@stigmer/runner 3.9.0 → 3.11.0

package/src/shared/__tests__/mcp-enabled-tools.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  effectiveEnabledTools,
+  filterToolsByEnabledTools,
+  enabledToolsBySlug,
+} from "../mcp-enabled-tools.js";
+
+describe("effectiveEnabledTools", () => {
+  it("uses the usage's non-empty enabled_tools verbatim", () => {
+    expect(effectiveEnabledTools(["a", "b"], ["c"])).toEqual(["a", "b"]);
+  });
+
+  it("falls back to default_enabled_tools when the usage list is empty", () => {
+    expect(effectiveEnabledTools([], ["c", "d"])).toEqual(["c", "d"]);
+  });
+
+  it("falls back to default_enabled_tools when the usage list is absent", () => {
+    expect(effectiveEnabledTools(undefined, ["c"])).toEqual(["c"]);
+  });
+
+  it("returns undefined (unrestricted) when both lists are empty or absent", () => {
+    expect(effectiveEnabledTools([], [])).toBeUndefined();
+    expect(effectiveEnabledTools(undefined, undefined)).toBeUndefined();
+    expect(effectiveEnabledTools([], undefined)).toBeUndefined();
+  });
+
+  it("returns copies, never the caller's arrays", () => {
+    const usage = ["a"];
+    const result = effectiveEnabledTools(usage, undefined)!;
+    result.push("b");
+    expect(usage).toEqual(["a"]);
+  });
+});
+
+describe("filterToolsByEnabledTools", () => {
+  const tool = (name: string) => ({ name });
+
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  it("passes every tool through untouched when unrestricted (undefined)", () => {
+    const tools = [tool("a"), tool("b")];
+    expect(filterToolsByEnabledTools("srv", tools, undefined)).toEqual(tools);
+  });
+
+  it("keeps only the tools on the allow-list (exact bare-name match)", () => {
+    const tools = [tool("read"), tool("write"), tool("delete")];
+    expect(
+      filterToolsByEnabledTools("srv", tools, ["read"]).map((t) => t.name),
+    ).toEqual(["read"]);
+  });
+
+  it("warns and intersects when an enabled name is not among the discovered tools", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const tools = [tool("read"), tool("write")];
+
+    const filtered = filterToolsByEnabledTools("srv", tools, ["read", "reed"]);
+
+    // The restriction still holds (intersection), the run is not failed,
+    // and the operator gets a loud pointer at the mismatched name.
+    expect(filtered.map((t) => t.name)).toEqual(["read"]);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("reed"));
+  });
+
+  it("yields an empty toolset when no enabled name matches (restriction over availability)", () => {
+    const tools = [tool("read")];
+    expect(filterToolsByEnabledTools("srv", tools, ["ghost"])).toEqual([]);
+  });
+});
+
+describe("enabledToolsBySlug", () => {
+  it("collects only restricted servers, keyed by slug", () => {
+    const map = enabledToolsBySlug([
+      { slug: "restricted", enabledTools: ["a"] },
+      { slug: "open" },
+    ]);
+    expect(map).toEqual({ restricted: ["a"] });
+  });
+
+  it("returns an empty object when nothing is restricted (the common case)", () => {
+    expect(enabledToolsBySlug([{ slug: "open" }])).toEqual({});
+  });
+});

package/src/shared/__tests__/mcp-manager.test.ts

@@ -1,18 +1,48 @@
-import { describe, it, expect } from "vitest";
-import { toMcpClientConfig } from "../mcp-manager.js";
+import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
+import type { Connection } from "@langchain/mcp-adapters";
+import { connectMcpServers, toMcpClientConfig } from "../mcp-manager.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
 
+// The adapter client is mocked ONLY for the connectMcpServers tests below
+// (initializeConnections returns the canned per-server tool map); the
+// toMcpClientConfig suites are pure and never construct it.
+const mockMcpClient = vi.hoisted(() => ({
+  toolMap: {} as Record<string, { name: string }[]>,
+}));
+
+vi.mock("@langchain/mcp-adapters", () => ({
+  MultiServerMCPClient: class {
+    async initializeConnections() {
+      return mockMcpClient.toolMap;
+    }
+    async close() {}
+  },
+}));
+
 function makeServer(overrides: Partial<ResolvedMcpServer>): ResolvedMcpServer {
   return {
     slug: "test-server",
     connectionType: "stdio",
     toolApprovals: [],
     pinnedToolApprovals: [],
+    toolApprovalOverrides: [],
     discoveredCapabilitiesEmpty: false,
     ...overrides,
   };
 }
 
