Repair the self-host e2e suite and run it in CI

[RhysSullivan]

Why

The self-host e2e project (vitest --project selfhost) has never run in CI: the test job filters e2e out (turbo run test --filter=!@executor-js/e2e) and the only e2e job runs a single stdio scenario on push. With nothing exercising it, the suite drifted red as the app moved on. A full run showed 9 of 56 files failing, none of them a real regression in the tested behavior. This repairs them and adds a CI gate so it stays honest.

Fixes

Stale selectors (the connect modal now uses an affixed credential field). The single-input bearer credential input renders an "Authorization: Bearer " affix with placeholder token, not the old paste the value / token. Updated the selectors, scoped to the dialog: scenarios/connect-handoff.test.ts, scenarios/connect-handoff-session.test.ts, selfhost/auth-methods-ui.test.ts.

Racy action-bar position read. scenarios/openapi-add-integration-action-bar.test.ts measured the Cancel button "in flight", but the floating action bar unmounts the instant the router navigates, so the read blocked the full timeout. The single-node counts already cover the reported doubled/ghosted-button regression; the step now asserts the submit commits and lands on the integration.

Shared-admin connection count. scenarios/api-tools.test.ts asserted a fresh identity has zero connections. That holds only on isolated-identity targets; self-host shares the bootstrap admin, so other scenarios' connections legitimately appear. The list call still runs everywhere (proving the endpoint); the zero-count assertion is gated off self-host per e2e/AGENTS.md.

Multi-tenant-only 404. scenarios/org-slug-routing.test.ts expected an unknown org slug to 404. That is a multi-tenant contract: self-host is single-tenant, /account/me always returns the instance org, and the slug is cosmetic. Gated the 404 step off self-host.

Cloud-shaped toolkit URL. selfhost/toolkits-mcp.test.ts connected to /e2e-org/mcp/toolkits/.... Self-host advertises the bare /mcp/toolkits/... (org prefixing is a cloud convention), and the server's RFC 9728 protected-resource doc reports the bare resource, which MCP SDK 1.29's stricter selectResourceURL requires the client URL to match. Connect to the URL self-host actually publishes.

Quarantined (tracked follow-up). scenarios/microsoft-emulator.test.ts and the Microsoft leg of scenarios/oauth-client-handoff.test.ts are skipped with a documented reason. microsoft.addGraph only accepts the canonical Microsoft Graph spec in the streamable block-YAML profile (it structurally splits the 37MB doc to avoid OOMing the 128MB Workers isolate) and hard-errors on anything else; the emulator serves a small spec outside that profile. Making these pass needs the emulator to serve a block-YAML Graph spec (or a non-Workers compile path), which is separate work. A skip option was added to the scenario helper so the quarantine stays visible in the report rather than silently deleted.

CI

New E2E (self-host) job in ci.yml: boots the self-host target via its globalsetup (no external infra), installs Playwright Chromium, and runs bun run test:selfhost on pull requests and push. If the browser scenarios prove flaky on CI, gate it to push-only like e2e-local, or add a retry.

New coverage

selfhost/oauth-popup-callback-org-state.test.ts: a browser-free regression test for the org-scoped OAuth popup callback (the bug fixed in #1235). It drives the org-context flow, asserts the provider state is wrapped, then does an authenticated GET of the callback and asserts it completes ("Connected") instead of "OAuth session expired or not found". No Playwright, so it is a good candidate to gate this class of regression cheaply.

Verification

• Full self-host suite locally: 55 files pass, 1 skipped; 72 tests pass, 4 skipped, 0 fail.
• oxlint --deny-warnings, oxfmt --check, and turbo run typecheck (42/42) pass.

Note: the cross-target scenarios also run on the cloud target, which I could not boot locally. The org-slug and api-tools changes branch on the target so cloud behavior is unchanged, and the Microsoft quarantine applies on both targets.

Relationship to #1235

The first commit cherry-picks #1235's OAuth popup fix (authorship preserved) so the OAuth-callback scenarios and the new test above are green and CI passes. If #1235 merges first, rebasing this branch drops the duplicate commit.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	514bad6	Commit Preview URL Branch Preview URL	Jul 01 2026, 03:16 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	514bad6	Jul 01 2026, 03:17 AM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1239.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1239.executor-e2e.workers.dev/mcp
Deployed commit	514bad6

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[greptile-apps]

Greptile Summary

This PR repairs the self-host e2e suite (9 of 56 files were failing) and adds a new CI gate so the suite stays honest on every PR. The changes fall into two categories: test fixes (stale selectors, racy position check, target-conditional assertions, wrong toolkit URL, quarantined Microsoft tests) and a functional bug fix in oauth-popup.ts that unwraps the org-slug-wrapped OAuth callback state before passing the raw session token to complete.

• Core fix (packages/core/api/src/oauth-popup.ts): runOAuthCallback now calls decodeOAuthCallbackState on the URL state parameter and extracts the inner raw token before passing it to complete and embedding it as sessionId in the popup result; plain tokens (no wrapper) are unaffected via the null-coalescing fallback.
• New selfhost regression test (e2e/selfhost/oauth-popup-callback-org-state.test.ts): a browser-free HTTP journey that drives the org-context OAuth popup flow end-to-end and asserts "Connected" is returned instead of "OAuth session expired or not found".
• CI (ci.yml): new e2e-selfhost job runs on PRs and push, booting the dev server via globalsetup and exercising both scenarios/** and selfhost/**.

Confidence Score: 4/5

Safe to merge; the oauth-popup.ts fix is narrow, backward-compatible, and covered by both a new unit test and a new end-to-end regression test.

