// Local-only: plain `apps/local` Vite dev must route the same local-only HTTP// surfaces as production `executor web`. These routes live outside the typed// `/api` HttpApi: `/api/health`, `/api/oauth/await/*`, and browser approval's// `/api/mcp-sessions/*`.import { type ChildProcess, spawn } from "node:child_process";import { randomBytes } from "node:crypto";import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";import net from "node:net";import { tmpdir } from "node:os";import { join } from "node:path";import { fileURLToPath } from "node:url"; import { expect } from "@effect/vitest";import { Effect } from "effect";import { Client } from "@modelcontextprotocol/sdk/client/index.js";import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"; import { scenario } from "../src/scenario";import { waitForHttp } from "../setup/boot"; const repoRoot = fileURLToPath(new URL("../../", import.meta.url));const localAppDir = join(repoRoot, "apps/local"); const APPROVAL_TARGET_TOOL = "executor.coreTools.policies.list";const EXECUTE_CODE = `const result = await tools.executor.coreTools.policies.list({});return JSON.stringify(result);`; const freePort = (): Promise<number> => new Promise((resolve, reject) => { const srv = net.createServer(); srv.on("error", reject); srv.listen(0, "127.0.0.1", () => { const port = (srv.address() as net.AddressInfo).port; srv.close(() => resolve(port)); }); }); const readToken = async (dataDir: string): Promise<string> => { const path = join(dataDir, "server-control", "auth.json"); const deadline = Date.now() + 30_000; while (Date.now() < deadline) { if (existsSync(path)) { const parsed = JSON.parse(readFileSync(path, "utf8")) as { readonly token?: unknown }; if (typeof parsed.token === "string") return parsed.token; } await new Promise((resolve) => setTimeout(resolve, 100)); } throw new Error(`Vite dev did not mint ${path}`);}; const stopTree = async (child: ChildProcess): Promise<void> => { if (child.pid === undefined || child.exitCode !== null) return; try { process.kill(-child.pid, "SIGTERM"); } catch { child.kill("SIGTERM"); } await Promise.race([ new Promise((resolve) => child.once("exit", resolve)), new Promise((resolve) => setTimeout(resolve, 5_000)), ]); if (child.exitCode === null) { try { process.kill(-child.pid, "SIGKILL"); } catch { child.kill("SIGKILL"); } }}; interface ViteDev { readonly origin: string; readonly token: string; readonly stop: () => Promise<void>;} const startPlainViteDev = async (): Promise<ViteDev> => { const dataDir = mkdtempSync(join(tmpdir(), "executor-local-vite-e2e-")); const port = await freePort(); const origin = `http://127.0.0.1:${port}`; const viteEntrypoint = join(localAppDir, "node_modules", "vite", "bin", "vite.js"); let logs = ""; const child = spawn( "bun", [viteEntrypoint, "dev", "--host", "127.0.0.1", "--port", String(port), "--strictPort"], { cwd: localAppDir, env: { ...process.env, EXECUTOR_DATA_DIR: dataDir, PORT: String(port) }, stdio: ["ignore", "pipe", "pipe"], detached: true, }, ); child.stdout?.on("data", (chunk: Buffer) => { logs += chunk.toString(); }); child.stderr?.on("data", (chunk: Buffer) => { logs += chunk.toString(); }); try { await waitForHttp(origin, { timeoutMs: 90_000 }); const token = await readToken(dataDir); return { origin, token, stop: async () => { await stopTree(child); rmSync(dataDir, { recursive: true, force: true }); }, }; } catch (error) { await stopTree(child); rmSync(dataDir, { recursive: true, force: true }); throw new Error(`plain Vite dev failed to boot:\n${logs}\n${String(error)}`); }}; scenario( "Local Vite dev · local-only API routes match production routing", { timeout: 180_000 }, Effect.gen(function* () { const vite = yield* Effect.promise(() => startPlainViteDev()); yield* Effect.promise(async () => { const failures: string[] = []; let policyId: string | null = null; const auth = { authorization: `Bearer ${vite.token}` }; try { const health = await fetch(`${vite.origin}/api/health`); const healthText = await health.text(); if (health.status !== 200 || healthText !== "ok") { failures.push(`/api/health returned ${health.status} ${JSON.stringify(healthText)}`); } const awaited = await fetch(`${vite.origin}/api/oauth/await/session-1`, { headers: auth, }); const awaitedText = await awaited.text(); if (awaited.status !== 200 || awaitedText !