test(e2e): repair or quarantine the cloud scenarios that drifted on main

The cloud e2e project never gated CI either, so ten scenarios rotted.
Refresh the four whose product behavior moved intentionally:
- connect-card-ssr-origin: install URLs are org-slug-scoped since the
  org-slug console URLs change (#974); accept the slug form.
- connection-owner-isolation: /api/auth/switch-organization was deleted
  with cookie-based org switching (#1000); switch orgs the way the web
  client does, via the x-executor-organization selector header.
- oauth-connections: the popup-state fix (#1235) envelopes the callback
  state as base64url JSON; decode it and assert the inner state + orgSlug.
- unauthenticated-skeleton: the 404 page shipped as a standalone page in
  the same commit as the shell-framed assertion (#986); assert the page
  it actually renders.

Quarantine the six that need product/harness work, each with a reason:
mcp-browser-approval-org-scope + the two browser-approval scenarios
(cloud-only: the mcporter browser-approval completion never lands),
cli-device-login (device-flow terminal never reaches the emulator), and
run-panel-auto-approve (autoApprove leaves the run paused; never green
since the feature landed in #1183).

Author: RhysSullivan

e2e/cloud/cli-device-login.test.ts

@@ -24,9 +24,24 @@ import { CLOUD_BASE_URL } from "../targets/cloud";
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const CLI_ENTRY = join(REPO_ROOT, "apps", "cli", "src", "main.ts");
 
+// The WorkOS emulator's compiled dist (@executor-js/emulate) has zero
+// references to device_authorization/device_code/verification_uri anywhere —
+// it does not implement the OAuth 2.0 Device Authorization Grant (RFC 8628)
+// that `executor login`'s device flow depends on (apps/cli/src/device-login.ts
+// posts to a `deviceAuthorizationEndpoint` discovered via
+// `GET /api/auth/cli-login` and expects `user_code`/`verification_uri[_complete]`
+// back). Against the real WorkOS this works; against the emulator the device
+// endpoint doesn't exist, so the CLI never prints a `user_code=` URL and both
+// scenarios below time out / exit non-zero waiting for it. Real gap in the
+// emulator (a separate repo, out of e2e scope here), not a stale test or an
+// app regression — suspect: @executor-js/emulate's WorkOS emulator lacking
+// RFC 8628 device-authorization support.
+const CLI_DEVICE_FLOW_SKIP =
+  "the WorkOS emulator doesn't implement RFC 8628 device-authorization (no device_code/verification_uri anywhere in its compiled dist), so `executor login`'s device flow never gets a user_code to print — suspect: @executor-js/emulate's WorkOS emulator";
+
 scenario(
   "CLI · executor login device flow → authenticated /api call",
-  { timeout: 180_000 },
+  { timeout: 180_000, skip: CLI_DEVICE_FLOW_SKIP },
   Effect.scoped(
     Effect.gen(function* () {
       const target = yield* Target;
@@ -182,7 +197,7 @@ const runCliLogin = (
 
 scenario(
   "CLI · two accounts on the same host get separate profiles",
-  { timeout: 120_000 },
+  { timeout: 120_000, skip: CLI_DEVICE_FLOW_SKIP },
   Effect.gen(function* () {
     const target = yield* Target;
     if (target.name !== "cloud") return;

e2e/cloud/connect-card-ssr-origin.test.ts

@@ -66,7 +66,14 @@ scenario(
     expect(endpoint!, "…and not the desktop/CLI default that used to flash").not.toContain(
       "127.0.0.1:4000",
     );
-    // It's still the org-scoped path the user actually needs.
-    expect(endpoint!, "the install URL stays org-scoped").toMatch(/\/org_[^/]+\/mcp$/);
+    // It's still the org-scoped path the user actually needs. Since #974
+    // ("Org-slug console URLs across cloud, self-host, and cloudflare hosts"),
+    // the install card prints the org's URL SLUG (e.g. /org-user-xxx/mcp), not
+    // the legacy WorkOS org_<id> form — mount.ts's classifyMcpPath still
+    // accepts either shape, but the slug form is what ships, so accept both
+    // rather than pinning on the retired id-only shape.
+    expect(endpoint!, "the install URL stays org-scoped").toMatch(
+      /\/(?:org_[^/]+|[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\/mcp$/,
+    );
   }),
 );

e2e/cloud/connection-owner-isolation.test.ts

@@ -114,13 +114,27 @@ const createAnotherOrg = (target: TargetShape, identity: Identity, name: string)
     return withRefreshedSession(identity, response);
   });
 
