@xdelivered/emberflow 0.2.0

package/server/subflowRunner.ts

@@ -0,0 +1,104 @@
+import type {
+  LogLine,
+  NodeRegistry,
+  StartRunOptions,
+  SubflowResult,
+  TraceSink,
+  WorkflowDefinition,
+} from '../src/engine';
+import { runOutput, startRun } from '../src/engine';
+
+/** Max depth of nested Subflow calls (ancestry chain length) before a run fails. */
+export const SUBFLOW_DEPTH_CAP = 8;
+
+export interface SubflowRunnerOptions {
+  /** Resolves a child workflow by id (server hosts this via apiStore.load). */
+  loadFlow: (id: string) => WorkflowDefinition | undefined;
+  registry: NodeRegistry;
+  secrets: Record<string, string>;
+  vars: Record<string, string>;
+  environment: string;
+  safeMode: boolean;
+  /** When true, child runs execute in Mock mode too — nothing real is ever
+   *  touched during a mock run, including inside Subflow children. See
+   *  `StartRunOptions.mockRun`. */
+  mockRun?: boolean;
+  /** Optional trace sink shared with the parent run (SSE/samples plumbing). */
+  trace?: TraceSink;
+  /** Optional child-log forwarder — receives the child's log lines already
+   *  prefixed with the child flow's name and the caller node's id, exactly as
+   *  the live runner streams them over SSE. Absent for headless runs. */
+  onLog?: (line: LogLine) => void;
+}
+
+/**
+ * Shared Subflow-runner factory used by BOTH the live runner
+ * (server/runRegistry.ts) and the in-process test runner
+ * (server/testRunner.ts): resolve the child via `loadFlow`, run it to
+ * completion on the same registry sharing the parent's environment
+ * (secrets/vars/safeMode), and return its collected Result output. The
+ * ancestry chain enforces the depth cap and catches A→B→A cycles; nested
+ * children keep their own execution sequence.
+ */
+export function makeSubflowRunner(
+  opts: SubflowRunnerOptions,
+  ancestry: string[],
+): NonNullable<StartRunOptions['subflowRunner']> {
+  return async (workflowId, input, callerNodeId): Promise<SubflowResult> => {
+    if (ancestry.length >= SUBFLOW_DEPTH_CAP) {
+      return { status: 'failed', error: `subflow depth cap (${SUBFLOW_DEPTH_CAP}) exceeded` };
+    }
+    if (ancestry.includes(workflowId)) {
+      return { status: 'failed', error: `subflow cycle: ${[...ancestry, workflowId].join(' → ')}` };
+    }
+    const childFlow = opts.loadFlow(workflowId);
+    if (!childFlow) return { status: 'failed', error: `Unknown workflow: ${workflowId}` };
+    try {
+      const childHandle = startRun({
+        flow: childFlow,
+        registry: opts.registry,
+        secrets: opts.secrets,
+        vars: opts.vars,
+        environment: opts.environment,
+        safeMode: opts.safeMode,
+        input,
+        // Mock mode propagates into the child: nothing real is ever touched
+        // in a mock run, including inside Subflow children. Scenario context
+        // never propagates (the parent didn't pick one for the child) — only
+        // the CHILD op's own op-level mocks apply, since nodeIds are scoped
+        // per-flow and reusing the parent's mock map would be meaningless
+        // (or worse, silently wrong) for the child's node ids.
+        mockRun: opts.mockRun,
+        mocks: (childFlow as { mocks?: Record<string, unknown> }).mocks ?? {},
+        trace: opts.trace,
+        subflowRunner: makeSubflowRunner(opts, [...ancestry, workflowId]),
+        events: opts.onLog
+          ? {
+              onLog: (line) =>
+                opts.onLog!({
+                  ...line,
+                  nodeLabel: `${childFlow.name} › ${line.nodeLabel ?? ''}`,
+                  nodeId: line.nodeId ? `${callerNodeId}/${line.nodeId}` : callerNodeId,
+                }),
+            }
+          : undefined,
+      });
+      const childRun = await childHandle.runToEnd();
+      if (childRun.status !== 'succeeded') {
+        // Surface the child's actual failure (e.g. the Mock-mode "would touch
+        // real infrastructure" boundary message) through the Subflow node's
+        // own error, rather than an opaque "failed" — the first failed
+        // node's `error`, if any, wins.