== "null") { failures.push( `/api/oauth/await/session-1 returned ${awaited.status} ${JSON.stringify(awaitedText)}`, ); } const created = await fetch(`${vite.origin}/api/policies`, { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ owner: "org", pattern: APPROVAL_TARGET_TOOL, action: "require_approval", }), }); if (!created.ok) { failures.push(`/api/policies setup returned ${created.status} ${await created.text()}`); } else { const policy = (await created.json()) as { readonly id?: string }; policyId = typeof policy.id === "string" ? policy.id : null; const mcp = new Client( { name: `vite-routing-${randomBytes(3).toString("hex")}`, version: "1.0.0" }, { capabilities: {} }, ); const transport = new StreamableHTTPClientTransport( new URL(`${vite.origin}/mcp?elicitation_mode=browser`), { requestInit: { headers: auth } }, ); await mcp.connect(transport); try { const executed = await mcp.callTool({ name: "execute", arguments: { code: EXECUTE_CODE }, }); const paused = executed.structuredContent as { readonly status?: string; readonly executionId?: string; readonly approvalUrl?: string; }; if ( paused.status !== "user_approval_required" || typeof paused.executionId !== "string" || typeof paused.approvalUrl !== "string" ) { failures.push( `MCP setup did not produce a browser approval: ${JSON.stringify(paused)}`, ); } else { const approvalUrl = new URL(paused.approvalUrl); const sessionId = approvalUrl.searchParams.get("mcp_session_id"); if (!sessionId) { failures.push(`approval URL had no mcp_session_id: ${paused.approvalUrl}`); } else { const detail = await fetch( `${vite.origin}/api/mcp-sessions/${encodeURIComponent( sessionId, )}/executions/${encodeURIComponent(paused.executionId)}`, { headers: auth }, ); if (detail.status !== 200) { failures.push( `/api/mcp-sessions paused-detail returned ${detail.status} ${await detail.text()}`, ); } } } } finally { await mcp.close(); } } } finally { if (policyId) { await fetch(`${vite.origin}/api/policies/${encodeURIComponent(policyId)}`, { method: "DELETE", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ owner: "org" }), }).catch(() => {}); } await vite.stop(); } expect( failures, "plain apps/local Vite dev should special-case the same local-only routes as production", ).toEqual([]); }); }),);
// Local-only: plain `apps/local` Vite dev must route the same local-only HTTP
// surfaces as production `executor web`. These routes live outside the typed
// `/api` HttpApi: `/api/health`, `/api/oauth/await/*`, and browser approval's
// `/api/mcp-sessions/*`.
import { type ChildProcess, spawn } from "node:child_process";
import { randomBytes } from "node:crypto";
import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
import net from "node:net";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { fileURLToPath } from "node:url";
import { expect } from "@effect/vitest";
import { Effect } from "effect";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
import { scenario } from "../src/scenario";
import { waitForHttp } from "../setup/boot";
const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
const localAppDir = join(repoRoot, "apps/local");
const APPROVAL_TARGET_TOOL = "executor.coreTools.policies.list";
const EXECUTE_CODE = `
const result = await tools.executor.coreTools.policies.list({});
return JSON.stringify(result);
`;
const freePort = (): Promise<number> =>
new Promise((resolve, reject) => {
const srv = net.createServer();
srv.on("error", reject);
srv.listen(0, "127.0.0.1", () => {
const port = (srv.address() as net.AddressInfo).port;
srv.close(() => resolve(port));
});
});
const readToken = async (dataDir: string): Promise<string> => {
const path = join(dataDir, "server-control", "auth.json");
const deadline = Date.now() + 30_000;
while (Date.now() < deadline) {
if (existsSync(path)) {
const parsed = JSON.parse(readFileSync(path, "utf8")) as { readonly token?: unknown };
if (typeof parsed.token === "string") return parsed.token;
}
await new Promise((resolve) => setTimeout(resolve, 100));
}
throw new Error(`Vite dev did not mint ${path}`);
};
const stopTree = async (child: ChildProcess): Promise<void> => {
if (child.pid === undefined || child.exitCode !== null) return;
try {
process.kill(-child.pid, "SIGTERM");
} catch {
child.kill("SIGTERM");
}
await Promise.race([
new Promise((resolve) => child.once("exit", resolve)),
new Promise((resolve) => setTimeout(resolve, 5_000)),
]);
if (child.exitCode === null) {
try {
process.kill(-child.pid, "SIGKILL");
