Merge branch 'v2/main' into v2/fix/1919-rfc6570-uri-template-expansion

clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts

@@ -20,6 +20,7 @@ import { serve } from "@hono/node-server";
 import type { ServerType } from "@hono/node-server";
 import type pinoType from "pino";
 import {
+  closeAbortedStream,
   createRemoteApp,
   requestIdForSendWait,
   mcpParamHeadersOnly,
@@ -1107,4 +1108,37 @@ describe("server.ts supplemental coverage", () => {
       }
     });
   });
+  describe("closeAbortedStream", () => {
+    it("owns a rejected close instead of letting it go unhandled", async () => {
+      // The whole reason the helper exists. Both SSE `onAbort` listeners run
+      // after the peer is already gone, so `close()` can lose the race and
+      // reject — and Hono invokes abort subscribers with a bare
+      // `subscriber()`, so nothing upstream would catch it. A regression here
+      // does not fail at the call site; it fails the whole vitest run from
+      // wherever the rejection happens to surface.
+      const rejected = Promise.reject(new Error("peer already gone"));
+      const unhandled: unknown[] = [];
+      const onUnhandled = (err: unknown) => unhandled.push(err);
+      process.on("unhandledRejection", onUnhandled);
+      try {
+        expect(closeAbortedStream({ close: () => rejected })).toBeUndefined();
+        // An unhandledRejection fires on a later macrotask, not this one.
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      } finally {
+        process.off("unhandledRejection", onUnhandled);
+      }
+      expect(unhandled).toEqual([]);
+    });
+
+    it("returns without waiting on a close that resolves", async () => {
+      let closed = false;
+      closeAbortedStream({
+        close: async () => {
+          closed = true;
+        },
+      });
+      await Promise.resolve();
+      expect(closed).toBe(true);
+    });
+  });
 });

clients/web/src/test/integration/mcp/remote/servers-route.test.ts

@@ -496,6 +496,75 @@ describe("/api/servers routes", () => {
       expect(res.status).toBe(400);
     });
 
+    // #1906 — the endpoint overrides travel as plain strings and land under
+    // `oauth` on disk beside the credentials.
+    it("persists the oauth endpoint overrides on POST", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "endpointoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "https://staging.test/authorize",
+            oauthTokenUrl: "https://staging.test/token",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      const stored = readConfig(h.configPath).mcpServers.endpointoverrides;
+      expect(stored?.oauth).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+
+    it("drops an empty oauth endpoint override rather than writing it", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "blankoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "",
+            oauthTokenUrl: "",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      expect(
+        readConfig(h.configPath).mcpServers.blankoverrides,
+      ).not.toHaveProperty("oauth");
+    });
+
+    it("rejects a non-string oauthTokenUrl payload", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "badtokenurl",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthTokenUrl: 42,
+          },
+        }),
+      });
+      expect(res.status).toBe(400);
+    });
+
     it("updates Inspector-extension fields at the top level on PUT", async () => {
       writeFileSync(
         h.configPath,