+        const failedNode = Object.values(childRun.nodeStates).find((s) => s.status === 'failed' && s.error);
+        const detail = failedNode?.error;
+        return {
+          status: 'failed',
+          error: `subflow "${childFlow.name}" ${childRun.status}${detail ? `: ${detail}` : ''}`,
+        };
+      }
+      return { status: 'succeeded', output: runOutput(childRun, childFlow) };
+    } catch (err) {
+      return { status: 'failed', error: err instanceof Error ? err.message : String(err) };
+    }
+  };
+}

package/server/testRunner.ts

@@ -0,0 +1,216 @@
+import {
+  mergeMocks,
+  startRun,
+  type NodeRegistry,
+  type ScenarioDefinition,
+  type WorkflowDefinition,
+} from '../src/engine';
+import { loadProjectConfig } from './projectConfig';
+import { buildApiStore, buildRegistries, requireProjectWhenExplicit } from './projectMode';
+import { loadEnvironments, resolveRunSafety, type EnvironmentsFile } from './environments';
+import { evaluateExpectation } from './scenarioTest';
+import { makeSubflowRunner } from './subflowRunner';
+import { redactSecrets } from './redact';
+import type { ApiStore } from './apiStore';
+
+/** Thrown for CLI usage errors (unknown opId / unknown environment) — the CLI
+ *  layer turns this into exit code 2, distinct from an assertion failure
+ *  (exit 1) or an unexpected error (also exit 1, via runCli's generic catch). */
+export class ScenarioTestUsageError extends Error {}
+
+export type SkipReason = 'no expect' | 'empty expect';
+
+export interface ScenarioResult {
+  opId: string;
+  scenario: string;
+  status: 'passed' | 'failed' | 'skipped';
+  /** Present only when status === 'failed' — evaluateExpectation's failure strings. */
+  failures?: string[];
+  /** Present only when status === 'skipped'. */
+  reason?: SkipReason;
+}
+
+export interface TestReport {
+  results: ScenarioResult[];
+  passed: number;
+  failed: number;
+  skipped: number;
+}
+
+interface RunEnv {
+  secrets: Record<string, string>;
+  vars: Record<string, string>;
+  environment: string;
+  safeMode: boolean;
+}
+
+async function runScenario(
+  op: WorkflowDefinition,
+  scenario: ScenarioDefinition,
+  apiStore: ApiStore,
+  registry: NodeRegistry,
+  env: RunEnv,
+  mock: boolean,
+): Promise<ScenarioResult> {
+  if (!scenario.expect) {
+    return { opId: op.id, scenario: scenario.name, status: 'skipped', reason: 'no expect' };
+  }
+  if (Object.keys(scenario.expect).length === 0) {
+    return { opId: op.id, scenario: scenario.name, status: 'skipped', reason: 'empty expect' };
+  }
+
+  // INTENTIONAL (controller decision): NO environment auth auto-attach here,
+  // unlike POST /runs (server/index.ts attachCredential). Tests are hermetic —
+  // auto-attaching the environment's credential would silently satisfy the very
+  // auth checks a deliberate 401-expectation scenario exists to exercise. If a
+  // scenario needs auth, embed the headers directly in `scenario.input`.
+  //
+  // --mock: same merge as the live serving mock-run path (mergeMocks,
+  // src/engine/scenarios.ts) — op-level `flow.mocks` overlaid by this
+  // scenario's `mocks`, scenario wins per nodeId. Nothing real is ever
+  // touched: the executor's mockRun short-circuit fails loudly on any
+  // infrastructure node (traceKind db/http/llm) that has no mock.
+  const handle = startRun({
+    flow: op,
+    registry,
+    secrets: env.secrets,
+    vars: env.vars,
+    environment: env.environment,
+    safeMode: env.safeMode,
+    input: scenario.input,
+    mockRun: mock,
+    mocks: mock ? mergeMocks(op, scenario) : undefined,
+    // Shared factory (server/subflowRunner.ts) — same depth cap/cycle guard as
+    // the live runner, minus the SSE trace/log plumbing a headless run skips.
