// Browser approval of a gated MCP action, end to end through the real console.//// A `require_approval` policy turns a built-in tool into an action that pauses// for a human. The MCP session runs in `elicitation_mode=browser`, so the gated// `execute` does not let the model resume inline — it pauses and hands back an// `approvalUrl`. A real browser (signed in as the same identity) opens that// console page and clicks Approve / Decline; meanwhile `resume` long-polls for// the decision. Approve lets the tool run and return its result; Decline blocks// it. This is the leg unit tests structurally cannot cover: a human clicking the// button in the rendered ResumeApprovalPage.//// The policy is removed in an `ensuring` finalizer — a leaked require_approval// gate on a shared built-in tool would pause unrelated scenarios.//// Cross-target: runs on every host that wires browser approval (cloud's Durable// Object, self-host's in-process store, Cloudflare's DO). The host differences —// where the approval URL points, which engine holds the pause — are invisible// here; the scenario only drives the rendered console page.import { expect } from "@effect/vitest";import { Effect } from "effect";import { composePluginApi } from "@executor-js/api/server"; import { scenario } from "../src/scenario";import { Api, Browser, Mcp, Target } from "../src/services";import { type McpBrowserApproval, parseBrowserApproval } from "../src/surfaces/mcp";import type { BrowserSurface } from "../src/surfaces/browser";import type { Identity } from "../src/target"; const coreApi = composePluginApi([] as const); // Gating a built-in read tool keeps the scenario hermetic — no external server// to host a destructive tool. The gate, not the tool, is what's under test: any// action the engine pauses on flows through the same approval path.const GATE_TOOL = "executor.coreTools.policies.list"; // The gated call returns the policy listing, which includes the policy we just// created — so the created policy's id appears in the result iff the tool// actually ran (i.e. the human approved).const GATED_CODE = `const result = await tools.executor.coreTools.policies.list({});return JSON.stringify(result);`; /** Open the console approval page as `identity` and click Approve or Decline. */const decideInBrowser = (  browser: BrowserSurface,  identity: Identity,  approval: McpBrowserApproval,  decision: "Approve" | "Decline",): Effect.Effect<void> =>  browser.session(identity, async ({ page, step }) => {    await step(      `Open the approval page and ${decision.toLowerCase()} the paused action`,      async () => {        await page.goto(approval.approvalUrl, { waitUntil: "networkidle" });        await page.getByRole("button", { name: decision }).click();        // The page confirms the decision was recorded ("Approve sent" / "Decline sent").        await page.getByText(`${decision} sent`).waitFor();      },    );  }); scenario(  "MCP · a gated action approved in the browser runs to completion",  { timeout: 180_000 },  Effect.gen(function* () {    const target = yield* Target;    const api = yield* Api;    const browser = yield* Browser;    const mcp = yield* Mcp;    const identity = yield* target.newIdentity();    const client = yield* api.client(coreApi, identity);     const policy = yield* client.policies.create({      payload: { owner: "org", pattern: GATE_TOOL, action: "require_approval" },    });     yield* Effect.gen(function* () {      const session = mcp.session(identity, { elicitationMode: "browser" });      const tools = yield* session.listTools();      expect(tools).toContain("execute");       const paused = yield* session.call("execute", { code: GATED_CODE });      const approval = parseBrowserApproval(paused);      expect(approval.approvalUrl, "approval URL targets the resume page").toContain(        `/resume/${approval.executionId}`,      );       // `resume` blocks for the human's decision; approve it in the browser      // concurrently, then the resumed call returns the gated tool's result.      const [resumed] = yield* Effect.all(        [          session.awaitResume(approval.executionId),          decideInBrowser(browser, identity, approval, "Approve"),        ],        { concurrency: "unbounded" },      );       expect(resumed.ok, "the approved execution completed without error").toBe(true);      expect(resumed.text, "the gated tool ran and returned the policy listing").toContain(        policy.id,      );    }).pipe(      Effect.ensuring(        client.policies          .remove({ params: { policyId: policy.id }, payload: { owner: "org" } })          .pipe(Effect.ignore),      ),    );  }),); scenario(  "MCP · a gated action declined in the browser is blocked",  { timeout: 180_000 },  Effect.gen(function* () {    const target = yield* Target;    const api = yield* Api;    const browser = yield* Browser;    const mcp = yield* Mcp;    const identity = yield* target.newIdentity();    const client = yield* api.client(coreApi, identity);     const policy = yield* client.policies.create({      payload: { owner: "org", pattern: GATE_TOOL, action: "require_approval" },    });     yield* Effect.gen(function* () {      const session = mcp.session(identity, { elicitationMode: "browser" });      yield* session.listTools();       const paused = yield* session.call("execute", { code: GATED_CODE });      const approval = parseBrowserApproval(paused);       const [resumed] = yield* Effect.all(        [          session.awaitResume(approval.executionId),          decideInBrowser(browser, identity, approval, "Decline"),        ],        { concurrency: "unbounded" },      );       // The decision propagated (resume returned rather than hanging) and the      // gated tool never ran — its output (the policy id) is absent.      expect(resumed.text, "the gated tool did not run after a decline").not.toContain(policy.id);    }).pipe(      Effect.ensuring(        client.policies          .remove({ params: { policyId: policy.id }, payload: { owner: "org" } })          .pipe(Effect.ignore),      ),    );  }),);