lael-labs/executor

.github/workflows/ci.yml+29−26

       fail-fast: false
       matrix:
         include:
-          # Each cloud shard boots its own fresh dev stack. On 4 vCPU runners,
+          # PGlite is deliberately single-connection, and under a sustained
-          # four fatter shards keep the longest shard below selfhost while saving
+          # multi-minute shard it can stop accepting postgres sockets. Keep
-          # four runner boots and four warm cache restores.
+          # every hermetic dev stack short: eight serial shards remove that
-          - { target: cloud, shard: 1/4, shard-name: 1of4 }
+          # lifetime-dependent failure and put cloud below the selfhost lane.
-          - { target: cloud, shard: 2/4, shard-name: 2of4 }
+          - { target: cloud, shard: 1/8, shard-name: 1of8 }
-          - { target: cloud, shard: 3/4, shard-name: 3of4 }
+          - { target: cloud, shard: 2/8, shard-name: 2of8 }
-          - { target: cloud, shard: 4/4, shard-name: 4of4 }
+          - { target: cloud, shard: 3/8, shard-name: 3of8 }
-          - target: selfhost
+          - { target: cloud, shard: 4/8, shard-name: 4of8 }
+          - { target: cloud, shard: 5/8, shard-name: 5of8 }
+          - { target: cloud, shard: 6/8, shard-name: 6of8 }
+          - { target: cloud, shard: 7/8, shard-name: 7of8 }
+          - { target: cloud, shard: 8/8, shard-name: 8of8 }
+          # Selfhost shards the same way: each shard is its own runner booting
+          # its own fresh instance (own port block + data dir), so the
+          # project's shared-bootstrap-admin assumption stays intact per shard
+          # and `fileParallelism: false` still serializes within a shard.
+          - { target: selfhost, shard: 1/3, shard-name: 1of3 }
+          - { target: selfhost, shard: 2/3, shard-name: 2of3 }
+          - { target: selfhost, shard: 3/3, shard-name: 3of3 }
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       # The globalsetup boots the target's own dev server (ports are claimed
       # per checkout, so this is hermetic) and tears it down after the run.
-      # --retry=2: browser scenarios can still hit isolated waitFor timeouts
+      # Do not retry scenarios: retries hide flakes and multiply slow timeout
-      # (single-test waitFor timeouts, not systemic failures); a retry on the
+      # failures. The fixtures and process lifecycle are deterministic enough
-      # same booted stack clears them.
+      # that the first result is the result.
       - name: Run cloud scenarios
         if: matrix.target == 'cloud'
         env:
           MCP_SESSION_TIMEOUT_MS: "3000"
           MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS: "6000"
-        run: bunx vitest run --project cloud --retry=2 ${{ matrix.shard && format('--shard={0}', matrix.shard) || '' }}
+        run: bunx vitest run --project cloud ${{ matrix.shard && format('--shard={0}', matrix.shard) || '' }}
         working-directory: e2e
       - name: Run selfhost scenarios
         if: matrix.target == 'selfhost'
-        run: bunx vitest run --project selfhost --retry=2
+        run: bunx vitest run --project selfhost ${{ matrix.shard && format('--shard={0}', matrix.shard) || '' }}
         working-directory: e2e
       # Failed runs keep their trace.zip / session.mp4 / step screenshots in
           retention-days: 7
   e2e-local:
-    name: E2E (stdio MCP)
+    name: E2E (local)
-    # Skipped on pull_request: the local scenario boots a real `executor web`
-    # plus a browser and is currently flaky on PRs. Still runs on push to main.
-    if: github.event_name != 'pull_request'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
         run: bunx playwright install --with-deps chromium chromium-headless-shell
         working-directory: e2e
-      # The `local` project is excluded from the default `test` chain (each
+      # Each scenario owns its server, browser, data directory, and descendants;
-      # scenario boots its own `executor web`). Run just the stdio MCP scenario
+      # run the complete hermetic suite on PRs without scenario retries.
-      # here: it is the auto-connect / env-as-secret regression guard, and
+      - name: Run local scenarios
-      # running it alone avoids the boot-resource accumulation and the
+        run: bunx vitest run --project local
-      # pre-existing browser flakiness of the rest of the local suite. Expanding
-      # to the full `local` project (bun run test:local) is a follow-up once
-      # those are stabilized.
-      - name: Run the stdio MCP scenario
-        run: bunx vitest run --project local local/stdio-mcp.test.ts
         working-directory: e2e
   desktop-smoke:

apps/cli/src/main.ts+2−0

     const shutdown = () => resume(Effect.void);
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
+    process.once("SIGHUP", shutdown);
     return Effect.sync(() => {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
+      process.off("SIGHUP", shutdown);
     });
   });

apps/host-selfhost/src/config.ts+25−0

@@ -45,6 +45,14 @@ export interface SelfHostConfig { · 44 unmodified lines
45	readonly organizationName: string;	45	readonly organizationName: string;
46	/** URL slug for org-prefixed console paths (`/<slug>/policies`). */	46	/** URL slug for org-prefixed console paths (`/<slug>/policies`). */
47	readonly orgSlug: string;	47	readonly orgSlug: string;
		48	/**
		49	* Sandbox execution budget passed to the QuickJS runtime, or undefined for
		50	* the runtime's own default (5 minutes). An operator knob in principle, but
		51	* its real consumer is the e2e harness, which shrinks it to seconds so the
		52	* sandbox-deadline scenario proves its race without waiting out real
		53	* minutes (the same pattern as MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS on cloud).
		54	*/
		55	readonly sandboxTimeoutMs: number \| undefined;
48	}	56	}
49		57
50	export const resolveDataDir = (): string =>	58	export const resolveDataDir = (): string =>
@@ -151,9 +159,26 @@ export const loadConfig = (): SelfHostConfig => { · 100 unmodified lines
151	bootstrapAdminName: process.env.EXECUTOR_BOOTSTRAP_ADMIN_NAME ?? "Admin",	159	bootstrapAdminName: process.env.EXECUTOR_BOOTSTRAP_ADMIN_NAME ?? "Admin",
152	organizationName: process.env.EXECUTOR_ORG_NAME ?? "Default",	160	organizationName: process.env.EXECUTOR_ORG_NAME ?? "Default",
153	orgSlug: resolveOrgSlug(),	161	orgSlug: resolveOrgSlug(),
		162	sandboxTimeoutMs: resolveSandboxTimeoutMs(),
154	};	163	};
155	};	164	};
156		165
		166	// A malformed value is refused rather than silently ignored: an operator who
		167	// sets the knob and typos it should find out at boot, not by watching a
		168	// runaway execution use the 5-minute default.
		169	const resolveSandboxTimeoutMs = (): number \| undefined => {
		170	const raw = process.env.EXECUTOR_SANDBOX_TIMEOUT_MS;
		171	if (!raw) return undefined;
		172	const parsed = Number(raw);
		173	if (!Number.isFinite(parsed) \|\| parsed <= 0) {
		174	// oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: refuse to boot on a malformed operator knob
		175	throw new Error(
		176	`EXECUTOR_SANDBOX_TIMEOUT_MS ${JSON.stringify(raw)} is not a positive number of milliseconds`,
		177	);
		178	}
		179	return Math.floor(parsed);
		180	};
		181
157	// The org slug doubles as a URL segment (`/<slug>/policies`), so an	182	// The org slug doubles as a URL segment (`/<slug>/policies`), so an
158	// operator-set value must fit the shared grammar and avoid reserved root	183	// operator-set value must fit the shared grammar and avoid reserved root
159	// segments (api, mcp, login, …) — a colliding slug would shadow real routes.	184	// segments (api, mcp, login, …) — a colliding slug would shadow real routes.

apps/host-selfhost/src/execution.ts+6−1

 export const SelfHostCodeExecutorProvider: Layer.Layer<CodeExecutorProvider> = Layer.sync(
   CodeExecutorProvider,
-  () => makeQuickJsExecutor(),
+  () => {
+    const { sandboxTimeoutMs } = loadConfig();
+    return makeQuickJsExecutor(
+      sandboxTimeoutMs === undefined ? {} : { timeoutMs: sandboxTimeoutMs },
+    );
+  },
 );
 /**