+    subflowRunner: makeSubflowRunner(
+      {
+        loadFlow: (id) => apiStore.load(id),
+        registry,
+        secrets: env.secrets,
+        vars: env.vars,
+        environment: env.environment,
+        safeMode: env.safeMode,
+        mockRun: mock,
+      },
+      [op.id],
+    ),
+  });
+  const run = await handle.runToEnd();
+  const { ok, failures } = evaluateExpectation(run, op, scenario.expect);
+  return {
+    opId: op.id,
+    scenario: scenario.name,
+    status: ok ? 'passed' : 'failed',
+    ...(ok ? {} : { failures }),
+  };
+}
+
+/**
+ * Runs every scenario with `expect` across the given ops (or a single op when
+ * `opId` is given), entirely in-process: `startRun` is called directly per
+ * scenario, mirroring the options shape `RunRegistry.create` passes
+ * (server/runRegistry.ts) — but bypassing RunRegistry entirely, so these runs
+ * never enter it (no SSE, no run history).
+ *
+ * This is the shared seam both the CLI (`runScenarioSuite`, which bootstraps
+ * its own project/registries/apiStore from disk) and the studio route
+ * (`POST /workflows/:id/test` in server/index.ts, which reuses the
+ * already-booted server's apiStore/registry/environmentsFile — no re-read
+ * from disk, no drift from in-memory writes) call into. NO second expectation
+ * engine — both paths land here.
+ *
+ * Throws `ScenarioTestUsageError` for usage problems (unknown opId, unknown
+ * environment) — the CLI layer maps that to exit code 2; the route maps it to
+ * 400/404.
+ */
+export async function runScenarioSuiteFor(
+  ctx: { apiStore: ApiStore; registry: NodeRegistry; environmentsFile: EnvironmentsFile },
+  opts: { opId?: string; environmentName?: string; mock?: boolean },
+): Promise<TestReport> {
+  const { apiStore, registry, environmentsFile } = ctx;
+  const { opId, environmentName, mock = false } = opts;
+
+  const envName = environmentName ?? environmentsFile.defaultEnvironment;
+  const envDef = environmentsFile.environments[envName];
+  if (!envDef) {
+    throw new ScenarioTestUsageError(`Unknown environment: '${envName}'`);
+  }
+  const safety = resolveRunSafety(envName, envDef, {});
+  const runEnv: RunEnv = {
+    secrets: envDef.secrets,
+    vars: envDef.vars,
+    environment: envName,
+    safeMode: safety.ok ? safety.safeMode : false,
+  };
+
+  const allOps = apiStore.list();
+  let targetOps = allOps;
+  if (opId !== undefined) {
+    const op = allOps.find((o) => o.id === opId);
+    if (!op) throw new ScenarioTestUsageError(`Unknown operation: '${opId}'`);
+    targetOps = [op];
+  }
+
+  const rawResults: ScenarioResult[] = [];
+  for (const op of targetOps) {
+    for (const scenario of op.scenarios ?? []) {
+      rawResults.push(await runScenario(op, scenario, apiStore, registry, runEnv, mock));
+    }
+  }
+
+  // evaluateExpectation diffs RAW run state, so a failure string can quote a
+  // secret value the flow echoed into its response body. Redact the whole
+  // reporter payload (value-based; raw/url-encoded/base64 forms) before it can
+  // reach stdout/CI logs — same redactSecrets the SSE event path uses.
+  const results = redactSecrets(rawResults, runEnv.secrets);
+
+  return {
+    results,
+    passed: results.filter((r) => r.status === 'passed').length,
+    failed: results.filter((r) => r.status === 'failed').length,
+    skipped: results.filter((r) => r.status === 'skipped').length,
+  };
+}
+
+/**
+ * CLI entry point: bootstraps a project from disk (loadProjectConfig/
+ * buildRegistries/buildApiStore/loadEnvironments — the same bootstrap
+ * `server/index.ts` uses) and delegates to `runScenarioSuiteFor`. NO runner
+ * process, no HTTP.