+/** Narrow a Connection to its stdio variant and return its env. */
+function stdioEnv(
+  config: Record<string, Connection>,
+  slug: string,
+): Record<string, string> | undefined {
+  const conn = config[slug];
+  if (!conn || !("command" in conn)) {
+    throw new Error(`expected a stdio connection for '${slug}'`);
+  }
+  return conn.env;
+}
+
 describe("toMcpClientConfig", () => {
   it("maps stdio servers to the client config format", () => {
     const servers = [
@@ -81,3 +111,141 @@ describe("toMcpClientConfig", () => {
     expect(toMcpClientConfig([])).toEqual({});
   });
 });
+
+// Runner-internal credentials that must never reach an MCP stdio subprocess
+// (oss#256). Names mirror what the runner actually reads: config.ts,
+// fingerprint-secret.ts, model-client.ts, registry-endpoint.ts.
+const RUNNER_CREDENTIAL_KEYS = [
+  "STIGMER_RUNNER_HITL_SECRET",
+  "STIGMER_TOKEN",
+  "STIGMER_AUTH_TOKEN",
+  "CURSOR_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+] as const;
+
+describe("toMcpClientConfig — stdio env isolation (oss#256)", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("gives a stdio server with no declared env none of the runner's variables", () => {
+    for (const key of RUNNER_CREDENTIAL_KEYS) {
+      vi.stubEnv(key, `leaked-${key}`);
+    }
+    vi.stubEnv("STIGMER_TEST_LEAK_SENTINEL", "canary");
+
+    const config = toMcpClientConfig([
+      makeServer({ slug: "bare", command: "some-mcp-server", env: undefined }),
+    ]);
+
+    // Passing no env means the MCP SDK supplies its minimal base environment
+    // (HOME, LOGNAME, PATH, SHELL, TERM, USER) — the runner must add nothing.
+    expect(stdioEnv(config, "bare")).toBeUndefined();
+  });
+
+  it("never copies process.env into a stdio config (fallback-reintroduction tripwire)", () => {
+    vi.stubEnv("STIGMER_TEST_LEAK_SENTINEL", "canary");
+
+    const config = toMcpClientConfig([
+      makeServer({ slug: "bare", command: "some-mcp-server", env: undefined }),
+    ]);
+
+    const env = stdioEnv(config, "bare") ?? {};
+    for (const key of Object.keys(process.env)) {
+      expect(
+        env,
+        `process.env key '${key}' must not leak into an MCP stdio env`,
+      ).not.toHaveProperty(key);
+    }
+  });
+
+  it("passes a declared env through exactly, without merging process.env", () => {
+    vi.stubEnv("STIGMER_TOKEN", "runner-secret");
+
+    const config = toMcpClientConfig([
+      makeServer({
+        slug: "declared",
+        command: "some-mcp-server",
+        env: { API_KEY: "user-value" },
+      }),
+    ]);
+
+    expect(stdioEnv(config, "declared")).toEqual({ API_KEY: "user-value" });
+  });
+
+  it("passes an empty declared env through unchanged (same child env as undeclared)", () => {
+    vi.stubEnv("STIGMER_TOKEN", "runner-secret");
+
+    const config = toMcpClientConfig([
+      makeServer({ slug: "empty", command: "some-mcp-server", env: {} }),
+    ]);
+
+    expect(stdioEnv(config, "empty")).toEqual({});
+  });
+});
+
+describe("connectMcpServers — enabled_tools enforcement (issue #350)", () => {
+  const tool = (name: string) => ({ name }) as any;
+
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = {};
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("filters a restricted server's discovered tools down to the allow-list, in BOTH the flat list and the per-server map", async () => {
+    mockMcpClient.toolMap = { planton: [tool("get"), tool("apply"), tool("destroy")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "planton", command: "npx", enabledTools: ["get"] }),
+    ]);
+
+    // Both result shapes must narrow together: `tools` feeds the model and
+    // the built-in general-purpose sub-agent, `serverToolMap` feeds the
+    // approval gate's toolServerMap and the sub-agent McpAccess subset check.
+    expect(result.tools.map((t) => t.name)).toEqual(["get"]);
+    expect(result.serverToolMap.planton.map((t) => t.name)).toEqual(["get"]);
+  });
+
+  it("leaves an unrestricted server (enabledTools absent — e.g. a synthesized attachment) untouched", async () => {
+    mockMcpClient.toolMap = { open: [tool("a"), tool("b")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "open", command: "npx" }),
+    ]);
+
+    expect(result.tools.map((t) => t.name)).toEqual(["a", "b"]);
+  });
+
+  it("restricts per server: one restricted server never narrows its unrestricted sibling", async () => {
+    mockMcpClient.toolMap = {
+      restricted: [tool("get"), tool("apply")],
+      open: [tool("get"), tool("apply")],
+    };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "restricted", command: "npx", enabledTools: ["get"] }),
+      makeServer({ slug: "open", command: "npx" }),
+    ]);
+
+    expect(result.serverToolMap.restricted.map((t) => t.name)).toEqual(["get"]);
+    expect(result.serverToolMap.open.map((t) => t.name)).toEqual(["get", "apply"]);
+  });
+
+  it("warns and intersects an allow-list naming a tool the server does not expose", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    mockMcpClient.toolMap = { planton: [tool("get")] };
+
+    const result = await connectMcpServers([
+      makeServer({ slug: "planton", command: "npx", enabledTools: ["get", "ghost"] }),
+    ]);
+
+    expect(result.tools.map((t) => t.name)).toEqual(["get"]);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("ghost"));
+  });
+});