apps/local/src/executor.ts+37−18

 import executorConfig from "../executor.config";
 import { localAnalytics } from "./analytics";
 import { localDataMigrations } from "./db/data-migrations";
-import { openOwnedLocalDatabase } from "./db/owned-database";
+import { openOwnedLocalDatabase, type OwnedLocalDatabase } from "./db/owned-database";
 interface ResolvedStorage {
   readonly dataDir: string;
 export interface LocalExecutorOptions {
   readonly activeToolkitSlug?: string;
+  /**
+   * Reuse an already-open owned database instead of opening (and locking) the
+   * data dir again. A toolkit-scoped MCP session differs from the default one
+   * only in its plugin set, so it must ride the running server's DB handle:
+   * `openOwnedLocalDatabase` takes an EXCLUSIVE lock, and a second open from
+   * inside the same process contends with the lock this process already holds.
+   * The borrowed handle is NOT closed when the derived executor disposes —
+   * whoever opened it still owns its lifetime.
+   */
+  readonly borrowedDb?: OwnedLocalDatabase;
 }
 const loadLocalPlugins = (options: LocalExecutorOptions = {}) =>
 interface LocalExecutorBundle {
   readonly executor: Executor<LocalPlugins>;
   readonly plugins: LocalPlugins;
+  /** The owned DB this bundle opened (or borrowed). Surfaced so a
+   *  toolkit-scoped executor can ride the SAME handle instead of contending
+   *  with this process's own exclusive data-dir lock. */
+  readonly db: OwnedLocalDatabase;
   /** Where this daemon's web UI is reachable, resolved once at boot. Surfaced
    *  so callers building user-facing links (MCP artifact deep links) use the
    *  same origin the executor itself was configured with. */
       const tenantId = makeTenantId(cwd);
       const tables = collectTables();
-      const owned = yield* Effect.acquireRelease(
+      // A borrowed handle is owned by its opener, so it is used as-is and left
-        Effect.tryPromise({
+      // open on release; only a handle opened here is closed here.
-          try: () =>
+      const owned = options.borrowedDb
-            openOwnedLocalDatabase({
+        ? options.borrowedDb
-              dataDir: storage.dataDir,
+        : yield* Effect.acquireRelease(
-              tables,
+            Effect.tryPromise({
-              namespace: localNamespace,
+              try: () =>
-              tenantId,
+                openOwnedLocalDatabase({
+                  dataDir: storage.dataDir,
+                  tables,
+                  namespace: localNamespace,
+                  tenantId,
+                }),
+              catch: (cause) =>
+                new LocalExecutorCreateError({
+                  message: CREATE_SQLITE_ERROR_MESSAGE,
+                  cause,
+                }),
             }),
-          catch: (cause) =>
+            (database) => Effect.promise(() => database.close()).pipe(Effect.ignore),
-            new LocalExecutorCreateError({
+          );
-              message: CREATE_SQLITE_ERROR_MESSAGE,
-              cause,
-            }),
-        }),
-        (database) => Effect.promise(() => database.close()).pipe(Effect.ignore),
-      );
       const sqlite = owned.db;
       const migration = owned.migration;
           );
       }
-      return { executor, plugins, webBaseUrl };
+      return { executor, plugins, webBaseUrl, db: owned };
     }),
   );
 };
     executor: bundle.executor,
     plugins: bundle.plugins,
     webBaseUrl: bundle.webBaseUrl,
+    db: bundle.db,
     dispose: async () => {
       await Effect.runPromise(Effect.ignore(bundle.executor.close()));
       await ignorePromiseFailure("disposeRuntime", () => runtime.dispose());

apps/local/src/main.ts+5−0

             },
           };
         }
+        // Borrow the running server's DB handle: this process already holds the
+        // data dir's exclusive ownership lock, so opening it a second time here
+        // fails against ourselves. The toolkit executor differs only in its
+        // plugin set, and the borrowed handle stays open when it disposes.
         const handle = await createExecutorHandle({
           activeToolkitSlug: resource.slug,
+          borrowedDb: (await getExecutorBundle()).db,
         });
         const toolkitEngine = withExecutionAnalytics(
           createExecutionEngine({

apps/local/src/serve.ts+39−11

   readonly stop: () => Promise<void>;
 }
+const viteChildSignals = ["SIGINT", "SIGTERM", "SIGHUP"] as const;
 async function allocatePort(): Promise<number> {
   const probe = Bun.serve({
     port: 0,
 async function startViteChild(): Promise<ViteChild> {
   const vitePort = await allocatePort();
   const cwd = resolve(import.meta.dirname, "..");
+  const viteEntrypoint = resolve(cwd, "node_modules/vite/bin/vite.js");
   const env = { ...process.env };
   delete env.PORT;
-  // `bunx --bun vite` runs vite under Bun, matching the `dev:vite` script
+  // Run Vite directly under Bun, matching the `dev:vite` script without a
-  // already in apps/local. --strictPort keeps the URL we hand back stable.
+  // bunx wrapper that can outlive its child. --strictPort keeps the URL stable.
   const child: Subprocess = Bun.spawn(
     [
-      "bunx",
+      process.execPath,
-      "--bun",
+      viteEntrypoint,
-      "vite",
       "dev",
       "--port",
       String(vitePort),
     },
   );
+  let stopping = false;
+  const stop = async (): Promise<void> => {
+    if (stopping) {
+      await child.exited;
+      return;
+    }
+    stopping = true;
+    for (const signal of viteChildSignals) process.off(signal, stopOnParentSignal);
+    if (child.exitCode === null) child.kill();
+    await Promise.race([child.exited, Bun.sleep(5_000)]);
+    if (child.exitCode === null) child.kill("SIGKILL");
+    await child.exited;
+  };
+  const stopOnParentSignal = (): void => {
+    // A PTY/session teardown can signal the CLI while Vite is still optimizing
+    // dependencies, before the server's normal stop handle exists. Reap the
+    // owned child immediately; the CLI's signal waiter performs full cleanup
+    // once startup has completed.
+    void stop();
+  };
+  for (const signal of viteChildSignals) process.once(signal, stopOnParentSignal);
   const url = `http://127.0.0.1:${vitePort}`;
   const deadline = Date.now() + 30_000;
   while (Date.now() < deadline) {
     // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: probing a child process that may not be listening yet
     try {
-      const r = await fetch(`${url}/`, { redirect: "manual" });
+      const r = await fetch(`${url}/`, {
+        redirect: "manual",
+        // A listening socket is not proof that Vite can answer. Bound each
+        // probe so one accepted-but-stalled request cannot defeat the 30s boot
+        // deadline and wedge the entire local e2e suite.
+        signal: AbortSignal.timeout(5_000),
+      });
       if (r.status < 500) {
         await r.body?.cancel();
         return {
           url,
-          stop: async () => {
+          stop,
-            child.kill();
-            await child.exited;
-          },
         };
       }
       await r.body?.cancel();
       // not up yet
     }
     if (child.exitCode !== null) {
+      await stop();
       // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: child process aborted before becoming ready
       throw new Error(`vite dev exited with code ${child.exitCode} before becoming ready`);
     }
     await Bun.sleep(150);
   }
-  child.kill();
+  await stop();
   // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: vite never became reachable
   throw new Error(`vite dev did not become reachable on ${url} within 30s`);
 }

e2e/local/auth.test.ts+5−3

           await page.goto(url, { waitUntil: "domcontentloaded" });
           await page.getByRole("link", { name: "Secrets" }).first().waitFor({ timeout: 30_000 });
           // Integrations actually LOAD (the built-in Executor integration) — proves
-          // auth + data, not just the static shell.
+          // auth + data, not just the static shell. Matched on the row's stable
-          await page.getByText("built-in").first().waitFor({ timeout: 30_000 });
+          // testid: the list renders each integration's name + slug, never the
+          // literal "built-in" (that string is only an internal `kind`).
+          await page.getByTestId("integration-entry-executor").first().waitFor({ timeout: 30_000 });
           // The token is moved out of the URL and persisted to localStorage.
           expect(new URL(page.url()).searchParams.has("_token")).toBe(false);
           const stored = await page.evaluate(() => localStorage.getItem("executor.authToken"));
           await page.getByRole("button", { name: "Connect" }).click();
           await page.getByRole("link", { name: "Secrets" }).first().waitFor({ timeout: 30_000 });
           // The reconnect fully restores — integrations LOAD, not a stale 401.
-          await page.getByText("built-in").first().waitFor({ timeout: 30_000 });
+          await page.getByTestId("integration-entry-executor").first().waitFor({ timeout: 30_000 });
         });
       }),
     );