-/** Switch this account's active org; returns the identity bound to it. */
-const switchOrg = (target: TargetShape, identity: Identity, organizationId: string) =>
-  Effect.gen(function* () {
-    const response = yield* postJson(target, "/api/auth/switch-organization", identity, {
-      organizationId,
-    });
-    return withRefreshedSession(identity, response);
+// `/api/auth/switch-organization` (session-cookie-based org switching) was
+// removed in #1000 (commit 1f9bfe06b): the URL is now the scope authority, not
+// the session. A request picks its active org via the `x-executor-organization`
+// header (apps/cloud/src/auth/organization.ts's `ORG_SELECTOR_HEADER`,
+// `EXECUTOR_ORG_SELECTOR_HEADER = "x-executor-organization"` in
+// packages/core/sdk/src/server-connection.ts), falling back to the session's
+// own org when absent. The header is a SELECTOR, not a trust boundary — the
+// server re-checks live membership — so attaching it directly to the identity
+// here is exactly what the real web client does from the console URL's slug.
+const ORG_SELECTOR_HEADER = "x-executor-organization";
+
+/** Switch this account's active org; returns the identity scoped to it via
+ *  the per-request org-selector header (no session mutation involved). */
+const switchOrg = (
+  _target: TargetShape,
+  identity: Identity,
+  organizationId: string,
+): Effect.Effect<Identity> =>
+  Effect.succeed({
+    ...identity,
+    headers: { ...identity.headers, [ORG_SELECTOR_HEADER]: organizationId },
   });
 
 /** The org this identity's session is currently bound to. */

e2e/cloud/mcp-browser-approval-org-scope.test.ts

@@ -116,7 +116,20 @@ const approvalApiRequest =
 
 scenario(
   "MCP approval · URL-scoped org survives approval while the session cookie points elsewhere",
-  { timeout: 180_000 },
+  {
+    timeout: 180_000,
+    // `mcpSession.listTools()` drives mcporter's OWN generic MCP-session OAuth
+    // login (its consentStrategy hook against the WorkOS emulator's
+    // /oauth2/authorize), unrelated to the org-scoped-approval-URL behavior
+    // this scenario actually tests. That handshake hangs and mcporter's own
+    // code-wait times out after 60s ("OAuth authorization required ...
+    // Waiting for browser approval..." -> McpError -32001), before any of
+    // this scenario's assertions run. Same root cause as
+    // scenarios/browser-approval.test.ts's cloud-only skip. Real
+    // harness/product defect (suspect: cloud's mcporter<->WorkOS-emulator
+    // OAuth session flow), needs a live-debugged fix, tracked separately.
+    skip: "cloud's mcporter MCP-session OAuth login (listTools' consentStrategy handshake against the WorkOS emulator) hangs and times out after 60s, before this scenario's org-scope assertions ever run — suspect: cloud mcporter<->WorkOS-emulator OAuth session flow",
+  },
   Effect.gen(function* () {
     const target = yield* Target;
     const api = yield* Api;

e2e/cloud/oauth-connections.test.ts

@@ -194,9 +194,18 @@ scenario(
       );
       expect(consent.status, "granting consent redirects back to the product").toBe(302);
       const callback = new URL(consent.headers.get("location") ?? "");
-      expect(callback.searchParams.get("state"), "the callback carries the session's state").toBe(
+      // Since #1235 ("preserve OAuth popup session state", commit 1d6363f8) the
+      // provider-facing state is a base64url JSON envelope
+      // ({ state, orgSlug } — packages/core/sdk/src/oauth.ts) so the callback
+      // edge can pick the right organization before completing the flow; the
+      // raw session state lives inside it, not on the wire directly.
+      const envelope = JSON.parse(
+        Buffer.from(callback.searchParams.get("state") ?? "", "base64url").toString("utf8"),
+      ) as { state: string; orgSlug: string };
+      expect(envelope.state, "the callback's envelope carries the session's state").toBe(
         String(started.state),
       );
+      expect(envelope.orgSlug, "the envelope carries the org the flow started in").toBeTruthy();
       const code = callback.searchParams.get("code");
       expect(code, "the callback carries an authorization code").not.toBeNull();
 

e2e/cloud/unauthenticated-skeleton.test.ts

@@ -162,15 +162,20 @@ scenario(
         await page.goto("/this-page-does-not-exist", { waitUntil: "commit" });
         await page.getByText("Page not found").waitFor();
       });
-      // The 404 renders INSIDE the real shell (nav + identity), not as a
-      // text-free full-page silhouette. Per-section skeletons in the sidebar
-      // (the integration list mid-fetch) are honest loading states and fine.
+      // An unmatched path renders the ROOT route's `notFoundComponent`
+      // (apps/cloud/src/routes/__root.tsx's `NotFoundPage`), which TanStack
+      // Router mounts standalone — outside AuthGate's Shell tree entirely, by
+      // design (see AuthGate's own `urlOrgSlug ? <NotFoundPage /> : ...`
+      // comment: "framed by nothing — the user isn't 'in' any org here"). It
+      // was never shell-framed; assert its actual bare shape instead of a
+      // "Policies" link and shell chrome that no code path has produced since
+      // NotFoundPage was introduced (#986, commit 5c21c8f9).
       expect(
-        await page.getByRole("link", { name: "Policies" }).isVisible(),
-        "the real shell frames the 404",
-      ).toBe(true);
+        await page.locator('[data-slot="skeleton"]').count(),
+        "the real 404 page, not a loading skeleton",
+      ).toBe(0);
       expect(
-        await page.getByText("Go home").isVisible(),
+        await page.getByRole("link", { name: "Go home" }).isVisible(),
         "with the 404 page's action, not a dead end",
       ).toBe(true);
     });

e2e/scenarios/browser-approval.test.ts

@@ -28,6 +28,24 @@ import type { Identity } from "../src/target";
 
 const coreApi = composePluginApi([] as const);
 
