Problem
Both checked-in end-to-end scripts fail at their action WebSocket setup against the current self-hosted engine:
npm run e2e -- http://localhost:18787 --ci passes the earlier smoke sections, then fails at Actions → Connect handler + caller WebSockets with Unexpected server response: 401.npm run e2e:actions -- http://localhost:18787 creates its workspace and agents, then immediately crashes with Unexpected server response: 401.
The scripts open raw sockets as /v1/ws?token=<agent token> (scripts/e2e.ts and scripts/e2e-actions.ts). The current Node upgrade contract authenticates /v1/ws through authenticateRealtimeWs, and packages/engine/src/__tests__/nodeUpgradeAuth.test.ts explicitly asserts that an agent token on that endpoint returns 401 while an observer token returns 101.
This makes the repository E2E commands contradict the enforced auth contract and prevents release/snapshot proof from completing even when the product test suite is green.
Exact reproduction
Built and started the current engine against a fresh SQLite database:
npm run build
node packages/engine/dist/bin/serve.js --db /tmp/fresh/relaycast.sqlite --port 18787 --env test
Then ran:
npm run e2e -- http://localhost:18787 --ci
npm run e2e:actions -- http://localhost:18787
Observed:
Actions
✗ Connect handler + caller WebSockets: Unexpected server response: 401
Fatal: Connect handler + caller WebSockets failed: Unexpected server response: 401
Relaycast actions E2E → http://localhost:18787
actions E2E crashed: Error: Unexpected server response: 401
Expected
The E2E scripts should use a supported realtime credential/endpoint and complete against a clean self-hosted database. Add a must-fire integration regression around the exact script authentication path so the scripts and nodeUpgradeAuth contract cannot diverge again.
Scope evidence
Found while validating PR #377. That PR does not modify WebSocket authentication or either E2E script; the rejected-agent-token assertion and raw agent-token script URLs are both present at the PR base (80ab366048a0634fbf1a8b5301de71dd22c50026), so this is a separate pre-existing proof-harness defect.
Problem
Both checked-in end-to-end scripts fail at their action WebSocket setup against the current self-hosted engine:
npm run e2e -- http://localhost:18787 --cipasses the earlier smoke sections, then fails at Actions → Connect handler + caller WebSockets withUnexpected server response: 401.npm run e2e:actions -- http://localhost:18787creates its workspace and agents, then immediately crashes withUnexpected server response: 401.The scripts open raw sockets as
/v1/ws?token=<agent token>(scripts/e2e.tsandscripts/e2e-actions.ts). The current Node upgrade contract authenticates/v1/wsthroughauthenticateRealtimeWs, andpackages/engine/src/__tests__/nodeUpgradeAuth.test.tsexplicitly asserts that an agent token on that endpoint returns 401 while an observer token returns 101.This makes the repository E2E commands contradict the enforced auth contract and prevents release/snapshot proof from completing even when the product test suite is green.
Exact reproduction
Built and started the current engine against a fresh SQLite database:
npm run build node packages/engine/dist/bin/serve.js --db /tmp/fresh/relaycast.sqlite --port 18787 --env testThen ran:
Observed:
Expected
The E2E scripts should use a supported realtime credential/endpoint and complete against a clean self-hosted database. Add a must-fire integration regression around the exact script authentication path so the scripts and
nodeUpgradeAuthcontract cannot diverge again.Scope evidence
Found while validating PR #377. That PR does not modify WebSocket authentication or either E2E script; the rejected-agent-token assertion and raw agent-token script URLs are both present at the PR base (
80ab366048a0634fbf1a8b5301de71dd22c50026), so this is a separate pre-existing proof-harness defect.