fix(03.1-recheck): address post-review gaps from second recheck pass

- Add mixed-failure ZodError test (upstream_mcp array + missing profile_name
  must re-throw raw ZodError, not wrap as ValidationError)
- Add validation_timeout_ms float rejection test (1.5 → rejects as non-integer)
- Strengthen weak http-transport skip-validation assertion (not.toBe(500) → toBe(200))
- Simplify generic-profile.test.ts upstream proxy detection to !!profile.upstream_mcp
  (loaded profile can never carry legacy array; remove hasUpstreamMcpFlag dependency)
- Extend MIGRATION-CLEANUP comment to include UPSTREAM_MCP_ARRAY_REJECTION_MESSAGE
  export as third required cleanup site

Agent authored

Author: David Ruzicka

src/profile/profile-loader.test.ts

@@ -3357,6 +3357,29 @@ paths:
       expect(err.message).toContain('upstream_mcp schema validation failed');
     });
 
+    it('re-throws raw ZodError when upstream_mcp array fails alongside other field errors', async () => {
+      const loader = new ProfileLoader();
+      const fs = await import('fs/promises');
+      const tmpPath = `/tmp/profile-upstream-mixed-${Date.now()}-${Math.random()}.json`;
+      await fs.writeFile(
+        tmpPath,
+        JSON.stringify({
+          // profile_name intentionally omitted — triggers a separate Zod issue
+          tools: [],
+          upstream_mcp: [{ name: 'p', transport: { type: 'http-streamable', url: 'https://u.example.com/mcp' } }],
+        }),
+        'utf-8',
+      );
+      expect.assertions(2);
+      const err = await loader.load(tmpPath).catch((e) => e);
+      // Mixed failure: both upstream_mcp (array) and profile_name (missing) fail Zod.
+      // The wrapping condition requires ALL issues to be upstream_mcp-rooted, so the
+      // raw ZodError must be re-thrown to preserve the profile_name error.
+      const { ZodError } = await import('zod');
+      expect(err).toBeInstanceOf(ZodError);
+      expect((err as import('zod').ZodError).issues.some((i) => i.path[0] !== 'upstream_mcp')).toBe(true);
+    });
+
     it('loads profile with single-object upstream_mcp', async () => {
       const loader = new ProfileLoader();
       const fs = await import('fs/promises');

src/profile/upstream-mcp-config.test.ts

@@ -224,6 +224,15 @@ describe('resolveUpstreamMcpConfig – validator error branches', () => {
     expect(() => resolveUpstreamMcpConfig(profile)).toThrow(/validation_timeout_ms must be a positive integer/);
   });
 
+  it('rejects non-integer validation_timeout_ms', () => {
+    const profile = makeProfile({
+      name: 'p1',
+      transport: { type: 'http-streamable', url: 'https://example.com/mcp' },
+      validation_timeout_ms: 1.5,
+    });
+    expect(() => resolveUpstreamMcpConfig(profile)).toThrow(/validation_timeout_ms must be a positive integer/);
+  });
+
   it('rejects empty tool_prefix', () => {
     const profile = makeProfile({
       name: 'p1',

src/profile/upstream-mcp-config.ts

@@ -228,10 +228,11 @@ export function looksLikeUpstreamMcpProxy(value: unknown): boolean {
 
 // MIGRATION-CLEANUP(phase-03.1): remove this function and all its callers once
 // all deployed profiles have been migrated to singular upstream_mcp object.
-// Both cleanup sites (this function + the Array.isArray branch in profile-resolver.ts
-// extractEnvVars) MUST be removed together — they serve the same migration window.
-// Removal: grep -rn "MIGRATION-CLEANUP(phase-03.1)" src/ — 2 code sites (grep returns 3 lines
-// because this comment block spans 2 lines; the third hit is in profile-resolver.ts).
+// Cleanup sites (must all be removed together):
+//   1. This function (hasUpstreamMcpFlag)
+//   2. Array.isArray branch in profile-resolver.ts extractEnvVars
+//   3. UPSTREAM_MCP_ARRAY_REJECTION_MESSAGE export + its import in profile-loader.ts
+// Removal: grep -rn "MIGRATION-CLEANUP(phase-03.1)" src/ — 3 code sites.
 /**
  * Returns true if the raw profile.upstream_mcp value indicates an upstream MCP
  * provider is configured. Tolerates BOTH the legacy array shape and the post

src/testing/generic-profile.test.ts

@@ -8,7 +8,6 @@ import { loadTestDefinitionSync, validateTestAgainstProfile } from './test-loade
 import { processTemplate } from './template-utils.js';
 import { Profile } from '../types/profile.js';
 import { ProfileLoader } from '../profile/profile-loader.js';
-import { hasUpstreamMcpFlag } from '../profile/upstream-mcp-config.js';
 import { assertRequestMatches, assertRequestsSequence } from './request-assertions.js';
 
 type ToolCallResponse = {
@@ -243,7 +242,7 @@ testFiles.forEach(testFile => {
       validateTestAgainstProfile(testDef, profile);
 
       const isUpstreamProxy =
-        hasUpstreamMcpFlag(profile.upstream_mcp) &&
+        !!profile.upstream_mcp &&
         !profile.openapi_spec_path;
 
       server = new MCPServer();

src/transport/http-transport.upstream-validation.test.ts

@@ -342,6 +342,7 @@ describeIfListen('upstream credential validation at session init', () => {
       .send(INIT_REQUEST);
 
     // Should succeed (session created) since no validation manager
-    expect(res.status).not.toBe(500);
+    expect(res.status).toBe(200);
+    expect(res.body).not.toHaveProperty('error');
   });
 });