All thirteen changed files are in good shape. The core oauth-popup.ts logic is straightforward — a null-coalescing unwrap with a unit test and an e2e regression test guarding it. The e2e suite fixes are mechanical selector/URL/assertion updates with clear rationale. The two observations (hardcoded credentials and the missing CI timeout) are quality notes, not correctness issues.

.github/workflows/ci.yml for the missing job timeout; e2e/selfhost/oauth-popup-callback-org-state.test.ts for the hardcoded OAuth test-server credentials.

Important Files Changed

Filename	Overview
packages/core/api/src/oauth-popup.ts	Core fix: decodes the org-slug-wrapped OAuth state to extract the raw session token before passing it to complete and embedding it in the popup result. Correct and well-tested by the accompanying unit test.
packages/core/api/src/oauth-popup.test.ts	Adds a unit test covering the wrapped-state unwrapping path; verifies both the complete callback receives the raw token and the popup HTML uses it as sessionId.
e2e/selfhost/oauth-popup-callback-org-state.test.ts	New black-box regression test that drives the full org-scoped OAuth callback round-trip; well-structured but relies on hardcoded alice:password credentials from the OAuth test server.
e2e/src/scenario.ts	Adds skip option to ScenarioOptions; uses it.skip correctly — callback is never run, and the reason string is self-documenting in the source.
.github/workflows/ci.yml	Adds e2e-selfhost CI job that runs on PRs and push; uses bun run bootstrap correctly for dev-server prerequisites, but lacks a timeout-minutes guard.
e2e/scenarios/api-tools.test.ts	Correctly gates the zero-connection assertion off selfhost, matching the isolation rule in AGENTS.md; the endpoint call itself still exercises the route on all targets.
e2e/scenarios/openapi-add-integration-action-bar.test.ts	Removes the racy in-flight position read; the existing single-node count assertions still cover the ghost-button regression. Change is justified and the regression coverage is preserved.
e2e/scenarios/microsoft-emulator.test.ts	Quarantines the blocked Microsoft scenario with a self-documenting skip reason; no logic changes to the test body.
e2e/scenarios/oauth-client-handoff.test.ts	Quarantines only the Microsoft handoff scenario with skip; the two non-Microsoft OAuth client scenarios in the same file are unaffected.
e2e/selfhost/toolkits-mcp.test.ts	Fixes the toolkit URL to use the bare /mcp/toolkits/… path self-host actually serves, matching RFC 9728 protected-resource metadata and MCP SDK 1.29's stricter URL validation.
e2e/scenarios/org-slug-routing.test.ts	Correctly gates the 404-on-unknown-slug step off selfhost; the behaviour difference (single-tenant canonicalization vs. multi-tenant 404) is accurately documented inline.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant App as Executor App (selfhost)
    participant Provider as OAuth Provider (test server)
    participant Callback as /oauth/callback

    App->>Provider: "GET /authorize?state=wrapped({state:"raw-token",orgSlug:"default"})"
    Note over App,Provider: State is org-slug-wrapped envelope

    Provider-->>App: 302 → consent page
    App->>Provider: POST /authorize (Basic auth)
    Provider-->>Callback: "302 → /oauth/callback?state=wrapped&code=code"
    Note over Callback: decodeOAuthCallbackState(wrapped) → {state:"raw-token"}

    Callback->>App: "complete({state: "raw-token", code})"
    Note over Callback: Before fix: passed wrapped state → session lookup failed
    App-->>Callback: OAuth result (access token)
    Callback-->>Provider: 200 HTML (Connected, sessionId: raw-token)

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant App as Executor App (selfhost)
    participant Provider as OAuth Provider (test server)
    participant Callback as /oauth/callback

    App->>Provider: "GET /authorize?state=wrapped({state:"raw-token",orgSlug:"default"})"
    Note over App,Provider: State is org-slug-wrapped envelope

    Provider-->>App: 302 → consent page
    App->>Provider: POST /authorize (Basic auth)
    Provider-->>Callback: "302 → /oauth/callback?state=wrapped&code=code"
    Note over Callback: decodeOAuthCallbackState(wrapped) → {state:"raw-token"}

    Callback->>App: "complete({state: "raw-token", code})"
    Note over Callback: Before fix: passed wrapped state → session lookup failed
    App-->>Callback: OAuth result (access token)
    Callback-->>Provider: 200 HTML (Connected, sessionId: raw-token)

Loading

_{Reviews (1): Last reviewed commit: "test(e2e): repair self-host scenarios an..." | Re-trigger Greptile}

[greptile-apps]

Hardcoded test-server credentials

The Basic auth header for the OAuth consent step hardcodes alice:password. If serveOAuthTestServer ever changes its built-in test users (or if a future implementation randomises them), this step will silently fail with a 401 and the assertion on consent.status will fire with a cryptic mismatch. The credentials should ideally come from a constant exported by the test server utility, or at minimum from a named constant at the top of the file to make the coupling visible.

[greptile-apps]

No timeout-minutes on the new job

The e2e-selfhost job boots a dev server via globalsetup before running the suite. If the server fails to start or hangs, the job will block until GitHub Actions' 6-hour default, holding up the queue and burning CI minutes. The existing e2e-local job has the same omission, but adding a timeout-minutes (e.g. 30) here would bound the blast radius for a new job that is now running on every PR.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1239

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1239

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1239

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1239

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1239

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1239

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1239

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1239

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1239

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1239

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1239

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1239

executor

npm i https://pkg.pr.new/executor@1239

commit: 514bad6