Function runApproval

e2e/desktop/local-auth-mcp.test.ts:114–194

(runDir: string)

);

const runApproval = async (runDir: string) => {
  const home = mkdtempSync(join(tmpdir(), "executor-desktop-mcp-"));
  const app = await launchDesktop(home, runDir);
  let stepIndex = 0;
  try {
    const page = await app.firstWindow({ timeout: 120_000 });
    const step = async (label: string, body: () => Promise<void>) => {
      await body();
      stepIndex += 1;
      await page.screenshot({
        path: join(
          runDir,
          `${String(stepIndex).padStart(2, "0")}-${label.toLowerCase().replace(/[^a-z0-9]+/g, "-")}.png`,
        ),
      });
    };

    await step("app boots into the web console", async () => {
      await page.getByText("Settings").first().waitFor({ timeout: 120_000 });
    });

    const { origin, token } = readSidecar(home);

    // Plant a require_approval policy so the gated tool elicits (bearer-authed —
    // the test process is not the app, so it carries the token explicitly).
    const policyRes = await fetch(`${origin}/api/policies`, {
      method: "POST",
      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
      body: JSON.stringify({
        owner: "org",
        pattern: APPROVAL_TARGET_TOOL,
        action: "require_approval",
      }),
    });
    expect(policyRes.ok, `policy create ok (${policyRes.status})`).toBe(true);

    const mcp = new Client({ name: "e2e-desktop-approve", version: "1.0.0" }, { capabilities: {} });
    const transport = new StreamableHTTPClientTransport(
      new URL(`${origin}/mcp?elicitation_mode=browser`),
      { requestInit: { headers: { authorization: `Bearer ${token}` } } },
    );
    await mcp.connect(transport);

    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the test owns the MCP transport lifecycle
    try {
      const executed = await mcp.callTool({ name: "execute", arguments: { code: EXECUTE_CODE } });
      const paused = executed.structuredContent as {
        status: string;
        executionId: string;
        approvalUrl: string;
      };
      expect(paused.status, "execute paused for browser approval").toBe("user_approval_required");

      await step("approve the gated tool in the desktop renderer", async () => {
        // The renderer carries no token; the main process injects the bearer for
        // THIS window. No ?_token (bootstrap no-ops on desktop).
        await page.goto(paused.approvalUrl, { waitUntil: "domcontentloaded" });
        await page.getByRole("button", { name: "Approve" }).waitFor({ timeout: 30_000 });