e2e/local/boot-process.test.ts+101−0

@@ -0,0 +1,101 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { mkdtempSync, rmSync } from "node:fs";
	3	import { tmpdir } from "node:os";
	4	import { join } from "node:path";
	5
	6	import {
	7	BootProcessExitError,
	8	BootReadinessTimeoutError,
	9	bootProcesses,
	10	isBootReadinessTimeout,
	11	waitForBoot,
	12	} from "../setup/boot";
	13	import { claimAndBoot, isAddrInUse } from "../src/ports";
	14
	15	describe("e2e boot process lifecycle", () => {
	16	it("fails immediately with the boot log when a child exits", async () => {
	17	const tempDir = mkdtempSync(join(tmpdir(), "executor-e2e-boot-"));
	18	const logFile = join(tempDir, "boot.log");
	19	let readinessProbeAborted = false;
	20
	21	try {
	22	const processes = bootProcesses(
	23	[
	24	{
	25	cmd: process.execPath,
	26	args: [
	27	"-e",
	28	'console.error("Error: Port 44550 is already in use (EADDRINUSE)"); process.exit(17)',
	29	],
	30	cwd: tempDir,
	31	logFile,
	32	},
	33	],
	34	{ label: "lifecycle-test" },
	35	);
	36
	37	const startedAt = Date.now();
	38	let failure: unknown;
	39	try {
	40	await waitForBoot(
	41	processes,
	42	(signal) =>
	43	new Promise<never>((_resolve, reject) => {
	44	signal.addEventListener(
	45	"abort",
	46	() => {
	47	readinessProbeAborted = true;
	48	// oxlint-disable-next-line executor/no-promise-reject -- boundary: the fixture models an abort-aware readiness promise
	49	reject(signal.reason);
	50	},
	51	{ once: true },
	52	);
	53	}),
	54	);
	55	} catch (error) {
	56	failure = error;
	57	}
	58
	59	expect(failure).toBeInstanceOf(BootProcessExitError);
	60	expect(Date.now() - startedAt, "child exit beats the readiness timeout").toBeLessThan(5_000);
	61	expect(readinessProbeAborted, "the losing readiness probe is cancelled").toBe(true);
	62	expect(isAddrInUse(failure), "the port claimer can retry this boot failure").toBe(true);
	63	const bootFailure = failure as BootProcessExitError;
	64	expect(bootFailure.exitCode).toBe(17);
	65	expect(bootFailure.logTail).toContain("Port 44550 is already in use");
	66
	67	await processes.teardown();
	68	} finally {
	69	rmSync(tempDir, { recursive: true, force: true });
	70	}
	71	});
	72
	73	it("releases a failed claim before retrying a readiness timeout", async () => {
	74	const envVar = "E2E_BOOT_LIFECYCLE_TEST_PORT";
	75	let attempts = 0;
	76	const claimedPorts: number[] = [];
	77
	78	try {
	79	const booted = await claimAndBoot(
	80	[{ envVar, offset: 8, label: "boot lifecycle test" }],
	81	async (ports) => {
	82	attempts += 1;
	83	claimedPorts.push(ports[envVar]!);
	84	if (attempts === 1) {
	85	throw new BootReadinessTimeoutError("http://127.0.0.1:1", 10, "fixture timeout");
	86	}
	87	return { teardown: async () => {}, value: "ready" };
	88	},
	89	{ maxAttempts: 2, label: "lifecycle-test", retryWhen: isBootReadinessTimeout },
	90	);
	91
	92	expect(booted.value).toBe("ready");
	93	expect(attempts).toBe(2);
	94	expect(claimedPorts).toHaveLength(2);
	95	await booted.teardown();
	96	expect(process.env[envVar], "the successful claim is cleared at teardown").toBeUndefined();
	97	} finally {
	98	delete process.env[envVar];
	99	}
	100	});
	101	});

e2e/local/cli-mcp-daemon-attach-stress.test.ts+52−62

 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Effect } from "effect";
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { mkdtempSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import type { Subprocess } from "bun";
 import { scenario } from "../src/scenario";
+import { stopAutoSpawnedDaemon } from "./daemon-process";
 const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
 const testScope = join(repoRoot, "apps/local");
 // Generous: a dev-mode daemon boots a Vite dev server, slow under machine load.
 const readyTimeoutMs = 150_000;
-type DaemonProc = Subprocess<"ignore", "pipe", "pipe">;
+// vitest runs this suite under NODE, not bun, so the daemon is spawned with
+// node:child_process (the rest of the e2e harness does the same). `Bun.spawn`
+// here threw `ReferenceError: Bun is not defined` on every run.
+type DaemonProc = ChildProcessWithoutNullStreams;
 const waitForDaemonReady = (
   proc: DaemonProc,
     let stdoutBuffer = "";
     let stderrBuffer = "";
     let settled = false;
-    const decoder = new TextDecoder();
-    const stdout = proc.stdout.getReader();
-    const stderr = proc.stderr.getReader();
     const deadline = setTimeout(() => {
       if (settled) return;
       settled = true;
       // oxlint-disable-next-line executor/no-promise-reject, executor/no-error-constructor -- boundary: captured daemon stderr
       rejectReady(new Error(`daemon did not announce ready: ${stderrBuffer}`));
     }, readyTimeoutMs);
-    void (async () => {
+    proc.stderr.on("data", (chunk: Buffer) => {
-      while (true) {
+      stderrBuffer += chunk.toString();
-        const { value, done } = await stderr.read();
+    });
-        if (done) return;
+    proc.stdout.on("data", (chunk: Buffer) => {
-        stderrBuffer += decoder.decode(value);
+      if (settled) return;
-      }
+      stdoutBuffer += chunk.toString();
-    })();
+      const match = /Daemon ready on http:\/\/(?:\[[^\]]+\]|[^:\s]+):(\d+)/.exec(stdoutBuffer);
-    void (async () => {
+      if (match) {
-      while (true) {
+        settled = true;
-        const { value, done } = await stdout.read();
+        clearTimeout(deadline);
-        if (done) {
+        resolveReady({ port: Number(match[1]), stderr: () => stderrBuffer });
-          if (!settled) {
-            settled = true;
-            clearTimeout(deadline);
-            // oxlint-disable-next-line executor/no-promise-reject, executor/no-error-constructor -- boundary: captured daemon stderr
-            rejectReady(new Error(`daemon stdout closed before ready: ${stderrBuffer}`));
-          }
-          return;
-        }
-        stdoutBuffer += decoder.decode(value);
-        const match = /Daemon ready on http:\/\/(?:\[[^\]]+\]|[^:\s]+):(\d+)/.exec(stdoutBuffer);
-        if (match) {
-          settled = true;
-          clearTimeout(deadline);
-          resolveReady({ port: Number(match[1]), stderr: () => stderrBuffer });
-          return;
-        }
       }
-    })();
+    });
+    proc.stdout.on("close", () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      // oxlint-disable-next-line executor/no-promise-reject, executor/no-error-constructor -- boundary: captured daemon stderr
+      rejectReady(new Error(`daemon stdout closed before ready: ${stderrBuffer}`));
+    });
   });
 const spawnDaemon = (dataDir: string): DaemonProc =>
-  Bun.spawn(
+  spawn(
+    "bun",
     [
-      "bun",
       "run",
       "dev:cli",
       "daemon",
     {
       cwd: repoRoot,
       env: { ...process.env, EXECUTOR_DATA_DIR: dataDir },
-      stdin: "ignore",
+      stdio: ["ignore", "pipe", "pipe"],
-      stdout: "pipe",
+      detached: true,
-      stderr: "pipe",
     },
-  );
+  ) as DaemonProc;
+const exited = (proc: DaemonProc): Promise<void> =>
+  proc.exitCode !== null || proc.signalCode !== null
+    ? Promise.resolve()
+    : new Promise((resolve) => proc.once("exit", () => resolve()));
 const stopProc = async (proc: DaemonProc): Promise<void> => {
-  if (proc.exitCode !== null) return;
+  if (proc.exitCode !== null || proc.signalCode !== null) return;
-  proc.kill("SIGTERM");
+  if (proc.pid) process.kill(-proc.pid, "SIGTERM");
-  await Promise.race([proc.exited, Bun.sleep(3000)]);
+  await Promise.race([exited(proc), new Promise<void>((resolve) => setTimeout(resolve, 3000))]);
-  if (proc.exitCode === null) proc.kill("SIGKILL");
+  if (proc.exitCode === null && proc.signalCode === null && proc.pid) {
+    process.kill(-proc.pid, "SIGKILL");
+    await exited(proc);
+  }
 };
 const startForegroundDaemon = (dataDir: string) =>
   }
 };
-/** `executor mcp` now ensures a DURABLE (detached) daemon and bridges to it, so a
- * cold-start scenario leaves that daemon running. Stop it before removing the
- * data dir so the test never leaks an orphan daemon. */
-const stopAutoSpawnedDaemon = (dataDir: string): void => {
-  try {
-    const manifest = JSON.parse(
-      readFileSync(join(dataDir, "server-control", "server.json"), "utf8"),
-    ) as { pid?: number };
-    if (manifest.pid) process.kill(manifest.pid, "SIGTERM");
-  } catch {
-    // no manifest (no daemon spawned) — nothing to stop.
-  }
-};
 const withTempData = Effect.acquireRelease(
   Effect.sync(() => {
     const root = mkdtempSync(join(tmpdir(), "executor-mcp-stress-"));
     return join(root, "data");
   }),
   (dataDir) =>
-    Effect.sync(() => {
+    Effect.promise(async () => {
-      stopAutoSpawnedDaemon(dataDir);
+      await stopAutoSpawnedDaemon(dataDir);
       rmSync(join(dataDir, ".."), { recursive: true, force: true });
     }),
 );
       "2",
     );
-    daemon.proc.kill("SIGKILL");
+    if (daemon.proc.pid) process.kill(-daemon.proc.pid, "SIGKILL");
-    yield* Effect.promise(() => Promise.race([daemon.proc.exited, Bun.sleep(3000)]));
+    yield* Effect.promise(() =>
+      Promise.race([
+        exited(daemon.proc),
+        new Promise<void>((resolve) => setTimeout(resolve, 3000)),
+      ]),
+    );
     // The next call must settle (reject) quickly — a 10s bound well under the
     // scenario timeout catches a hang.
           .callTool({ name: "execute", arguments: { code: "return 3" } })
           .then(() => "resolved" as const)
           .catch(() => "rejected" as const),
-        Bun.sleep(10_000).then(() => "timeout" as const),
+        new Promise<"timeout">((resolve) => setTimeout(() => resolve("timeout"), 10_000)),
       ]),
     );
     // eslint-disable-next-line no-console