clients/web/src/test/integration/server/server-auto-open.test.ts

@@ -0,0 +1,149 @@
+/**
+ * `autoOpen` browser launch (#1959).
+ *
+ * Both servers call `openBrowser` from a synchronous callback — the prod
+ * server from `serve()`'s listen callback, the dev plugin from `logBanner` —
+ * so a rejection there has nowhere to go. On a headless or otherwise
+ * browser-less host that rejection is the *ordinary* outcome, not an edge
+ * case, and before #1959 it escaped as an unhandled rejection from a server
+ * that had already started listening and printed a perfectly usable URL.
+ *
+ * The helper is shared precisely so this behavior has one implementation to
+ * pin. The unit tests below cover it directly; the end-to-end test then
+ * proves the prod server routes through it and survives the failure. The dev
+ * plugin is not booted here — it returns early under `VITEST` by design (see
+ * `vite-hono-plugin.ts`) — but it calls the same tested helper.
+ */
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { createServer } from "node:net";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { WebServerConfig } from "../../../../server/web-server-config.js";
+import type { WebServerHandle } from "../../../../server/types.js";
+
+const openMock = vi.hoisted(() => vi.fn());
+vi.mock("open", () => ({ default: openMock }));
+
+// Imported after the mock is registered so both bind to the double.
+const { openBrowser } = await import("../../../../server/web-server-config.js");
+const { startHonoServer } = await import("../../../../server/server.js");
+
+const WARNING = "Could not open a browser automatically:";
+
+async function findFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.unref();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      if (addr && typeof addr === "object") {
+        const { port } = addr;
+        srv.close(() => resolve(port));
+      } else {
+        srv.close(() => reject(new Error("Could not resolve a free port")));
+      }
+    });
+  });
+}
+
+/** An unhandledRejection fires on a later macrotask than the rejection. */
+async function settle() {
+  await new Promise((resolve) => setTimeout(resolve, 50));
+}
+
+const INDEX_HTML =
+  "<!doctype html><html><body><div id=root></div></body></html>";
+
+let handle: WebServerHandle | undefined;
+let staticRoot: string | undefined;
+
+afterEach(async () => {
+  await handle?.close();
+  handle = undefined;
+  if (staticRoot) await rm(staticRoot, { recursive: true, force: true });
+  staticRoot = undefined;
+  openMock.mockReset();
+  vi.restoreAllMocks();
+});
+
+describe("openBrowser", () => {
+  it("owns a rejection and warns instead of letting it go unhandled", async () => {
+    // Suppress the expected warning rather than letting it pollute the run,
+    // but assert on it — the warning IS the user-visible half of the fix.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const unhandled: unknown[] = [];
+    const onUnhandled = (err: unknown) => unhandled.push(err);
+    process.on("unhandledRejection", onUnhandled);
+    try {
+      openMock.mockRejectedValue(new Error("no browser on this host"));
+      expect(openBrowser("http://127.0.0.1:6274")).toBeUndefined();
+      await settle();
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+    expect(unhandled).toEqual([]);
+    expect(warn).toHaveBeenCalledWith(WARNING, expect.any(Error));
+  });
+
+  it("stays quiet when the browser opens", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    openMock.mockResolvedValue(undefined);
+    openBrowser("http://127.0.0.1:6274");
+    await settle();
+    expect(openMock).toHaveBeenCalledWith("http://127.0.0.1:6274");
+    expect(warn).not.toHaveBeenCalledWith(WARNING, expect.anything());
+  });
+});
+
+describe("startHonoServer autoOpen", () => {
+  it("keeps serving when the browser cannot be opened", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const unhandled: unknown[] = [];
+    const onUnhandled = (err: unknown) => unhandled.push(err);
+    process.on("unhandledRejection", onUnhandled);
+
+    try {
+      openMock.mockRejectedValue(new Error("no browser on this host"));
+
+      staticRoot = await mkdtemp(join(tmpdir(), "inspector-autoopen-"));
+      await writeFile(join(staticRoot, "index.html"), INDEX_HTML, "utf-8");
+      const port = await findFreePort();
+      const baseUrl = `http://127.0.0.1:${port}`;
+      const config: WebServerConfig = {
+        port,
+        hostname: "127.0.0.1",
+        authToken: "auto-open-token",
+        dangerouslyOmitAuth: false,
+        initialMcpConfig: null,
+        mcpConfigPath: undefined,
+        writable: true,
+        initialServers: null,
+        storageDir: undefined,
+        allowedOrigins: [baseUrl],
+        sandboxPort: 0,
+        sandboxHost: "127.0.0.1",
+        logger: undefined,
+        autoOpen: true,
+        staticRoot,
+      };
+      handle = await startHonoServer(config);
+
+      // `serve()`'s listen callback fires after startHonoServer resolves.
+      for (let i = 0; i < 100 && openMock.mock.calls.length === 0; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      await settle();
+
+      expect(openMock).toHaveBeenCalledWith(expect.stringContaining(baseUrl));
+      expect(unhandled).toEqual([]);
+      expect(warn).toHaveBeenCalledWith(WARNING, expect.any(Error));
+      // The point of warning rather than throwing: the server is still up.
+      const res = await fetch(`${baseUrl}/`);
+      expect(res.status).toBe(200);
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+  });
+});