package/src/shared/__tests__/mcp-resolver.test.ts

@@ -1,11 +1,17 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { resolveMcpServers } from "../mcp-resolver.js";
+import { mcpServerToResolved, mergeMcpServerUsages, resolveMcpServers } from "../mcp-resolver.js";
 import { McpTransportError } from "../mcp-transport-guard.js";
 
-function makeUsage(slug: string, org = "test-org") {
+function makeUsage(
+  slug: string,
+  org = "test-org",
+  enabledTools: string[] = [],
+  toolApprovalOverrides: Array<{ toolName: string; requiresApproval: boolean }> = [],
+) {
   return {
     mcpServerRef: { slug, org, kind: 0 },
-    toolApprovalOverrides: [],
+    enabledTools,
+    toolApprovalOverrides,
   } as any;
 }
 
@@ -106,3 +112,140 @@ describe("resolveMcpServers — transport guard integration", () => {
     expect(result.resolvedServers).toHaveLength(0);
   });
 });
+
+describe("resolveMcpServers — enabled_tools threading (issue #350)", () => {
+  function withDefaults(server: any, defaultEnabledTools: string[]) {
+    server.spec.defaultEnabledTools = defaultEnabledTools;
+    return server;
+  }
+
+  it("carries the usage's enabled_tools as the effective allow-list", async () => {
+    const client = clientReturning({ github: httpMcpServer("github") });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github", "test-org", ["create_pr"])], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toEqual(["create_pr"]);
+  });
+
+  it("falls back to the server's default_enabled_tools for an empty usage list", async () => {
+    const client = clientReturning({
+      github: withDefaults(httpMcpServer("github"), ["search_code"]),
+    });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github")], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toEqual(["search_code"]);
+  });
+
+  it("resolves unrestricted (absent field) when both lists are empty", async () => {
+    const client = clientReturning({ github: httpMcpServer("github") });
+
+    const result = await resolveMcpServers(
+      client, [makeUsage("github")], {}, "stdio-allowed",
+    );
+
+    expect(result.resolvedServers[0].enabledTools).toBeUndefined();
+  });
+
+  it("mcpServerToResolved without a usage keeps only the default fallback (the discovery path)", () => {
+    const server = withDefaults(httpMcpServer("github"), ["search_code"]);
+
+    const resolved = mcpServerToResolved(server, "github", {});
+
+    // No usage in hand (discovery) — a per-agent restriction cannot apply,
+    // only the server-declared default does.
+    expect(resolved?.enabledTools).toEqual(["search_code"]);
+  });
+});
+
+describe("resolveMcpServers — tool_approval_overrides threading (issue #349)", () => {
+  it("carries the usage's overrides on its own resolved server only", async () => {
+    // Riding the server is the scoping mechanism: an override can no longer
+    // reach a same-named tool on another server, because it never exists
+    // anywhere but its own server's object.
+    const client = clientReturning({
+      github: httpMcpServer("github"),
+      slack: httpMcpServer("slack"),
+    });
+
+    const result = await resolveMcpServers(
+      client,
+      [
+        makeUsage("github", "test-org", [], [{ toolName: "delete_item", requiresApproval: false }]),