e2e/local/cli-mcp-protocol.test.ts+4−17

 import { Client as LegacyClient } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport as LegacyStdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Effect } from "effect";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { scenario } from "../src/scenario";
+import { stopAutoSpawnedDaemon } from "./daemon-process";
 const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
 const testScope = join(repoRoot, "apps/local");
   stderr: "pipe" as const,
 });
-const stopAutoSpawnedDaemon = (dataDir: string): void => {
-  // The bridge is transient, while its auto-started daemon is detached. Reap
-  // that owner before deleting this scenario's private data directory.
-  // oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates a bridge that failed before writing its manifest
-  try {
-    const manifest = JSON.parse(
-      readFileSync(join(dataDir, "server-control", "server.json"), "utf8"),
-    ) as { readonly pid?: number };
-    if (manifest.pid) process.kill(manifest.pid, "SIGTERM");
-  } catch {
-    // No manifest means there is no auto-started daemon to stop.
-  }
-};
 const withTempData = Effect.acquireRelease(
   Effect.sync(() => {
     const root = mkdtempSync(join(tmpdir(), "executor-mcp-protocol-"));
     return { root, dataDir: join(root, "data") };
   }),
   ({ root, dataDir }) =>
-    Effect.sync(() => {
+    Effect.promise(async () => {
-      stopAutoSpawnedDaemon(dataDir);
+      await stopAutoSpawnedDaemon(dataDir);
       rmSync(root, { recursive: true, force: true });
     }),
 );

e2e/local/daemon-process.ts+55−0

@@ -0,0 +1,55 @@
	1	import { readFile } from "node:fs/promises";
	2	import { join } from "node:path";
	3
	4	const isAlive = (pid: number): boolean => {
	5	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: process liveness probing reports false for an already-reaped test daemon
	6	try {
	7	process.kill(process.platform === "win32" ? pid : -pid, 0);
	8	return true;
	9	} catch {
	10	return false;
	11	}
	12	};
	13
	14	const signal = (pid: number, name: NodeJS.Signals): void => {
	15	// Auto-started daemons are detached process-group leaders. Signal the whole
	16	// private group so their Vite child cannot survive a failed test.
	17	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Windows and pre-detach failures require a direct-pid fallback
	18	try {
	19	process.kill(process.platform === "win32" ? pid : -pid, name);
	20	} catch {
	21	// oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates a process that exited between the liveness check and signal
	22	try {
	23	process.kill(pid, name);
	24	} catch {}
	25	}
	26	};
	27
	28	const waitUntilStopped = async (pid: number, timeoutMs: number): Promise<boolean> => {
	29	const deadline = performance.now() + timeoutMs;
	30	while (performance.now() < deadline) {
	31	if (!isAlive(pid)) return true;
	32	await new Promise((resolve) => setTimeout(resolve, 50));
	33	}
	34	return !isAlive(pid);
	35	};
	36
	37	/** Stop the detached daemon elected by an `executor mcp` cold start. */
	38	export const stopAutoSpawnedDaemon = async (dataDir: string): Promise<void> => {
	39	// oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates a bridge that failed before writing its manifest
	40	try {
	41	const manifest = JSON.parse(
	42	await readFile(join(dataDir, "server-control", "server.json"), "utf8"),
	43	) as { readonly pid?: unknown };
	44	if (!Number.isSafeInteger(manifest.pid) \|\| (manifest.pid as number) <= 0) return;
	45
	46	const pid = manifest.pid as number;
	47	signal(pid, "SIGTERM");
	48	if (await waitUntilStopped(pid, 10_000)) return;
	49
	50	signal(pid, "SIGKILL");
	51	await waitUntilStopped(pid, 2_000);
	52	} catch {
	53	// No manifest means there is no auto-started daemon to stop.
	54	}
	55	};

e2e/local/local-server.ts+8−2

     yield* Effect.all(
       [
         cli.session(
-          ["bun", "run", "dev:cli", "web", "--foreground", "--port", "0"],
+          ["bun", "run", "apps/cli/src/main.ts", "web", "--foreground", "--port", "0"],
           async (term) => {
             markRecordingStart(runDir, "terminal");
             markFocus(runDir, "terminal");
             // otherwise the orphaned child wedges the terminal teardown.
             markFocus(runDir, "terminal");
             await term.keyboard.press("Control+C");
+            await term.waitForExit({ timeoutMs: 15_000 });
           },
           {
             cwd: repoRoot,
-            env: { EXECUTOR_DATA_DIR: dataDir, EXECUTOR_SCOPE_DIR: dataDir, ...options?.env },
+            env: {
+              EXECUTOR_DEV: "1",
+              EXECUTOR_DATA_DIR: dataDir,
+              EXECUTOR_SCOPE_DIR: dataDir,
+              ...options?.env,
+            },
             record: join(runDir, options?.castName ?? "terminal.cast"),
             viewport: { cols: 120, rows: 40 },
           },

e2e/local/vite-dev-routing.test.ts+3−2

   const dataDir = mkdtempSync(join(tmpdir(), "executor-local-vite-e2e-"));
   const port = await freePort();
   const origin = `http://127.0.0.1:${port}`;
+  const viteEntrypoint = join(localAppDir, "node_modules", "vite", "bin", "vite.js");
   let logs = "";
   const child = spawn(
-    "bunx",
+    "bun",
-    ["--bun", "vite", "dev", "--host", "127.0.0.1", "--port", String(port), "--strictPort"],
+    [viteEntrypoint, "dev", "--host", "127.0.0.1", "--port", String(port), "--strictPort"],
     {
       cwd: localAppDir,
       env: { ...process.env, EXECUTOR_DATA_DIR: dataDir, PORT: String(port) },

e2e/scenarios/resume-after-sandbox-deadline.test.ts+35−20

@@ -8,14 +8,18 @@ · 7 unmodified lines
8	// unknown execution.	8	// unknown execution.
9	//	9	//
10	// The journey drives exactly that shape: ONE execution with TWO approval	10	// The journey drives exactly that shape: ONE execution with TWO approval
11	// gates. The first approval is granted late in its window (~3.5 min), so the	11	// gates. The first approval is granted late (70% of the sandbox budget in),
12	// second pause's window reaches well past the sandbox's 5-minute mark. The	12	// so the second pause's window reaches well past the budget. The second
13	// second approval arrives ~5.75 min after execution start — inside its OWN	13	// approval arrives at ~115% of the budget after execution start — inside its
14	// advertised window, but past the old absolute deadline. Deliberately slow	14	// OWN advertised window, but past the old absolute deadline. The subject is
15	// (~6 min): the elapsed time IS the subject under test. A single-pause	15	// that RATIO, not any absolute duration, so the delays scale off the budget
16	// variant cannot express this cross-target — hosts that advertise a	16	// the target was booted with: selfhost boots with a seconds-long
17	// 4-minute window would expire it legitimately before the sandbox clock	17	// EXECUTOR_SANDBOX_TIMEOUT_MS (setup/sandbox-timeout.ts) and proves the race
18	// even matters.	18	// in ~25s; a target on the production 5-minute budget runs the original
		19	// ~6-minute journey (the elapsed time IS the subject — nothing is mocked). A
		20	// single-pause variant cannot express this cross-target — hosts that
		21	// advertise a 4-minute window would expire it legitimately before the
		22	// sandbox clock even matters.
19	//	23	//
20	// The gate is `policies.create`'s own `requiresApproval` annotation	24	// The gate is `policies.create`'s own `requiresApproval` annotation
21	// (hermetic, same device as policy-tool-approval.test.ts); both approvals	25	// (hermetic, same device as policy-tool-approval.test.ts); both approvals
@@ -29,15 +33,23 @@ import { composePluginApi } from "@executor-js/api/server"; · 7 unmodified lines
29	import { scenario } from "../src/scenario";	33	import { scenario } from "../src/scenario";
30	import { Api, Mcp, Target } from "../src/services";	34	import { Api, Mcp, Target } from "../src/services";
31	import { configuredMcpPausedSessionIdleTimeoutMs } from "../setup/mcp-session-timeouts";	35	import { configuredMcpPausedSessionIdleTimeoutMs } from "../setup/mcp-session-timeouts";
		36	import { configuredSandboxTimeoutMs } from "../setup/sandbox-timeout";
32		37
33	const coreApi = composePluginApi([] as const);	38	const coreApi = composePluginApi([] as const);
34		39
35	// Grant the first approval at 3.5 min — late but inside its 4-minute window.	40	const SANDBOX_BUDGET_MS = configuredSandboxTimeoutMs();
36	// The second pause then opens a fresh window reaching ~7.5 min.	41
37	const FIRST_APPROVAL_DELAY_MS = 3.5 * 60_000;	42	// Grant the first approval at 70% of the budget — late but inside its window
38	// Grant the second approval 2.25 min later: ~5.75 min after execution start,	43	// (was 3.5 of 5 min). The second pause then opens a fresh window reaching
39	// past the sandbox's 5-minute budget but inside the second window.	44	// past the budget.
40	const SECOND_APPROVAL_DELAY_MS = 2.25 * 60_000;	45	const FIRST_APPROVAL_DELAY_MS = 0.7 * SANDBOX_BUDGET_MS;
		46	// Grant the second approval 45% of the budget later: ~115% of the budget
		47	// after execution start, past the sandbox clock but inside the second window
		48	// (was 2.25 of 5 min → ~5.75 min total).
		49	const SECOND_APPROVAL_DELAY_MS = 0.45 * SANDBOX_BUDGET_MS;
		50	// The whole journey plus scheduling slack, for the idle-window guard and the
		51	// vitest timeout.
		52	const JOURNEY_MS = FIRST_APPROVAL_DELAY_MS + SECOND_APPROVAL_DELAY_MS;
41		53
42	/** Sandbox code that creates two policies through the approval-gated core	54	/** Sandbox code that creates two policies through the approval-gated core
43	* tool. Patterns are unique-per-run and match no real tool, so the rules are	55	* tool. Patterns are unique-per-run and match no real tool, so the rules are
@@ -56,19 +68,22 @@ const second = await tools.executor.coreTools.policies.create({ · 12 unmodified lines
56	return JSON.stringify({ first: first.ok, second: second.ok });	68	return JSON.stringify({ first: first.ok, second: second.ok });
57	`;	69	`;
58		70
59	// The journey spans ~6 real minutes of paused waiting, so the host must keep	71	// The journey spans the whole paused waiting time, so the host must keep the
60	// the paused session alive that long. The suite's default e2e override shrinks	72	// paused session alive that long. The suite's default e2e override shrinks
61	// the paused-session idle teardown to seconds (to keep teardown tests fast),	73	// the paused-session idle teardown to seconds (to keep teardown tests fast),
62	// which would evict the session mid-scenario for reasons unrelated to the	74	// which would evict the session mid-scenario for reasons unrelated to the
63	// clock under test — require the production-like window instead.	75	// clock under test — require a window that outlasts the journey instead.
		76	// With a shrunken sandbox budget the journey shrinks too, so even the short
		77	// e2e idle window can suffice; the guard compares the two rather than
		78	// hardcoding either.
64	const PAUSED_IDLE_WINDOW_TOO_SHORT =	79	const PAUSED_IDLE_WINDOW_TOO_SHORT =
65	configuredMcpPausedSessionIdleTimeoutMs() < 8 * 60_000	80	configuredMcpPausedSessionIdleTimeoutMs() < JOURNEY_MS + 60_000
66	? `the target's paused-session idle teardown (${configuredMcpPausedSessionIdleTimeoutMs()}ms) evicts the session before this ~6-minute journey completes; boot the target with MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS >= 480000 to run it`	81	? `the target's paused-session idle teardown (${configuredMcpPausedSessionIdleTimeoutMs()}ms) evicts the session before this ${Math.round(JOURNEY_MS / 1000)}s journey completes; boot the target with MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS >= ${JOURNEY_MS + 60_000} or a smaller E2E_SANDBOX_TIMEOUT_MS to run it`
67	: undefined;	82	: undefined;
68		83
69	scenario(	84	scenario(
70	"MCP · chained approvals granted within their windows survive the sandbox clock",	85	"MCP · chained approvals granted within their windows survive the sandbox clock",
71	{ timeout: 480_000, skip: PAUSED_IDLE_WINDOW_TOO_SHORT },	86	{ timeout: Math.max(120_000, JOURNEY_MS + 120_000), skip: PAUSED_IDLE_WINDOW_TOO_SHORT },
72	Effect.gen(function* () {	87	Effect.gen(function* () {
73	const target = yield* Target;	88	const target = yield* Target;
74	const apiSurface = yield* Api;	89	const apiSurface = yield* Api;

