delete process.env.OPENAI_API_KEY;
     delete process.env.ANTHROPIC_API_KEY;
+    // Deterministic regardless of the developer's shell: a leaked
+    // STIGMER_ANTHROPIC_BACKEND=vertex would reroute every direct-mode test.
+    delete process.env.STIGMER_ANTHROPIC_BACKEND;
+    delete process.env.STIGMER_OPENAI_BACKEND;
+    delete process.env.CLOUD_ML_REGION;
+    vertexCreateRequests.length = 0;
   });
 
   afterEach(() => {
@@ -234,6 +279,36 @@ describe("callLlmAction", () => {
     });
   });
 
+  describe("direct mode — Anthropic on the vertex backend", () => {
+    it("serves the call with no ANTHROPIC_API_KEY anywhere (ADC is the credential path)", async () => {
+      // The regression pin for the backend-blind key check: a correctly
+      // configured Vertex deployment holds no Anthropic key, and llm_call
+      // tasks must not fail with LLM_MISSING_API_KEY before construction.
+      process.env.STIGMER_ANTHROPIC_BACKEND = "vertex";
+      process.env.CLOUD_ML_REGION = "global";
+      mockFetchWithRegistry(() => {
+        throw new Error("unexpected fetch: vertex traffic must go through the SDK client");
+      });
+
+      const result = await callLlmAction(baseAnthropicConfig, {}, "exec-1");
+
+      expect(result.result).toBe("Vertex direct.");
+      expect(result.provider).toBe("anthropic");
+      expect(result.input_tokens).toBe(11);
+      expect(result.output_tokens).toBe(4);
+      expect(vertexCreateRequests.length).toBeGreaterThan(0);
+    });
+
+    it("keeps the LLM_MISSING_API_KEY contract on the public backend, now naming the backend remedy", async () => {
+      const err = await callLlmAction(baseAnthropicConfig, {}, "exec-1").catch((e: unknown) => e as Error & { type?: string });
+
+      expect(err).toBeInstanceOf(Error);
+      expect((err as { type?: string }).type).toBe("LLM_MISSING_API_KEY");
+      expect((err as Error).message).toContain("ANTHROPIC_API_KEY");
+      expect((err as Error).message).toContain("STIGMER_ANTHROPIC_BACKEND=vertex");
+    });
+  });
+
   describe("proxy mode", () => {
     it("routes through proxy when endpoint is set", async () => {
       process.env.STIGMER_PROXY_ENDPOINT = "https://proxy.stigmer.ai";

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import type { ClassifyToolApprovalsInput, ToolDescriptor } from "../classify-tool-approvals.js";
 