+        makeUsage("slack"),
+      ],
+      {},
+      "stdio-allowed",
+    );
+
+    const bySlug = new Map(result.resolvedServers.map((s) => [s.slug, s]));
+    expect(bySlug.get("github")!.toolApprovalOverrides).toEqual([
+      { toolName: "delete_item", requiresApproval: false },
+    ]);
+    expect(bySlug.get("slack")!.toolApprovalOverrides).toEqual([]);
+  });
+
+  it("mcpServerToResolved without a usage carries no overrides (the discovery path)", () => {
+    const resolved = mcpServerToResolved(httpMcpServer("github"), "github", {});
+
+    // No usage in hand (discovery) — there is no agent context, so no
+    // layer-3 overrides can exist.
+    expect(resolved?.toolApprovalOverrides).toEqual([]);
+  });
+
+  it("session-wins merge feeds the SESSION usage's overrides to the resolver (native-harness parity)", async () => {
+    // Pins the end-to-end path that was broken before #349: the deep-agent
+    // harness resolved servers from the merged usages but flattened
+    // overrides from the AGENT usages only, so a session's overrides were
+    // silently ignored there (and honored by the Cursor harness).
+    const client = clientReturning({ github: httpMcpServer("github") });
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", [], [{ toolName: "push", requiresApproval: true }])],
+      [makeUsage("github", "test-org", [], [{ toolName: "push", requiresApproval: false }])],
+    );
+
+    const result = await resolveMcpServers(client, merged, {}, "stdio-allowed");
+
+    expect(result.resolvedServers[0].toolApprovalOverrides).toEqual([
+      { toolName: "push", requiresApproval: false },
+    ]);
+  });
+});
+
+describe("mergeMcpServerUsages — session-wins-per-slug (shared by both harnesses)", () => {
+  it("session usage replaces the agent's WHOLE usage for the same slug, including enabled_tools", () => {
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", ["create_pr"])],
+      [makeUsage("github", "test-org", ["search_code"])],
+    );
+
+    expect(merged).toHaveLength(1);
+    expect(merged[0].enabledTools).toEqual(["search_code"]);
+  });
+
+  it("a session usage with an empty list overrides to the server-default/unrestricted shape", () => {
+    // Session-wins is whole-usage precedence, not a list union: an empty
+    // session list means "back to the server's defaults", exactly as if the
+    // agent-level usage did not exist.
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github", "test-org", ["create_pr"])],
+      [makeUsage("github")],
+    );
+
+    expect(merged).toHaveLength(1);
+    expect(merged[0].enabledTools).toEqual([]);
+  });
+
+  it("unions distinct slugs and skips usages without one", () => {
+    const merged = mergeMcpServerUsages(
+      [makeUsage("github"), { toolApprovalOverrides: [] } as any],
+      [makeUsage("planton")],
+    );
+
+    expect(merged.map((u) => u.mcpServerRef?.slug)).toEqual(["github", "planton"]);
+  });
+});

package/src/shared/__tests__/model-client.test.ts

@@ -53,6 +53,9 @@ describe("buildChatModel", () => {
     vi.clearAllMocks();
     delete process.env.ANTHROPIC_API_KEY;
     delete process.env.OPENAI_API_KEY;
+    delete process.env.STIGMER_ANTHROPIC_BACKEND;
+    delete process.env.STIGMER_OPENAI_BACKEND;
+    delete process.env.CLOUD_ML_REGION;
   });
 