+ */
+export async function runScenarioSuite(opts: {
+  projectDir: string;
+  opId?: string;
+  environmentName?: string;
+  mock?: boolean;
+}): Promise<TestReport> {
+  const { projectDir, opId, environmentName, mock } = opts;
+
+  const project = requireProjectWhenExplicit(
+    await loadProjectConfig(projectDir),
+    process.env.EMBERFLOW_PROJECT,
+    projectDir,
+  );
+  const environmentsFile = loadEnvironments(project ? project.root : projectDir);
+  const { execution } = buildRegistries(project);
+  const apiStore = buildApiStore(project);
+
+  return runScenarioSuiteFor({ apiStore, registry: execution, environmentsFile }, { opId, environmentName, mock });
+}
+
+/** `✓ opId · scenario` / `✗ opId · scenario (failure; failure)` — undefined for
+ *  skipped scenarios, which aren't printed as individual lines (only counted
+ *  in the summary), keeping default output focused on assertable scenarios. */
+export function formatScenarioLine(r: ScenarioResult): string | undefined {
+  if (r.status === 'skipped') return undefined;
+  if (r.status === 'passed') return `✓ ${r.opId} · ${r.scenario}`;
+  return `✗ ${r.opId} · ${r.scenario} (${(r.failures ?? []).join('; ')})`;
+}
+
+/** `12 passed, 1 failed, 3 skipped (no expect)` — the parenthetical lists the
+ *  distinct skip reasons present (omitted entirely when nothing was skipped). */
+export function formatSummary(report: TestReport): string {
+  const reasons = [...new Set(report.results.filter((r) => r.status === 'skipped').map((r) => r.reason))];
+  const suffix = report.skipped > 0 ? ` (${reasons.join(', ')})` : '';
+  return `${report.passed} passed, ${report.failed} failed, ${report.skipped} skipped${suffix}`;
+}

package/server/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "es2023",
+    "lib": ["ES2023", "DOM"],
+    "types": ["node"],
+    "skipLibCheck": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "allowJs": true
+  },
+  "include": ["."]
+}

package/server/workflowTestRoute.test.ts

@@ -0,0 +1,297 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { spawn, type ChildProcess } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// Verifies POST /workflows/:id/test — the studio "Test" button's server
+// route: runs one op's `expect`-carrying scenarios in-process, reusing the
+// same suite/evaluation/redaction seam as `emberflow test` (server/testRunner.ts),
+// and never touches RunRegistry (no SSE, no run history). Boots the actual
+// runner subprocess (server/index.ts) against a scratch project dir, mirroring
+// the harness in environmentsRoute.test.ts / runsAuth.test.ts.
+
+let proc: ChildProcess;
+const PORT = 8137;
+const base = `http://127.0.0.1:${PORT}`;
+let projectDir: string;
+
+async function waitHealthy(url: string, tries = 40): Promise<void> {
+  for (let i = 0; i < tries; i++) {
+    try {
+      if ((await fetch(url)).ok) return;
+    } catch {
+      /* not up yet */
+    }
+    await new Promise((r) => setTimeout(r, 150));
+  }
+  throw new Error('runner did not become healthy');
+}
+
+function bootRunner(port: number, env: Record<string, string | undefined>): ChildProcess {
+  return spawn('npx', ['tsx', 'server/index.ts'], {
+    env: { ...process.env, EMBERFLOW_RUNNER_PORT: String(port), ...env },
+    stdio: 'ignore',
+  });
+}
+
+async function postTest(opId: string, body?: Record<string, unknown>): Promise<Response> {
+  return fetch(`${base}/api/workflows/${encodeURIComponent(opId)}/test`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body ?? {}),
+  });
+}
+
+beforeAll(async () => {
+  projectDir = mkdtempSync(join(tmpdir(), 'workflowtestroute-'));
+  writeFileSync(
+    join(projectDir, 'emberflow.config.mjs'),
+    `export default {
+  registerNodes(registry) {
+    registry.register(
+      { type: 'EchoToken', label: 'Echo Token', inputSchema: { fields: [{ name: 'token', type: 'string' }] } },
+      async (ctx) => ({ token: ctx.input.token }),
+    );
+  },
+};\n`,
+  );
+  writeFileSync(
+    join(projectDir, 'emberflow.environments.json'),
+    JSON.stringify({
+      defaultEnvironment: 'local',
+      environments: {
+        local: { vars: {}, secrets: { API_TOKEN: 'supersecretvalue' } },
+      },
+    }),
+  );
+
+  const apisDir = join(projectDir, 'emberflow', 'apis', 'default');
+  mkdirSync(apisDir, { recursive: true });
+
+  // authcheck: one op with a pass, a fail, and an expect-less (skip) scenario —
+  // mirrors server/cliTest.test.ts's harness.
