test(integration): support deferred MCP tool calls in SDK E2E - #12365

Local verification — real CLI build + real MCP server, scripted model

I built the E2E environment locally and ran sdk-typescript/mcp-server.test.ts on both arms. The PR does what it says: the exact 7 failures from #12357 reproduce on unpatched main and all 9 tests go green with this patch, while the legacy direct-call shape keeps passing. Recommending merge.

Worth flagging up front: this PR comes from a fork, so e2e.yml skips the E2E Tests job by design (github.event.pull_request.head.repo.full_name == github.repository). The green checks on this PR therefore do not exercise the tests it changes — the run below is the substitute for that.

Rig

Only the model is substituted — everything the assertions read (SDK transcript, bridge resolution, permission path, MCP execution) is the real product code.

Result

Arm A's failure text is identical to main CI run 35545401904 — same 7 tests, same messages, including the [ 'tool_search', 'tool_call', …(N) ] to include 'mcp__test-math-server__add' array shape, expected 0 to be greater than or equal to 2 and expected undefined to be defined.

The failures really were false

A probe through the same CLI and SDK, printing what the transcript carries:

The MCP tool ran and returned 15 with is_error=false; the only thing wrong on main was that the assertion looked at the envelope's model-facing name. That matches the bridge contract in docs/design/deferred-tool-call-bridge.md ("the function response ... retains the bridge name") and coreToolScheduler.resolveToolCallBridgeRequest, which keeps modelFacingName on the wire and resolves the target only for execution.

Three wire shapes × two arms

The top row is the positive control the PR description promises: with the pre-#10410 top-level name, both arms stay green, so the patch adds recognition of the envelope without dropping the direct form.

Cross-checks

• canUseTool assertion (line 463) is untouched and still correct. The permission callback receives the resolved MCP names, not tool_call, because _schedule unwraps the envelope before anything downstream sees it. Measured: arm B's should support multi-turn MCP tools with canUseTool passes through line 463, which arm A never reached.
• Gates on the patched file: typecheck:integration ✓, eslint --max-warnings 0 ✓, prettier --check ✓.
• Scope looks complete. In CI run 35545401904 the sdk shard is 1 failed | 12 passed — this file is the only casualty — and the cli shard stays green, including cli/simple-mcp-server.test.ts, which matches through telemetry (rig.waitForToolCall) and therefore already sees the resolved target name.
• Merge result against today's main (17b5c940) still touches only this file; no other open PR edits it.

Non-blocking observations

1. These assertions prove an invocation was attempted, not that it succeeded — and that is pre-existing, not something this PR introduces. Probe: have the model send tool_call with a required argument missing. The bridge refuses it (params must have required property 'b'), the MCP tool never runs, the model answers "15" anyway — and should use MCP add tool to add two numbers goes green on both arms (the same holds for the legacy direct shape on main). If the suite should guard execution, pair the tool_use id with a non-error tool_result the way sdk-mcp-server.test.ts already does.
2. getInvokedToolName unwraps the target name but not input.arguments. Today the only input assertion is expect(addToolUseBlock.input).toBeDefined(), so nothing breaks; a future assertion on tool arguments would see the envelope { name, arguments } instead. A short comment there would save the next reader a detour.
3. Optional: getInvokedToolName / findMcpToolUseBlocks would be reusable by other suites if they lived in sdk-typescript/test-helper.ts next to findToolUseBlocks.

Repro

git worktree add --detach /tmp/wt origin/main && cd /tmp/wt && pnpm install   # prepare builds dist/cli.js
# start a local OpenAI-compatible server that answers the suite's prompts with
#   tool_search{query:"select:mcp__test-math-server__add"} then
#   tool_call{name:"mcp__test-math-server__add",arguments:{a,b}}
QWEN_HOME=<clean home with security.auth.selectedType=openai> \
OPENAI_API_KEY=fake-key OPENAI_BASE_URL=<server>/v1 OPENAI_MODEL=fake-model QWEN_MODEL=fake-model \
NO_PROXY=127.0.0.1,localhost QWEN_SANDBOX=false \
pnpm exec vitest run --root ./integration-tests --retry=0 \
  --poolOptions.forks.minForks 1 --poolOptions.forks.maxForks 1 \
  sdk-typescript/mcp-server.test.ts
# arm A (main's mcp-server.test.ts): 7 failed | 2 passed
# arm B (this PR's file, same build):        9 passed