 vi.mock("../../idle-watchdog.js", () => ({
@@ -597,6 +597,122 @@ describe("ClassifyToolApprovals activity", () => {
       expect(headers).not.toHaveProperty("X-Stigmer-Mcp-Server-Id");
     });
   });
+
+  describe("direct mode (no proxy)", () => {
+    // The regression suite for the stigmerBackendEndpoint-as-LLM-proxy bug:
+    // an unproxied runner must call the provider directly with the real key,
+    // and must fail closed with one clear message when it has none.
+    const directOptions = { proxyEndpoint: null, stigmerToken: null, primaryModel: "gpt-4.1" };
+
+    beforeEach(() => {
+      // Deterministic regardless of the developer's shell: blank reads as
+      // missing, and backend/proxy vars must not leak in from outside.
+      vi.stubEnv("OPENAI_API_KEY", "");
+      vi.stubEnv("ANTHROPIC_API_KEY", "");
+      vi.stubEnv("STIGMER_ANTHROPIC_BACKEND", "");
+      vi.stubEnv("STIGMER_OPENAI_BACKEND", "");
+      vi.stubEnv("STIGMER_PROXY_ENDPOINT", "");
+    });
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+    });
+
+    it("fails closed without any credential path: every tool gated, no client constructed", async () => {
+      const { ChatAnthropic } = await import("@langchain/anthropic");
+      const { ChatOpenAI } = await import("@langchain/openai");
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+      const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+      const tools: ToolDescriptor[] = [
+        { name: "search_code", description: "Search code" },
+        { name: "delete_file", description: "Delete a file" },
+      ];
+
+      const result = await classifyTools(
+        { tools, serverName: "github", serverDescription: "GitHub", mcpServerId: null },
+        directOptions,
+      );
+
+      expect(result).toEqual([
+        { tool_name: "search_code", requires_approval: true, message: "Execute search_code" },
+        { tool_name: "delete_file", requires_approval: true, message: "Execute delete_file" },
+      ]);
+      expect(ChatOpenAI).not.toHaveBeenCalled();
+      expect(ChatAnthropic).not.toHaveBeenCalled();
+      expect(mockInvoke).not.toHaveBeenCalled();
+      // The message must name the model and provider (classification's
+      // provider follows the economy model, not the operator's key) and
+      // carry the predicate's remedy text.
+      expect(warn).toHaveBeenCalledWith(expect.stringContaining("'gpt-4o-mini' (openai)"));
+      expect(warn).toHaveBeenCalledWith(expect.stringContaining("OPENAI_API_KEY"));
+      warn.mockRestore();
+    });
+
+    it("uses the provider key directly — no proxy baseURL, no Authorization header", async () => {
+      vi.stubEnv("OPENAI_API_KEY", "sk-direct-test");
+      const { ChatOpenAI } = await import("@langchain/openai");
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [{ tool_name: "t", requires_approval: false, message: "" }],
+      });
+
+      const result = await classifyTools(
+        { tools: [{ name: "t", description: "d" }], serverName: "s", serverDescription: "", mcpServerId: null },
+        directOptions,
+      );
+
+      expect(result).toEqual([]);
+      const args = vi.mocked(ChatOpenAI).mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args.apiKey).toBe("sk-direct-test");
+      // The bug this suite pins: the gRPC control-plane endpoint must never
+      // reappear as a baseURL/Authorization transport override.
+      expect(args).not.toHaveProperty("configuration");
+    });
+
+    it("routes an Anthropic economy model directly through ChatAnthropic with the real key", async () => {
+      vi.stubEnv("ANTHROPIC_API_KEY", "sk-ant-direct");
+      const { ChatAnthropic } = await import("@langchain/anthropic");
+      const { getSummarizationModel } = await import("../../shared/model-registry.js");
+      vi.mocked(getSummarizationModel).mockResolvedValueOnce("claude-haiku-4.5");
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [{ tool_name: "t", requires_approval: false, message: "" }],
+      });
+
+      await classifyTools(
+        { tools: [{ name: "t", description: "d" }], serverName: "s", serverDescription: "", mcpServerId: null },
+        directOptions,
+      );
+
+      const args = vi.mocked(ChatAnthropic).mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args.apiKey).toBe("sk-ant-direct");
+      expect(args).not.toHaveProperty("clientOptions");
+    });
+
+    it("defers an un-inferable economy model to the per-batch fail-closed path", async () => {
+      // Real scenario: the registry-empty fallback returns the primary model
+      // verbatim (model-registry.ts), whatever its name. The pre-check must
+      // not guess a provider — the batch path owns the precise error.
+      const { getSummarizationModel } = await import("../../shared/model-registry.js");
+      vi.mocked(getSummarizationModel).mockResolvedValueOnce("mystery-model");
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+      const error = vi.spyOn(console, "error").mockImplementation(() => {});
+
+      const result = await classifyTools(
+        { tools: [{ name: "t", description: "d" }], serverName: "s", serverDescription: "", mcpServerId: null },
+        directOptions,
+      );
+
+      expect(result).toEqual([
+        { tool_name: "t", requires_approval: true, message: "Execute t" },
+      ]);
+      expect(error).toHaveBeenCalled();
+      error.mockRestore();
+    });
+  });
 });
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/activities/__tests__/discover-mcp-server.hang.test.ts