e2e/selfhost/posthog-mcp-oauth.test.ts+43−20

-// Selfhost browser regression for the reported PostHog MCP OAuth dead-end. A
+// Hermetic selfhost browser regression for the reported PostHog MCP OAuth
-// real Executor instance adds https://mcp.posthog.com/mcp, then starts the
+// dead-end. A real Executor instance adds a wire-level OAuth-protected MCP
-// connection flow. The product guarantee: clicking Connect opens PostHog's
+// server, then starts the connection flow. The product guarantee: clicking
-// OAuth authorization page through dynamic client registration, not the
+// Connect reaches the authorization page through dynamic client registration,
-// bring-your-own OAuth app picker with "Automatic setup unavailable".
+// not the bring-your-own OAuth app picker with "Automatic setup unavailable".
+//
+// This used to call PostHog's production MCP and OAuth sites directly. That
+// made Executor CI depend on a third party's availability, metadata, and popup
+// response time. The local fixtures implement the same RFC 9728 discovery,
+// RFC 8414 metadata, RFC 7591 registration, and authorization redirect over
+// real HTTP, while keeping the assertion deterministic.
 import { randomBytes } from "node:crypto";
 import { expect } from "@effect/vitest";
 import { composePluginApi } from "@executor-js/api/server";
 import { deriveMcpNamespace } from "@executor-js/plugin-mcp";
 import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
+import { makeGreetingMcpServer, serveMcpServerWithOAuth } from "@executor-js/plugin-mcp/testing";
 import { IntegrationSlug } from "@executor-js/sdk/shared";
+import { OAuthTestServer } from "@executor-js/sdk/testing";
 import { scenario } from "../src/scenario";
 import { Api, Browser, Target } from "../src/services";
-const POSTHOG_MCP_URL = "https://mcp.posthog.com/mcp";
 const api = composePluginApi([mcpHttpPlugin()] as const);
 scenario(
-  "MCP OAuth · PostHog starts OAuth from Add connection",
+  "MCP OAuth · dynamic registration opens the discovered authorization server",
   { timeout: 180_000 },
   Effect.scoped(
     Effect.gen(function* () {
       const target = yield* Target;
       const browser = yield* Browser;
       const { client: makeApiClient } = yield* Api;
+      const oauth = yield* OAuthTestServer;
+      const server = yield* serveMcpServerWithOAuth(
+        () => makeGreetingMcpServer({ name: "dcr-regression-mcp" }),
+        { path: "/mcp" },
+      );
       const identity = yield* target.newIdentity();
       const client = yield* makeApiClient(api, identity);
       const displayName = `PostHog MCP ${randomBytes(3).toString("hex")}`;
       yield* Effect.gen(function* () {
         yield* browser.session(identity, async ({ page, step }) => {
-          await step("Open the add-MCP flow pointed at PostHog", async () => {
+          await step("Open the add-MCP flow pointed at the OAuth server", async () => {
             const addUrl = new URL("/integrations/add/mcp", target.baseUrl);
-            addUrl.searchParams.set("url", POSTHOG_MCP_URL);
+            addUrl.searchParams.set("url", server.endpoint);
             await page.goto(addUrl.toString(), { waitUntil: "networkidle" });
             await page.getByText("How does this server authenticate?").waitFor({ timeout: 30_000 });
             await page.getByText("Method 1 · Detected").waitFor();
             const popupPromise = page.waitForEvent("popup", { timeout: 30_000 });
             await page.getByRole("button", { name: "Connect", exact: true }).click();
             const popup = await popupPromise;
-            await popup.waitForURL(/^https:\/\/oauth\.posthog\.com\/oauth\/authorize\//, {
+            await popup.waitForURL((url) => url.origin === new URL(oauth.issuerUrl).origin, {
               timeout: 30_000,
             });
             await popup.waitForLoadState("domcontentloaded", { timeout: 30_000 });
             const authorizeUrl = new URL(popup.url());
-            expect(authorizeUrl.origin, "OAuth opened PostHog's authorization host").toBe(
+            expect(authorizeUrl.origin, "OAuth opened the discovered authorization host").toBe(
-              "https://oauth.posthog.com",
+              new URL(oauth.authorizationEndpoint).origin,
             );
-            expect(authorizeUrl.pathname, "OAuth opened the authorize endpoint").toBe(
-              "/oauth/authorize/",
-            );
-            expect(
-              authorizeUrl.searchParams.get("resource"),
-              "resource targets the MCP endpoint",
-            ).toBe(POSTHOG_MCP_URL);
             await popup.close();
           });
         });
+        const oauthRequests = yield* oauth.requests;
+        expect(
+          oauthRequests.some(
+            (request) => request.method === "POST" && request.path === "/register",
+          ),
+          "the connection flow dynamically registered its OAuth client",
+        ).toBe(true);
+        const authorizeRequest = oauthRequests.find(
+          (request) => request.method === "GET" && request.path === "/authorize",
+        );
+        expect(
+          authorizeRequest,
+          "the popup reached the discovered authorize endpoint",
+        ).toBeDefined();
+        expect(authorizeRequest?.query.resource, "resource targets the MCP endpoint").toBe(
+          server.endpoint,
+        );
       }).pipe(Effect.ensuring(client.mcp.removeServer({ params: { slug } }).pipe(Effect.ignore)));
     }),
-  ),
+  ).pipe(Effect.provide(OAuthTestServer.layer())),
 );

