[kriszyp]

Summary

The getUser-timeout test (test/lib/mcp/withMCPAuth.test.js, added in #287) cancels on Node 22, along with every later test in the file. On the release PR (#288) it made Lint, Build & Test (22) fail twice: 23 tests cancelled, Promise resolution is still pending but the event loop has already resolved.

Cause: withMCPAuth unref()s its user-lookup timer (src/lib/mcp/withMCPAuth.ts:261), which is correct for a server. This test's getUser returns a promise that never settles. So once the request is waiting, nothing referenced keeps the event loop alive until the 20 ms timeout fires, and Node 22's test runner treats the drained loop as a hung test. On Node 24 and 26 something else happens to hold the loop open, so it passes there.

Fix: test-only. Hold a referenced setInterval for the duration of the await, and clear it in finally. Production code is unchanged.

Verification

Single test, --test-name-pattern="when getUser times out":

Node	Before (main)	After
22.23.1	15 cancelled, 0 pass	1 pass
22.23.4	15 cancelled, 0 pass	1 pass

The full suite under coverage on Node 22.23.1, as CI runs it, gives 1877 pass, 0 fail, 0 cancelled. Node 24 is unchanged.

Unblocks the 2.10.0 release (#288).

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the test suite in test/lib/mcp/withMCPAuth.test.js to prevent the test runner from prematurely cancelling a test. It introduces a temporary setInterval keep-alive mechanism around the withMCPAuth call to keep the event loop active while waiting for a timeout to fire, clearing the interval in a finally block. There are no review comments to address.

[github-actions]

Reviewed; no blockers found.

The fix correctly addresses a race between the Node 22 test runner and the unref'd timeout in withMCPAuth. By holding a referenced setInterval during the await, you ensure the event loop stays alive long enough for the user-lookup timeout to fire and settle the promise. The try...finally block safely handles the cleanup.