+  writeFileSync(
+    join(apisDir, 'authcheck.json'),
+    JSON.stringify({
+      id: 'authcheck',
+      name: 'Auth Check',
+      version: 1,
+      http: { method: 'POST', path: '/authcheck' },
+      nodes: [
+        {
+          id: 'input',
+          type: 'Input',
+          label: 'Input',
+          position: { x: 0, y: 0 },
+          config: { fields: [{ name: 'authed', type: 'boolean' }] },
+        },
+        {
+          id: 'route',
+          type: 'Route',
+          label: 'Route',
+          position: { x: 200, y: 0 },
+          config: { field: 'authed', branches: ['true', 'false'] },
+          inputMap: { value: { sourceNodeId: 'input', sourceField: '$' } },
+        },
+        {
+          id: 'respOk',
+          type: 'Response',
+          label: 'OK',
+          position: { x: 400, y: -80 },
+          config: { status: 200, body: { ok: true } },
+        },
+        {
+          id: 'respUnauth',
+          type: 'Response',
+          label: 'Unauthorized',
+          position: { x: 400, y: 80 },
+          config: { status: 401, body: { error: 'unauthorized' } },
+        },
+      ],
+      edges: [
+        { id: 'e1', source: 'input', target: 'route' },
+        { id: 'e2', source: 'route', target: 'respOk', sourceHandle: 'true' },
+        { id: 'e3', source: 'route', target: 'respUnauth', sourceHandle: 'false' },
+      ],
+      createdAt: '2026-01-01T00:00:00Z',
+      updatedAt: '2026-01-01T00:00:00Z',
+    }),
+  );
+  writeFileSync(
+    join(apisDir, 'authcheck.scenarios.json'),
+    JSON.stringify([
+      { id: 's-pass', name: 'authed-ok', input: { authed: true }, expect: { status: 200, body: { ok: true } } },
+      // Deliberately wrong expectation: authed:true routes to 200, but this
+      // scenario asserts 401 — must fail.
+      { id: 's-fail', name: 'expired', input: { authed: true }, expect: { status: 401 } },
+      { id: 's-skip', name: 'no-assertion', input: { authed: false } },
+    ]),
+  );
+
+  // leaky: a deliberate failure whose diff quotes a secret the flow echoed —
+  // must arrive redacted.
+  writeFileSync(
+    join(apisDir, 'leaky.json'),
+    JSON.stringify({
+      id: 'leaky',
+      name: 'Leaky',
+      version: 1,
+      nodes: [
+        {
+          id: 'echo',
+          type: 'EchoToken',
+          label: 'Echo',
+          position: { x: 0, y: 0 },
+          config: { token: { $secret: 'API_TOKEN' } },
+        },
+        {
+          id: 'result',
+          type: 'Result',
+          label: 'Result',
+          position: { x: 200, y: 0 },
+          config: {},
+          inputMap: { token: { sourceNodeId: 'echo', sourceField: 'token' } },
+        },
+      ],
+      edges: [{ id: 'e1', source: 'echo', target: 'result' }],
+      createdAt: '2026-01-01T00:00:00Z',
+      updatedAt: '2026-01-01T00:00:00Z',
+    }),
+  );
+  writeFileSync(
+    join(apisDir, 'leaky.scenarios.json'),
+    JSON.stringify([
+      // Deliberate body mismatch so the failure diff quotes the ACTUAL body
+      // (which contains the echoed secret) — it must arrive redacted.
+      { id: 's1', name: 'mismatch', input: {}, expect: { body: { token: 'not-the-secret' } } },
+    ]),
+  );
+
+  // broken: references an unregistered node type — startRun throws
+  // synchronously ("Invalid flow: Unknown node type: …"), the simplest
+  // reliable trigger for the route's unexpected-error path.