} catch {
child.kill("SIGKILL");
}
}
};
interface ViteDev {
readonly origin: string;
readonly token: string;
readonly stop: () => Promise<void>;
}
const startPlainViteDev = async (): Promise<ViteDev> => {
const dataDir = mkdtempSync(join(tmpdir(), "executor-local-vite-e2e-"));
const port = await freePort();
const origin = `http://127.0.0.1:${port}`;
const viteEntrypoint = join(localAppDir, "node_modules", "vite", "bin", "vite.js");
let logs = "";
const child = spawn(
"bun",
[viteEntrypoint, "dev", "--host", "127.0.0.1", "--port", String(port), "--strictPort"],
{
cwd: localAppDir,
env: { ...process.env, EXECUTOR_DATA_DIR: dataDir, PORT: String(port) },
stdio: ["ignore", "pipe", "pipe"],
detached: true,
},
);
child.stdout?.on("data", (chunk: Buffer) => {
logs += chunk.toString();
});
child.stderr?.on("data", (chunk: Buffer) => {
logs += chunk.toString();
});
try {
await waitForHttp(origin, { timeoutMs: 90_000 });
const token = await readToken(dataDir);
return {
origin,
token,
stop: async () => {
await stopTree(child);
rmSync(dataDir, { recursive: true, force: true });
},
};
} catch (error) {
await stopTree(child);
rmSync(dataDir, { recursive: true, force: true });
throw new Error(`plain Vite dev failed to boot:\n${logs}\n${String(error)}`);
}
};
scenario(
"Local Vite dev · local-only API routes match production routing",
{ timeout: 180_000 },
Effect.gen(function* () {
const vite = yield* Effect.promise(() => startPlainViteDev());
yield* Effect.promise(async () => {
const failures: string[] = [];
let policyId: string | null = null;
const auth = { authorization: `Bearer ${vite.token}` };
try {
const health = await fetch(`${vite.origin}/api/health`);
const healthText = await health.text();
if (health.status !== 200 || healthText !== "ok") {
failures.push(`/api/health returned ${health.status} ${JSON.stringify(healthText)}`);
}
const awaited = await fetch(`${vite.origin}/api/oauth/await/session-1`, {
headers: auth,
});
const awaitedText = await awaited.text();
if (awaited.status !== 200 || awaitedText !== "null") {
failures.push(
`/api/oauth/await/session-1 returned ${awaited.status} ${JSON.stringify(awaitedText)}`,
);
}
const created = await fetch(`${vite.origin}/api/policies`, {
method: "POST",
headers: { ...auth, "content-type": "application/json" },
body: JSON.stringify({
owner: "org",
pattern: APPROVAL_TARGET_TOOL,
action: "require_approval",
}),
});
if (!created.ok) {
failures.push(`/api/policies setup returned ${created.status} ${await created.text()}`);
} else {
const policy = (await created.json()) as { readonly id?: string };
policyId = typeof policy.id === "string" ? policy.id : null;
const mcp = new Client(
{ name: `vite-routing-${randomBytes(3).toString("hex")}`, version: "1.0.0" },
{ capabilities: {} },
);
const transport = new StreamableHTTPClientTransport(
new URL(`${vite.origin}/mcp?elicitation_mode=browser`),
{ requestInit: { headers: auth } },
);
await mcp.connect(transport);
try {
const executed = await mcp.callTool({
name: "execute",
arguments: { code: EXECUTE_CODE },
});
const paused = executed.structuredContent as {
readonly status?: string;
readonly executionId?: string;
readonly approvalUrl?: string;
};
if (
paused.status !== "user_approval_required" ||
typeof paused.executionId !== "string" ||
typeof paused.approvalUrl !== "string"
) {
failures.push(
`MCP setup did not produce a browser approval: ${JSON.stringify(paused)}`,
);
} else {
const approvalUrl = new URL(paused.approvalUrl);
const sessionId = approvalUrl.searchParams.get("mcp_session_id");
if (!sessionId) {
failures.push(`approval URL had no mcp_session_id: ${paused.approvalUrl}`);
} else {
const detail = await fetch(
`${vite.origin}/api/mcp-sessions/${encodeURIComponent(
sessionId,
)}/executions/${encodeURIComponent(paused.executionId)}`,
{ headers: auth },
);
if (detail.status !== 200) {
failures.push(
`/api/mcp-sessions paused-detail returned ${detail.status} ${await detail.text()}`,
);
}
}
}
} finally {
await mcp.close();
}
}
} finally {
if (policyId) {
await fetch(`${vite.origin}/api/policies/${encodeURIComponent(policyId)}`, {
method: "DELETE",
headers: { ...auth, "content-type": "application/json" },
body: JSON.stringify({ owner: "org" }),
}).catch(() => {});
}
await vite.stop();
}
expect(
failures,
"plain apps/local Vite dev should special-case the same local-only routes as production",
).toEqual([]);
});
}),
);