[robzolkos]

Why

make release-check failed in race-test while v0.22.1 was being cut, on MCP server tests that had not changed since v0.22.0. Two separate causes, both in the tests:

• Another program's requests. moshi-hook, which runs on some developer machines, sends two bare GET / (no credentials) to every new localhost listener. The fakes here count every request they see, so the probe failed whichever test was listening. Seen in three different tests.
• A deadline race. TestFilingSaysWhetherTryingAgainIsSafe cut the filing wait to 300ms for every subtest, and the SDK's first poll fires at 250ms. A poll slower than 50ms, common under the race detector, ended the wait first.

What changed

• Every fake Basecamp in internal/mcpserver comes from newUpstream, which answers 404 without reaching the fake when a request lacks the test client's token. newTestAPI takes only what newUpstream returns, so a new test cannot build a client against an unguarded fake.
• Only the unsettled subtest shortens the filing wait, and its filing starts as processing, so its result does not depend on whether a poll landed.

Scope

• Covers internal/mcpserver, the only package that failed. Seven test files in other packages (mostly internal/commands) have "unexpected request" handlers too. They did not fail, and I have not checked whether each one judges every request.

Verification

• TestFakeBasecampAnswersOnlyTheClientUnderTest sends the probe: fails on the first commit, passes after the gate.
• Polls slowed to 100ms by a temporary patch: failed and unsettled each failed 5 of 5 before, all subtests passed 5 of 5 after.
• go test -race -count=20 ./internal/mcpserver/ with moshi-hook running: 0 failures (before: failures in each of three batches, 3 of 15 package runs). bin/ci passes.

---

Summary by cubic

Fixes flaky internal/mcpserver tests that intermittently failed make release-check under the race detector.

• Every fake Basecamp in the package is now built through newUpstream, which answers 404 to any request lacking the test client's bearer token. This stops other programs probing localhost, like moshi-hook's bare GET /, from reaching the fakes.
• TestFilingSaysWhetherTryingAgainIsSafe no longer cuts the filing wait for all subtests. Only the unsettled subtest shortens it, and its filing now starts as processing, so its result no longer depends on whether a poll lands before the wait expires.

^{Written for commit 726861e. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[Copilot]

🟢 Approved

There are no active review issues for the test-only changes aimed at stabilizing the CLI’s MCP server tests.

No open issues 🎉

What changed in this PR

This PR stabilizes the CLI’s MCP server tests against unrelated localhost probes and filing-poll timing under the race detector. Changes are limited to tests.

Changes:

• Centralizes fake upstream creation with a bearer-token gate and automatic cleanup.
• Adds a regression test confirming unauthenticated probes never reach fake handlers.
• Limits the shortened filing timeout to unsettled and starts that fixture as processing, removing dependence on the first poll.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
internal/​mcpserver/​server_test.go	Adds guarded upstream helpers and probe regression coverage; migrates server tests.
internal/​mcpserver/​filing_test.go	Uses guarded upstreams and removes the filing deadline race.
internal/​mcpserver/​feed_test.go	Migrates feed test fakes to guarded upstreams.
internal/​mcpserver/​composite_test.go	Migrates composite test fakes to guarded upstreams.

_{Review effort: Balanced}