// Repro + regression guard for the user report: "On a totally fresh install// (no existing data dir) on macOS, Executor does not detect any tools for a// STDIO MCP server."//// `withLocalServer` boots a real `executor web` on a THROWAWAY data dir (the// fresh-install condition) and the `local` app is the only surface that enables// stdio MCP (`dangerouslyAllowStdioMCP: true`). We add a stdio MCP server over// the bearer-authed API and assert its tools are discoverable — and that the// secret env it needs is stored on the connection (the secret store), not in// the integration's config blob.//// The original bug: `mcp.addServer` only registered an INTEGRATION. Per the// v1.5 integrations/connections split, tools are produced per-CONNECTION, and a// stdio add never created one, so the integration landed with zero connections// and zero tools. The fix auto-creates the default connection on add and routes// the env values into the connection's secret store.import { fileURLToPath } from "node:url"; import { expect } from "@effect/vitest";import { Effect } from "effect";import { HttpApiClient } from "effect/unstable/httpapi";import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";import { composePluginApi } from "@executor-js/api/server";import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared"; import { scenario } from "../src/scenario";import { Cli, RunDir } from "../src/services";import { withLocalServer } from "./local-server"; const api = composePluginApi([mcpHttpPlugin()] as const); const FIXTURE = fileURLToPath(new URL("./fixtures/stdio-mcp-server.mjs", import.meta.url)); // The fixture exposes `whoami` ONLY when EXECUTOR_E2E_SECRET is present in its// process env. So `whoami` showing up in the discovered tools is direct proof// the connection's secret env reached the spawned subprocess.const SECRET = "s3cr3t-from-the-vault"; scenario(  "Local · a stdio MCP server's tools are detected on a fresh install, with env stored as a secret",  // Must stay STRICTLY greater than the boot-URL wait in `withLocalServer`  // (currently 240s). When this CI job runs `stdio-mcp.test.ts` alone it always  // pays a cold `vite optimizeDeps` boot (no prior file to warm the cache), the  // one variable step. If this test timeout equals the boot wait, both deadlines  // fire together and vitest's generic "Test timed out" wins, swallowing the  // harness's "printed no ?_token URL\n<terminal tail>" error that tells us what  // boot actually got stuck on. Keep the gap so the boot diagnostic surfaces.  { timeout: 300_000 },  Effect.gen(function* () {    const cli = yield* Cli;    const runDir = yield* RunDir;     yield* withLocalServer(cli, runDir, (server) =>      Effect.gen(function* () {        const client = yield* HttpApiClient.make(api, {          baseUrl: new URL("/api", server.origin).toString(),          transformClient: HttpClient.mapRequest((request) =>            HttpClientRequest.setHeader(request, "authorization", `Bearer ${server.token}`),          ),        }).pipe(Effect.provide(FetchHttpClient.layer));         const slug = "e2e-stdio";         // Add the stdio server exactly as the desktop/local "Add MCP" flow does,        // including a secret env var the server needs.        yield* client.mcp.addServer({          payload: {            transport: "stdio",            name: "E2E Stdio",            command: "node",            args: [FIXTURE],            env: { EXECUTOR_E2E_SECRET: SECRET },            slug,          },        });         // The integration lands in the catalog — the add itself works.        const integrations = yield* client.integrations.list();        expect(          integrations.map((i) => String(i.slug)),          "the stdio MCP integration is registered",        ).toContain(slug);         // The add auto-creates the default connection (the v1.5 split makes this        // the thing that drives tool discovery). Pre-fix there were zero.        const connections = yield* client.connections.list({ query: { integration: slug } });        expect(          connections.map((c) => String(c.name)),          "a default connection was auto-created for the stdio server",        ).toContain("default");         // THE SYMPTOM, fixed: the stdio server's tools are detected. `whoami`        // appearing proves the connection's secret env reached the subprocess.        const tools = yield* client.tools.list({ query: { integration: slug } });        const names = tools.map((t) => t.name);        expect(names, "the stdio server's base tool is detected").toContain("echo_tool");        expect(          names,          "the secret env var reached the spawned subprocess (whoami is gated on it)",        ).toContain("whoami");         // "Properly store auth": the secret value is NOT in the integration's        // config blob — only the var NAME is declared there; the value lives on        // the connection (the secret store).        const stored = yield* client.mcp.getServer({ params: { slug } });        expect(          JSON.stringify(stored?.config ?? {}),          "the secret value is not persisted in the integration config",        ).not.toContain(SECRET);         // --- The UI path: DECLARE env var names, then provide the secret value        // as a connection credential (what the add form now does). ---        const declSlug = "e2e-stdio-decl";        yield* client.mcp.addServer({          payload: {            transport: "stdio",            name: "E2E Stdio Declared",            command: "node",            args: [FIXTURE],            envVars: ["EXECUTOR_E2E_SECRET"],            slug: declSlug,          },        });         // Declaring a secret env var (no value) does NOT auto-connect: the        // secret is still missing, so there are no tools until you connect.        const beforeConns = yield* client.connections.list({ query: { integration: declSlug } });        expect(beforeConns, "no connection until the secret is provided").toHaveLength(0);        const beforeTools = yield* client.tools.list({ query: { integration: declSlug } });        expect(beforeTools, "no tools until the secret is provided").toHaveLength(0);         // Provide the secret as the connection credential (the connect step).        yield* client.connections.create({          payload: {            owner: "org",            name: ConnectionName.make("default"),            integration: IntegrationSlug.make(declSlug),            template: AuthTemplateSlug.make("env"),            values: { EXECUTOR_E2E_SECRET: SECRET },          },        });         const declTools = yield* client.tools.list({ query: { integration: declSlug } });        expect(          declTools.map((t) => t.name),          "connecting with the secret discovers the env-gated tool",        ).toContain("whoami");      }),    );  }),);