+// Cloud-only: `session.listTools()` drives mcporter's OWN generic MCP-session
+// OAuth login (its consentStrategy hook against the WorkOS emulator's
+// /oauth2/authorize, unrelated to the require_approval gate this file is
+// actually testing). That handshake hangs and mcporter's own code-wait times
+// out after 60s ("OAuth authorization required ... Waiting for browser
+// approval..." -> McpError -32001), before either scenario below reaches its
+// approval-gate assertions. Selfhost's forcedMcpConsent (Better Auth's own
+// OAuth server) and cloudflare's dev-auth direct client (no OAuth at all, see
+// src/surfaces/mcp.ts's `target.name === "cloudflare"` branch) don't go
+// through this path, so only cloud is quarantined here — this is a real
+// harness/product defect (suspect: cloud's mcporter<->WorkOS-emulator OAuth
+// session flow), not a stale assertion; needs a live-debugged fix, tracked
+// separately.
+const CLOUD_MCP_OAUTH_HANG_SKIP =
+  process.env.E2E_TARGET === "cloud"
+    ? "cloud's mcporter MCP-session OAuth login (listTools' consentStrategy handshake against the WorkOS emulator) hangs and times out after 60s, before the require_approval flow under test ever runs — suspect: cloud mcporter<->WorkOS-emulator OAuth session flow"
+    : undefined;
+
 // Gating a built-in read tool keeps the scenario hermetic — no external server
 // to host a destructive tool. The gate, not the tool, is what's under test: any
 // action the engine pauses on flows through the same approval path.
@@ -62,7 +80,7 @@ const decideInBrowser = (
 
 scenario(
   "MCP · a gated action approved in the browser runs to completion",
-  { timeout: 180_000 },
+  { timeout: 180_000, skip: CLOUD_MCP_OAUTH_HANG_SKIP },
   Effect.gen(function* () {
     const target = yield* Target;
     const api = yield* Api;
@@ -112,7 +130,7 @@ scenario(
 
 scenario(
   "MCP · a gated action declined in the browser is blocked",
-  { timeout: 180_000 },
+  { timeout: 180_000, skip: CLOUD_MCP_OAUTH_HANG_SKIP },
   Effect.gen(function* () {
     const target = yield* Target;
     const api = yield* Api;

e2e/scenarios/run-panel-auto-approve.test.ts

@@ -36,9 +36,29 @@ return await tools.executor.coreTools.policies.create({
 });
 `;
 
+// `autoApprove: true` on `POST /executions` still comes back `"paused"` instead
+// of `"completed"`. Traced the full wiring end to end — HTTP payload schema
+// (packages/core/api/src/executions/api.ts), the handler
+// (packages/core/api/src/handlers/executions.ts), `startPausableExecution`'s
+// `autoApprove` short-circuit into `runInlineExecution` with `acceptAllHandler`,
+// `makeFullInvoker` -> `makeExecutorToolInvoker`, and the static-tool dispatch
+// + `enforceApproval`/`buildElicit` in packages/core/sdk/src/executor.ts — every
+// layer threads the per-call elicitation handler correctly and matches the
+// already-working `policies.list` gate exercised by
+// scenarios/browser-approval.test.ts. No defect found by static reading; this
+// needs a live-debugged trace of the sandboxed `codeExecutor.execute` run to
+// find where the accept-all handler stops taking effect. The feature and this
+// test shipped together in the same commit (a150db97, "Run panel: auto-approve
+// operator-invoked tools (#1183)") and this scenario has never gone green on
+// main since — a real product bug, not a stale assertion; suspect: the
+// autoApprove short-circuit in packages/core/execution/src/engine.ts's
+// `startPausableExecution` (or its sandbox integration), needs live debugging.
+const RUN_PANEL_AUTO_APPROVE_SKIP =
+  'autoApprove: true still returns "paused" instead of "completed" — wiring traced end to end (HTTP schema, handler, engine\'s autoApprove short-circuit, makeFullInvoker, static-tool dispatch/enforceApproval) with no defect found statically; never green since introduction in a150db97 (#1183) — suspect: packages/core/execution/src/engine.ts\'s startPausableExecution autoApprove path, needs live debugging';
+
 scenario(
   "Run panel · autoApprove runs an approval-gated tool that otherwise pauses",
-  {},
+  { skip: RUN_PANEL_AUTO_APPROVE_SKIP },
   Effect.gen(function* () {
     const target = yield* Target;
     const apiSurface = yield* Api;