   afterEach(() => {
@@ -159,4 +162,155 @@ describe("buildChatModel", () => {
     expect(provider).toBe("anthropic");
     expect(apiModelId).toBe("claude-haiku-4.5");
   });
+
+  // ─── Request timeout (STIGMER_LLM_REQUEST_TIMEOUT_MS) ──────────────────────
+  //
+  // The timeout lives in a different slot per wrapper: ChatOpenAI reads it
+  // as a constructor field; ChatAnthropic only honors clientOptions.timeout.
+  // Putting it in the shared constructor spread was the regression that made
+  // the env var inert on every Anthropic path (T02 finding 2, repaired in
+  // T06). The backend factories' half of the chain is pinned in the
+  // vertex/bedrock/foundry adapter tests.
+
+  describe("request timeout", () => {
+    it("places the OpenAI timeout at the constructor level with maxRetries 0", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1", timeoutMs: 5000 });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).toMatchObject({ timeout: 5000, maxRetries: 0 });
+    });
+
+    it("places the Anthropic timeout in clientOptions, never the inert constructor slot", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-haiku-4.5", timeoutMs: 5000 });
+
+      const args = lastAnthropicArgs();
+      expect(args).toMatchObject({ clientOptions: { timeout: 5000 }, maxRetries: 0 });
+      expect(args).not.toHaveProperty("timeout");
+    });
+
+    it("merges the timeout with the proxy wiring inside one clientOptions block", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({
+        modelName: "claude-haiku-4.5",
+        proxyEndpoint: "https://api.stigmer.ai",
+        stigmerToken: "tok-123",
+        timeoutMs: 5000,
+      });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        clientOptions: {
+          timeout: 5000,
+          baseURL: "https://api.stigmer.ai/v1/proxy/llm/anthropic",
+        },
+      });
+    });
+  });
+
+  // ─── Provider backends (STIGMER_ANTHROPIC_BACKEND) ─────────────────────────
+
+  describe("vertex backend", () => {
+    beforeEach(() => {
+      process.env.STIGMER_ANTHROPIC_BACKEND = "vertex";
+      process.env.CLOUD_ML_REGION = "asia-south1";
+    });
+
+    it("holds the canonical-id invariant: translated id on the wire, canonical id returned", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.5", apiModelId: "claude-sonnet-4-5-20250929", provider: "anthropic" },
+      ]);
+
+      const { apiModelId } = await buildChatModel({ modelName: "claude-sonnet-4.5" });
+
+      // Pricing and usage metrics key on the canonical id; only the
+      // constructor (the wire) sees the Vertex `@date` form.
+      expect(apiModelId).toBe("claude-sonnet-4-5-20250929");
+      const args = lastAnthropicArgs();
+      expect(args.model).toBe("claude-sonnet-4-5@20250929");
+      expect(typeof args.createClient).toBe("function");
+    });
+
+    it("passes dateless 4.6-generation ids to the wire untranslated", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-sonnet-4.6" });
+
+      expect(lastAnthropicArgs().model).toBe("claude-sonnet-4-6");
+    });
+
+    it("constructs without ANTHROPIC_API_KEY (auth is Google's, not Anthropic's)", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-sonnet-4.6" });
+
+      expect(lastAnthropicArgs().apiKey).toBe("");
+    });
+
+    it("yields to the proxy: a proxied call never consults the backend var", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({
+        modelName: "claude-sonnet-4.6",
+        proxyEndpoint: "https://api.stigmer.ai",
+        stigmerToken: "tok",
+      });
+
+      const args = lastAnthropicArgs();
+      expect(args).not.toHaveProperty("createClient");
+      expect(args.model).toBe("claude-sonnet-4-6");
+      expect(args).toMatchObject({
+        clientOptions: { baseURL: "https://api.stigmer.ai/v1/proxy/llm/anthropic" },
+      });
+    });
+
+    it("leaves the OpenAI path untouched by the Anthropic backend var", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1" });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).not.toHaveProperty("createClient");
+      expect(mockAnthropicCtor).not.toHaveBeenCalled();
+    });
+
+    it("fails at dispatch with the region message when CLOUD_ML_REGION is missing", async () => {
+      // Defense in depth for paths that bypass the factories' preflight.
+      delete process.env.CLOUD_ML_REGION;
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await expect(buildChatModel({ modelName: "claude-sonnet-4.6" }))
+        .rejects.toThrow(/CLOUD_ML_REGION/);
+      expect(mockAnthropicCtor).not.toHaveBeenCalled();
+    });
+  });
+
+  it("throws the parser's message on an invalid backend value (never a silent public fallback)", async () => {
+    process.env.STIGMER_ANTHROPIC_BACKEND = "verteks";
+    mockRegistryResponse([
+      { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+    ]);
+
+    await expect(buildChatModel({ modelName: "claude-sonnet-4.6" }))
+      .rejects.toThrow(/STIGMER_ANTHROPIC_BACKEND="verteks" is not a supported backend/);
+  });
 });