e2e/setup/boot.ts+122−13

@@ -3,7 +3,46 @@ · 2 unmodified lines
3	// what runs (their dev stack, their stub flags); this file only owns process	3	// what runs (their dev stack, their stub flags); this file only owns process
4	// lifecycle, so it stays target-agnostic.	4	// lifecycle, so it stays target-agnostic.
5	import { spawn, type ChildProcess } from "node:child_process";	5	import { spawn, type ChildProcess } from "node:child_process";
6	import { openSync } from "node:fs";	6	import { closeSync, openSync, readFileSync } from "node:fs";
		7	import { setTimeout as sleep } from "node:timers/promises";
		8
		9	const BOOT_LOG_TAIL_BYTES = 8_000;
		10	const HTTP_PROBE_TIMEOUT_MS = 5_000;
		11
		12	/** A long-lived boot process exited before its service became ready. */
		13	export class BootProcessExitError extends Error {
		14	readonly _tag = "BootProcessExitError";
		15
		16	constructor(
		17	readonly command: string,
		18	readonly exitCode: number \| null,
		19	readonly signal: NodeJS.Signals \| null,
		20	readonly logTail: string,
		21	) {
		22	const outcome = exitCode === null ? `signal ${signal ?? "unknown"}` : `code ${exitCode}`;
		23	const diagnostic = logTail ? `\nLast boot log output:\n${logTail}` : "";
		24	super(`Boot process ${JSON.stringify(command)} exited with ${outcome}${diagnostic}`);
		25	this.name = "BootProcessExitError";
		26	}
		27	}
		28
		29	/** A service process stayed alive but did not become HTTP-ready in time. */
		30	export class BootReadinessTimeoutError extends Error {
		31	readonly _tag = "BootReadinessTimeoutError";
		32
		33	constructor(
		34	readonly url: string,
		35	readonly timeoutMs: number,
		36	readonly lastError: unknown,
		37	) {
		38	super(`Timed out after ${timeoutMs}ms waiting for ${url}: ${String(lastError)}`);
		39	this.name = "BootReadinessTimeoutError";
		40	}
		41	}
		42
		43	/** Whether an acquisition failed because a live process never became ready. */
		44	export const isBootReadinessTimeout = (error: unknown): boolean =>
		45	error instanceof BootReadinessTimeoutError;
7		46
8	export interface BootedProcesses {	47	export interface BootedProcesses {
9	readonly teardown: () => Promise<void>;	48	readonly teardown: () => Promise<void>;
@@ -11,6 +50,21 @@ export interface BootedProcesses { · 1 unmodified line
11	readonly pids: ReadonlyArray<number>;	50	readonly pids: ReadonlyArray<number>;
12	}	51	}
13		52
		53	/** A spawned process tree that can report an exit during startup. */
		54	export interface MonitoredBootedProcesses extends BootedProcesses {
		55	/** Rejects as soon as any child exits before readiness/teardown. */
		56	readonly unexpectedExit: Promise<never>;
		57	}
		58
		59	const readLogTail = (logFile: string \| undefined): string => {
		60	if (!logFile) return "";
		61	try {
		62	return readFileSync(logFile, "utf8").slice(-BOOT_LOG_TAIL_BYTES).trim();
		63	} catch {
		64	return "";
		65	}
		66	};
		67
14	export const bootProcesses = (	68	export const bootProcesses = (
15	procs: ReadonlyArray<{	69	procs: ReadonlyArray<{
16	readonly cmd: string;	70	readonly cmd: string;
@@ -21,9 +75,10 @@ export const bootProcesses = ( · 4 unmodified lines
21	readonly logFile?: string;	75	readonly logFile?: string;
22	}>,	76	}>,
23	options: { readonly label: string },	77	options: { readonly label: string },
24	): BootedProcesses => {	78	): MonitoredBootedProcesses => {
25	const children: ChildProcess[] = [];	79	const children: ChildProcess[] = [];
26	let tearingDown = false;	80	let tearingDown = false;
		81	const unexpectedExits: Array<Promise<never>> = [];
27	for (const proc of procs) {	82	for (const proc of procs) {
28	const log = proc.logFile ? openSync(proc.logFile, "a") : undefined;	83	const log = proc.logFile ? openSync(proc.logFile, "a") : undefined;
29	const child = spawn(proc.cmd, [...proc.args], {	84	const child = spawn(proc.cmd, [...proc.args], {
@@ -36,11 +91,35 @@ export const bootProcesses = ( · 6 unmodified lines
36	// kill and squat the port into the NEXT invocation's waitForHttp.	91	// kill and squat the port into the NEXT invocation's waitForHttp.
37	detached: true,	92	detached: true,
38	});	93	});
39	child.on("exit", (code) => {	94	if (log !== undefined) closeSync(log);
40	if (code !== 0 && code !== null && !tearingDown) {	95	unexpectedExits.push(
41	console.error(`[e2e:${options.label}] ${proc.cmd} exited with ${code}`);	96	new Promise<never>((_resolve, reject) => {
42	}	97	child.once("error", (cause) => {
43	});	98	if (tearingDown) return;
		99	// oxlint-disable-next-line executor/no-promise-reject -- boundary: adapt the child-process error event to the startup race
		100	reject(
		101	new BootProcessExitError(
		102	[proc.cmd, ...proc.args].join(" "),
		103	child.exitCode,
		104	child.signalCode,
		105	`${readLogTail(proc.logFile)}\n${String(cause)}`.trim(),
		106	),
		107	);
		108	});
		109	child.once("exit", (code, signal) => {
		110	if (tearingDown) return;
		111	const error = new BootProcessExitError(
		112	[proc.cmd, ...proc.args].join(" "),
		113	code,
		114	signal,
		115	readLogTail(proc.logFile),
		116	);
		117	console.error(`[e2e:${options.label}] ${error.message}`);
		118	// oxlint-disable-next-line executor/no-promise-reject -- boundary: adapt the child-process exit event to the startup race
		119	reject(error);
		120	});
		121	}),
		122	);
44	children.push(child);	123	children.push(child);
45	}	124	}
46		125
@@ -77,28 +156,58 @@ export const bootProcesses = ( · 30 unmodified lines
77	}	156	}
78	},	157	},
79	pids: children.flatMap((child) => (child.pid === undefined ? [] : [child.pid])),	158	pids: children.flatMap((child) => (child.pid === undefined ? [] : [child.pid])),
		159	unexpectedExit: Promise.race(unexpectedExits),
80	};	160	};
81	};	161	};
82		162
		163	/**
		164	* Wait for a boot probe while also observing the spawned process tree. The
		165	* losing readiness probe is aborted, so an early process exit neither hides
		166	* behind the full HTTP timeout nor leaves a polling timer alive.
		167	*/
		168	export const waitForBoot = async <A>(
		169	processes: MonitoredBootedProcesses,
		170	ready: (signal: AbortSignal) => Promise<A>,
		171	): Promise<A> => {
		172	const controller = new AbortController();
		173	try {
		174	return await Promise.race([ready(controller.signal), processes.unexpectedExit]);
		175	} finally {
		176	controller.abort();
		177	}
		178	};
		179
83	export const waitForHttp = async (	180	export const waitForHttp = async (
84	url: string,	181	url: string,
85	options: { readonly timeoutMs?: number; readonly expectRedirect?: boolean } = {},	182	options: {
		183	readonly timeoutMs?: number;
		184	readonly expectRedirect?: boolean;
		185	readonly signal?: AbortSignal;
		186	} = {},
86	): Promise<void> => {	187	): Promise<void> => {
87	const deadline = Date.now() + (options.timeoutMs ?? 90_000);	188	const timeoutMs = options.timeoutMs ?? 90_000;
		189	const deadline = performance.now() + timeoutMs;
88	let lastError: unknown;	190	let lastError: unknown;
89	while (Date.now() < deadline) {	191	while (performance.now() < deadline) {
		192	options.signal?.throwIfAborted();
90	try {	193	try {
91	const response = await fetch(url, { redirect: "manual" });	194	const remainingMs = Math.max(1, deadline - performance.now());
		195	const probeTimeout = AbortSignal.timeout(Math.min(HTTP_PROBE_TIMEOUT_MS, remainingMs));
		196	const signal = options.signal
		197	? AbortSignal.any([options.signal, probeTimeout])
		198	: probeTimeout;
		199	const response = await fetch(url, { redirect: "manual", signal });
92	// During a cold vite compile /api/* falls back to the SPA's 200 HTML —	200	// During a cold vite compile /api/* falls back to the SPA's 200 HTML —
93	// expectRedirect waits for the real handler (302) instead.	201	// expectRedirect waits for the real handler (302) instead.
94	if (options.expectRedirect ? response.status === 302 : response.status < 500) return;	202	if (options.expectRedirect ? response.status === 302 : response.status < 500) return;
95	lastError = new Error(`status ${response.status}`);	203	lastError = new Error(`status ${response.status}`);
96	} catch (error) {	204	} catch (error) {
		205	options.signal?.throwIfAborted();
97	lastError = error;	206	lastError = error;
98	}	207	}
99	await new Promise((resolve) => setTimeout(resolve, 400));	208	await sleep(400, undefined, { signal: options.signal });
100	}	209	}
101	throw new Error(`timed out waiting for ${url}: ${String(lastError)}`);	210	throw new BootReadinessTimeoutError(url, timeoutMs, lastError);
102	};	211	};
103		212
104	/**	213	/**