@@ -0,0 +1,103 @@
+/**
+ * Regression pin for issue #239's hang mechanism, against the REAL MCP client
+ * stack (no @langchain/mcp-adapters mock — that's why this lives in its own
+ * file, apart from discover-mcp-server.test.ts's mocked suite).
+ *
+ * The monday.com failure shape: the endpoint answers the streamable-HTTP
+ * initialize POST with a 4xx, mcp-adapters automatically falls back to SSE at
+ * the same URL, the endpoint accepts the stream and never sends the legacy
+ * `endpoint` event — and the MCP SDK's SSEClientTransport has no timer of its
+ * own, so initialization hangs forever. Before the transport-aware init bound,
+ * that hang rode until Temporal killed the activity opaquely; this test pins
+ * that discovery now fails fast (in fake time) with an error that names the
+ * endpoint.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { createServer, type Server } from "node:http";
+
+vi.mock("../../idle-watchdog.js", () => ({
+  activityStarted: vi.fn(),
+  activityFinished: vi.fn(),
+}));
+
+// classifyHttpOAuthFailure re-probes the endpoint on the failure path; keep it
+// deterministic here (its own behavior is covered by mcp-oauth-detect tests).
+vi.mock("../../shared/mcp-oauth-detect.js", () => ({
+  detectOAuthChallenge: vi.fn().mockResolvedValue(null),
+}));
+
+describe("discovery against a 4xx-then-silent-SSE endpoint (issue #239)", () => {
+  let server: Server;
+  let url: string;
+
+  beforeEach(async () => {
+    server = createServer((req, res) => {
+      if (req.method === "POST") {
+        // monday-shaped: reject the streamable-HTTP initialize outright.
+        res.writeHead(405, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "method not allowed" }));
+        return;
+      }
+      // The SSE fallback: accept the stream, never send an `endpoint` event.
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive",
+      });
+      res.write(": silent stream\n\n");
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (typeof address === "string" || address === null) throw new Error("no port");
+    url = `http://127.0.0.1:${address.port}/mcp`;
+  });
+
+  afterEach(() => {
+    // closeAllConnections: the hung SSE stream is a live socket that would
+    // otherwise keep server.close() (and the vitest worker) waiting.
+    server.closeAllConnections();
+    server.close();
+    vi.useRealTimers();
+  });
+
+  it("fails within the HTTP init bound with an endpoint-naming error", async () => {
+    const { discoverMcpServer } = await import("../discover-mcp-server.js");
+
+    const stigmerClient = {
+      getMcpServer: vi.fn().mockResolvedValue({
+        metadata: { slug: "monday", id: "mcp-monday" },
+        spec: {
+          serverType: {
+            case: "http",
+            value: { url, headers: {}, queryParams: {}, timeoutSeconds: 0 },
+          },
+          env: {},
+          pinnedToolApprovals: [],
+        },
+        status: undefined,
+      }),
+      getExecutionContextByExecutionId: vi.fn(),
+    };
+
+    // shouldAdvanceTime keeps real I/O flowing (the POST → 405 → SSE fallback
+    // happens over real sockets) while letting the test jump the 60s bound.
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+
+    const promise = discoverMcpServer(
+      { mcpServerId: "mcp-monday" },
+      { stigmerClient: stigmerClient as never, transportPosture: "stdio-forbidden" },
+    );
+    // Attach the rejection expectation BEFORE advancing so the rejection is
+    // never momentarily unhandled.
+    const expectation = expect(promise).rejects.toThrow(
+      new RegExp(`at ${url.replaceAll(".", "\\.")}.*did not complete MCP initialization`, "s"),
+    );
+
+    // Give the real client a beat to reach the hang (POST + fallback), then
+    // jump past the 30s HTTP bound in fake time.
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    await vi.advanceTimersByTimeAsync(31_000);
+
+    await expectation;
+  }, 15_000);
+});