+  writeFileSync(
+    join(apisDir, 'broken.json'),
+    JSON.stringify({
+      id: 'broken',
+      name: 'Broken',
+      version: 1,
+      nodes: [{ id: 'x', type: 'NoSuchNodeType', label: 'X', position: { x: 0, y: 0 }, config: {} }],
+      edges: [],
+      createdAt: '2026-01-01T00:00:00Z',
+      updatedAt: '2026-01-01T00:00:00Z',
+    }),
+  );
+  writeFileSync(
+    join(apisDir, 'broken.scenarios.json'),
+    JSON.stringify([{ id: 's1', name: 'boom', input: {}, expect: { status: 200 } }]),
+  );
+
+  proc = bootRunner(PORT, { EMBERFLOW_PROJECT: projectDir });
+  await waitHealthy(`${base}/healthz`);
+}, 20_000);
+
+afterAll(async () => {
+  proc?.kill();
+  if (projectDir) rmSync(projectDir, { recursive: true, force: true });
+});
+
+describe('POST /workflows/:id/test', () => {
+  it('runs the op\'s scenarios and reports pass/fail/skip counts with failure strings', async () => {
+    const res = await postTest('authcheck');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.passed).toBe(1);
+    expect(body.failed).toBe(1);
+    expect(body.skipped).toBe(1);
+    const failed = body.results.find((r: { scenario: string }) => r.scenario === 'expired');
+    expect(failed.status).toBe('failed');
+    expect(failed.failures.join(' ')).toContain('status: expected 401, got 200');
+    const passed = body.results.find((r: { scenario: string }) => r.scenario === 'authed-ok');
+    expect(passed.status).toBe('passed');
+    const skipped = body.results.find((r: { scenario: string }) => r.scenario === 'no-assertion');
+    expect(skipped.status).toBe('skipped');
+  });
+
+  it('only runs scenarios for the requested op (not every op in the project)', async () => {
+    const res = await postTest('authcheck');
+    const body = await res.json();
+    expect(body.results.every((r: { opId: string }) => r.opId === 'authcheck')).toBe(true);
+  });
+
+  it('redacts a secret echoed into a failing diff', async () => {
+    const res = await postTest('leaky');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.failed).toBe(1);
+    const text = JSON.stringify(body);
+    expect(text).not.toContain('supersecretvalue');
+    expect(text).toContain('«secret:API_TOKEN»');
+  });
+
+  it('404s for an unknown op', async () => {
+    const res = await postTest('no-such-op');
+    expect(res.status).toBe(404);
+    const body = await res.json();
+    expect(body.error).toBeTruthy();
+  });
+
+  it('500s with a JSON error body on an unexpected throw (invalid flow: unregistered node type)', async () => {
+    const res = await postTest('broken');
+    expect(res.status).toBe(500);
+    expect(res.headers.get('content-type')).toContain('application/json');
+    const body = await res.json();
+    expect(body.error).toContain('Unknown node type');
+  });
+
+  it('400s for an unknown environment', async () => {
+    const res = await postTest('authcheck', { environment: 'no-such-env' });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toBeTruthy();
+  });
+
+  it('does not create a RunRegistry run — GET /runs/:id/events for an id returned mid-suite still 404s, and a pre-existing run stays the last one visible', async () => {
+    // Establish a real run via POST /runs (goes through RunRegistry) so we
+    // have a known-good runId to compare against.
+    const createRes = await fetch(`${base}/api/runs`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        flow: {
+          id: 'probe-flow',
+          name: 'Probe',
+          version: 1,
+          nodes: [{ id: 'input', type: 'Input', label: 'Input', position: { x: 0, y: 0 }, config: { fields: [] } }],
+          edges: [],
+        },
+        mode: 'step',
+        environment: 'local',
+      }),
+    });
+    expect(createRes.status).toBe(201);
+    const { runId } = await createRes.json();
+
+    // The probe run is visible via SSE replay.
+    const beforeEvents = await fetch(`${base}/api/runs/${runId}/events`);
+    expect(beforeEvents.status).toBe(200);
+    beforeEvents.body?.cancel();
+
+    // Run the test suite (which internally executes several scenario runs).
+    const testRes = await postTest('authcheck');
+    expect(testRes.status).toBe(200);
+
+    // The probe run's SSE stream is still exactly as reachable as before —
+    // no new run replaced or shadowed it, proving the suite's runs never
+    // registered with RunRegistry.
+    const afterEvents = await fetch(`${base}/api/runs/${runId}/events`);
+    expect(afterEvents.status).toBe(200);
+    afterEvents.body?.cancel();
+
+    // And a bogus/random run id (representing "any run the suite might have
+    // created") is not found — RunRegistry has no record of it.
+    const bogusEvents = await fetch(`${base}/api/runs/definitely-not-a-real-run-id/events`);
+    expect(bogusEvents.status).toBe(404);
+  });
+});