e2e/setup/cloud.boot.ts+5−3

 // Vendored fork import (same pattern as mcporter).
 import { createEmulator } from "@executor-js/emulate";
-import { bootProcesses, waitForHttp } from "./boot";
+import { bootProcesses, waitForBoot, waitForHttp } from "./boot";
 import { AUTUMN_PLAN_SEED } from "./autumn-plans";
 import { E2E_EXECUTION_RATE_LIMIT } from "./execution-limits";
   try {
     const local = `http://127.0.0.1:${options.cloudPort}`;
-    await waitForHttp(local);
+    await waitForBoot(procs, (signal) => waitForHttp(local, { signal }));
     // The API plane is ready when login actually redirects to AuthKit.
-    await waitForHttp(`${local}/api/auth/login`, { expectRedirect: true });
+    await waitForBoot(procs, (signal) =>
+      waitForHttp(`${local}/api/auth/login`, { expectRedirect: true, signal }),
+    );
   } catch (error) {
     await teardown();
     throw error;

e2e/setup/cloud.globalsetup.ts+2−2

@@ -8,7 +8,7 @@ import { resolve } from "node:path"; · 7 unmodified lines
8		8
9	import { claimAndBoot } from "../src/ports";	9	import { claimAndBoot } from "../src/ports";
10	import { E2E_COOKIE_PASSWORD, E2E_WORKOS_CLIENT_ID } from "../targets/cloud";	10	import { E2E_COOKIE_PASSWORD, E2E_WORKOS_CLIENT_ID } from "../targets/cloud";
11	import { waitForHttp } from "./boot";	11	import { isBootReadinessTimeout, waitForHttp } from "./boot";
12	import { bootCloud } from "./cloud.boot";	12	import { bootCloud } from "./cloud.boot";
13	import { ensureE2eMcpSessionTimeoutEnv } from "./mcp-session-timeouts";	13	import { ensureE2eMcpSessionTimeoutEnv } from "./mcp-session-timeouts";
14	import { bootMotel, motelExporterEnv } from "./motel";	14	import { bootMotel, motelExporterEnv } from "./motel";
@@ -93,7 +93,7 @@ export default async function setup(): Promise<(() => Promise<void>) \| void> { · 78 unmodified lines
93	});	93	});
94	return { teardown: cloud.teardown, value: cloud };	94	return { teardown: cloud.teardown, value: cloud };
95	},	95	},
96	{ label: "cloud" },	96	{ label: "cloud", retryWhen: isBootReadinessTimeout },
97	);	97	);
98	// Publish the Autumn emulator URL to the test workers (they inherit this	98	// Publish the Autumn emulator URL to the test workers (they inherit this
99	// process's env): scenarios that assert on tracked usage yield the Autumn	99	// process's env): scenarios that assert on tracked usage yield the Autumn

e2e/setup/cloudflare.boot.ts+7−2

 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { bootProcesses, waitForHttp, type BootedProcesses } from "./boot";
+import { bootProcesses, waitForBoot, waitForHttp, type BootedProcesses } from "./boot";
 export const cloudflareDir = fileURLToPath(new URL("../../apps/host-cloudflare/", import.meta.url));
 const wranglerBin = fileURLToPath(
   try {
     // dev-auth: /api/account/me answers 200 as the dev admin once the worker is
     // up (workerd boot + esbuild + D1 schema bring-up take a beat on first run).
-    await waitForHttp(`http://127.0.0.1:${options.port}/api/account/me`, { timeoutMs: 120_000 });
+    await waitForBoot(procs, (signal) =>
+      waitForHttp(`http://127.0.0.1:${options.port}/api/account/me`, {
+        timeoutMs: 120_000,
+        signal,
+      }),
+    );
   } catch (error) {
     await procs.teardown();
     throw error;

e2e/setup/motel.ts+3−3

@@ -8,7 +8,7 @@ import { mkdirSync, rmSync } from "node:fs"; · 7 unmodified lines
8	import { join } from "node:path";	8	import { join } from "node:path";
9	import { fileURLToPath } from "node:url";	9	import { fileURLToPath } from "node:url";
10		10
11	import { bootProcesses, waitForHttp, type BootedProcesses } from "./boot";	11	import { bootProcesses, waitForBoot, waitForHttp, type MonitoredBootedProcesses } from "./boot";
12		12
13	export const MOTEL_PORT = 4796;	13	export const MOTEL_PORT = 4796;
14	export const MOTEL_URL = `http://127.0.0.1:${MOTEL_PORT}`;	14	export const MOTEL_URL = `http://127.0.0.1:${MOTEL_PORT}`;
@@ -28,7 +28,7 @@ export const bootMotel = async (): Promise<SuiteMotel \| null> => { · 13 unmodified lines
28	rmSync(dataDir, { recursive: true, force: true });	28	rmSync(dataDir, { recursive: true, force: true });
29	mkdirSync(dataDir, { recursive: true });	29	mkdirSync(dataDir, { recursive: true });
30		30
31	let procs: BootedProcesses \| null = null;	31	let procs: MonitoredBootedProcesses \| null = null;
32	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: optional infrastructure; a motel-less host still runs the suite	32	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: optional infrastructure; a motel-less host still runs the suite
33	try {	33	try {
34	procs = bootProcesses(	34	procs = bootProcesses(
@@ -45,7 +45,7 @@ export const bootMotel = async (): Promise<SuiteMotel \| null> => { · 10 unmodified lines
45	],	45	],
46	{ label: "motel" },	46	{ label: "motel" },
47	);	47	);
48	await waitForHttp(`${MOTEL_URL}/api/health`);	48	await waitForBoot(procs, (signal) => waitForHttp(`${MOTEL_URL}/api/health`, { signal }));
49	console.log(`[e2e] traces → suite motel at ${MOTEL_URL}`);	49	console.log(`[e2e] traces → suite motel at ${MOTEL_URL}`);
50	return { url: MOTEL_URL, teardown: procs.teardown };	50	return { url: MOTEL_URL, teardown: procs.teardown };
51	} catch (error) {	51	} catch (error) {

e2e/setup/sandbox-timeout.ts+28−0

@@ -0,0 +1,28 @@
	1	// The sandbox execution budget shared between a target's boot env and the
	2	// sandbox-deadline scenario, so they cannot drift apart (same pattern as
	3	// execution-limits.ts). The scenario proves a RATIO — approvals granted
	4	// inside their own windows survive an execution that outlives the sandbox's
	5	// absolute budget — so the budget's magnitude is free to shrink: on selfhost
	6	// the boot recipe passes E2E_SANDBOX_TIMEOUT_MS through to the server as
	7	// EXECUTOR_SANDBOX_TIMEOUT_MS and the scenario scales its approval delays to
	8	// match, turning a ~6-minute real-time wait into seconds. Targets that cannot
	9	// shrink the budget (cloud's dynamic-worker deadline is not env-tunable) run
	10	// against the production default and skip via their paused-session window
	11	// guard instead.
	12	export const E2E_SANDBOX_TIMEOUT_MS = 20_000;
	13
	14	export const SANDBOX_TIMEOUT_ENV = "E2E_SANDBOX_TIMEOUT_MS";
	15
	16	const PRODUCTION_SANDBOX_TIMEOUT_MS = 5 * 60_000;
	17
	18	const positiveMilliseconds = (raw: string \| undefined): number \| undefined => {
	19	if (!raw) return undefined;
	20	const parsed = Number(raw);
	21	if (!Number.isFinite(parsed) \|\| parsed <= 0) return undefined;
	22	return Math.floor(parsed);
	23	};
	24
	25	/** The sandbox budget the current target enforces: the harness override when
	26	* the target was booted with one, else the production default. */
	27	export const configuredSandboxTimeoutMs = (): number =>
	28	positiveMilliseconds(process.env[SANDBOX_TIMEOUT_ENV]) ?? PRODUCTION_SANDBOX_TIMEOUT_MS;

e2e/setup/selfhost.boot.ts+10−2

 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { bootProcesses, waitForHttp, type BootedProcesses } from "./boot";
+import { bootProcesses, waitForBoot, waitForHttp, type BootedProcesses } from "./boot";
 export const selfhostDir = fileURLToPath(new URL("../../apps/host-selfhost/", import.meta.url));
   /** vite --host (e.g. "0.0.0.0" to be tailnet-reachable). */
   readonly host?: string;
   readonly logFile?: string;
+  /** Shrink the sandbox execution budget (EXECUTOR_SANDBOX_TIMEOUT_MS) so
+   *  deadline scenarios prove their race in seconds. Omit for production. */
+  readonly sandboxTimeoutMs?: number;
 }
 export const bootSelfhost = async (options: SelfhostBootOptions): Promise<BootedProcesses> => {
           // instance at them; the hosted SSRF guard would otherwise block
           // outbound probes/dials to localhost. Hermetic test instance only.
           EXECUTOR_ALLOW_LOCAL_NETWORK: "true",
+          ...(options.sandboxTimeoutMs !== undefined
+            ? { EXECUTOR_SANDBOX_TIMEOUT_MS: String(options.sandboxTimeoutMs) }
+            : {}),
         },
         logFile: options.logFile,
       },
     // Probe via `localhost`, not 127.0.0.1 — without --host, vite binds the
     // resolver's first answer for localhost (::1 on macOS), so the IPv4
     // loopback literal never answers.
-    await waitForHttp(`http://localhost:${options.port}`);
+    await waitForBoot(procs, (signal) =>
+      waitForHttp(`http://localhost:${options.port}`, { signal }),
+    );
   } catch (error) {
     await procs.teardown();
     throw error;

e2e/setup/selfhost.globalsetup.ts+8−2

 import { claimAndBoot } from "../src/ports";
 import { SELFHOST_ADMIN } from "../targets/selfhost";
-import { waitForHttp } from "./boot";
+import { isBootReadinessTimeout, waitForHttp } from "./boot";
+import { E2E_SANDBOX_TIMEOUT_MS, SANDBOX_TIMEOUT_ENV } from "./sandbox-timeout";
 import { bootSelfhost } from "./selfhost.boot";
 import { RUNS_DIR } from "../src/scenario";
     [{ envVar: "E2E_SELFHOST_PORT", offset: 4, label: "selfhost vite dev" }],
     async (ports) => {
       const port = ports.E2E_SELFHOST_PORT!;
+      // Shrink the sandbox execution budget and publish the value to the test
+      // workers (spawned after this globalsetup, so they inherit the env): the
+      // sandbox-deadline scenario reads it to scale its approval delays.
+      process.env[SANDBOX_TIMEOUT_ENV] = String(E2E_SANDBOX_TIMEOUT_MS);
       // Fresh data dir per suite run — hermetic; in-suite isolation comes from
       // fresh identities, not resets (bootSelfhost wipes it).
       const procs = await bootSelfhost({
         webBaseUrl: `http://localhost:${port}`,
         admin: SELFHOST_ADMIN,
         logFile: bootLogFile,
+        sandboxTimeoutMs: E2E_SANDBOX_TIMEOUT_MS,
       });
       return { teardown: procs.teardown, value: procs };
     },
-    { label: "selfhost" },
+    { label: "selfhost", retryWhen: isBootReadinessTimeout },
   );
   return teardown;
 }

e2e/src/ports.ts+23−5

     return {
       ports,
       release: async () => {
+        // Values published by this claim are not operator pins. Clear them
+        // when the acquisition is released so a failed `claimAndBoot` attempt
+        // can genuinely probe and claim again instead of treating its own
+        // stale E2E_* value as an explicit override on every retry.
+        for (const claim of unpinned) {
+          const published = ports[claim.envVar];
+          if (published !== undefined && process.env[claim.envVar] === String(published)) {
+            delete process.env[claim.envVar];
+          }
+        }
         const held = heldLocks.get(block);
         if (!held) return;
         heldLocks.delete(block);
  * ephemeral) an outbound socket can still grab a just-released probe port before
  * the service binds it. When that happens the boot throws EADDRINUSE; we release
  * the block (freeing its lock so `claimPorts` walks past it) and re-claim + retry
- * up to `maxAttempts` times. Any non-EADDRINUSE boot failure — or exhausting the
+ * up to `maxAttempts` times. Callers may also classify another idempotent
- * retries — releases and rethrows, so a genuinely broken boot still surfaces.
+ * acquisition failure with `retryWhen` (for example, a bounded Vite readiness
+ * timeout). Unclassified failures and exhausted retries surface unchanged.
  *
  * `boot` receives the freshly claimed ports and must return its teardown; the
  * returned `teardown` chains the caller's teardown then releases the block.
 export const claimAndBoot = async <T>(
   claims: ReadonlyArray<PortClaim>,
   boot: (ports: Record<string, number>) => Promise<{ teardown: () => Promise<void>; value: T }>,
-  options: { readonly maxAttempts?: number; readonly label?: string } = {},
+  options: {
+    readonly maxAttempts?: number;
+    readonly label?: string;
+    /** Additional acquisition failures that are safe to retry from scratch. */
+    readonly retryWhen?: (error: unknown) => boolean;
+  } = {},
 ): Promise<{ ports: Record<string, number>; teardown: () => Promise<void>; value: T }> => {
   const maxAttempts = options.maxAttempts ?? 3;
   const label = options.label ?? "boot";
     } catch (error) {
       await release();
       lastError = error;
-      if (!isAddrInUse(error) || attempt === maxAttempts) throw error;
+      const retryable = isAddrInUse(error) || options.retryWhen?.(error) === true;
+      if (!retryable || attempt === maxAttempts) throw error;
       const collided = claims
         .map((claim) => ports[claim.envVar])
         .filter((port): port is number => port !== undefined)
         .join(", ");
+      const reason = isAddrInUse(error) ? `hit EADDRINUSE on port(s) ${collided}` : String(error);
       console.warn(
-        `[e2e] ${label} hit EADDRINUSE on port(s) ${collided} (attempt ${attempt}/${maxAttempts}); re-claiming a fresh block and retrying`,
+        `[e2e] ${label} acquisition failed (${reason}, attempt ${attempt}/${maxAttempts}); re-claiming a fresh block and retrying`,
       );
     }
   }

packages/hosts/mcp/src/stdio-integration.test.ts+57−3

@@ -4,8 +4,8 @@ import { StdioClientTransport as ModernStdioClientTransport } from "@modelcontex · 3 unmodified lines
4	import { Client } from "@modelcontextprotocol/sdk/client/index.js";	4	import { Client } from "@modelcontextprotocol/sdk/client/index.js";
5	import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";	5	import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
6	import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";	6	import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
7	import { Effect } from "effect";	7	import { Effect, Schema } from "effect";
8	import { mkdtempSync } from "node:fs";	8	import { mkdtempSync, readFileSync, rmSync } from "node:fs";
9	import { tmpdir } from "node:os";	9	import { tmpdir } from "node:os";
10	import { join, resolve } from "node:path";	10	import { join, resolve } from "node:path";
11		11
@@ -17,6 +17,60 @@ const stdioServer = { · 5 unmodified lines
17	command: "bun",	17	command: "bun",
18	args: ["run", stdioServerEntry],	18	args: ["run", stdioServerEntry],
19	};	19	};
		20	const decodeDaemonManifest = Schema.decodeUnknownSync(
		21	Schema.fromJsonString(Schema.Struct({ pid: Schema.Number })),
		22	);
		23
		24	const isProcessGroupAlive = (pid: number): boolean => {
		25	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: process liveness probing reports false after the test daemon is reaped
		26	try {
		27	process.kill(process.platform === "win32" ? pid : -pid, 0);
		28	return true;
		29	} catch {
		30	return false;
		31	}
		32	};
		33
		34	const signalProcessGroup = (pid: number, signal: NodeJS.Signals): void => {
		35	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Windows and pre-detach failures require a direct-pid fallback
		36	try {
		37	process.kill(process.platform === "win32" ? pid : -pid, signal);
		38	} catch {
		39	// oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates a daemon that exited between liveness check and signal
		40	try {
		41	process.kill(pid, signal);
		42	} catch {}
		43	}
		44	};
		45
		46	const stopAutoSpawnedDaemon = async (dataDir: string): Promise<void> => {
		47	// oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates startup that failed before publishing a manifest
		48	try {
		49	const manifest = decodeDaemonManifest(
		50	readFileSync(join(dataDir, "server-control", "server.json"), "utf8"),
		51	);
		52	if (!Number.isSafeInteger(manifest.pid) \|\| manifest.pid <= 0) return;
		53
		54	const pid = manifest.pid;
		55	signalProcessGroup(pid, "SIGTERM");
		56	const deadline = performance.now() + 10_000;
		57	while (isProcessGroupAlive(pid) && performance.now() < deadline) {
		58	await new Promise((resolve) => setTimeout(resolve, 50));
		59	}
		60	if (isProcessGroupAlive(pid)) signalProcessGroup(pid, "SIGKILL");
		61	} catch {
		62	// No manifest means there is no auto-started daemon to stop.
		63	}
		64	};
		65
		66	const withTempData = Effect.acquireRelease(
		67	Effect.sync(() => mkdtempSync(join(tmpdir(), "executor-mcp-test-"))),
		68	(dataDir) =>
		69	Effect.promise(async () => {
		70	await stopAutoSpawnedDaemon(dataDir);
		71	rmSync(dataDir, { recursive: true, force: true });
		72	}),
		73	);
20		74
21	describe("MCP stdio integration", () => {	75	describe("MCP stdio integration", () => {
22	it.effect(	76	it.effect(
@@ -25,7 +79,7 @@ describe("MCP stdio integration", () => { · 2 unmodified lines
25	Effect.gen(function* () {	79	Effect.gen(function* () {
26	// Fresh temp dir so the test doesn't migrate against the developer's	80	// Fresh temp dir so the test doesn't migrate against the developer's
27	// real ~/.executor/data.db.	81	// real ~/.executor/data.db.
28	const dataDir = mkdtempSync(join(tmpdir(), "executor-mcp-test-"));	82	const dataDir = yield* withTempData;
29	const transport = new StdioClientTransport({	83	const transport = new StdioClientTransport({
30	command: "bun",	84	command: "bun",
31	args: ["run", cliEntry, "mcp", "--scope", testScope],	85	args: ["run", cliEntry, "mcp", "--scope", testScope],

Speed up and stabilize CI e2e (#1551)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code