fix: order managed auth checkpoint events

Author: rgarcia

src/lib/mcp/tools/managed-auth-state.ts

@@ -219,10 +219,19 @@ async function waitFromCheckpoint(
     );
   }
   const events = await authFlowEvents(client, latest.id);
-  const event =
-    checkpoint.kind === "event"
-      ? events.find((candidate) => candidate.id === checkpoint.eventId)
-      : events.find((candidate) => candidate.id !== checkpoint.eventId);
+  let event: ManagedAuthTimelineEvent | undefined;
+  if (checkpoint.kind === "event") {
+    event = events.find((candidate) => candidate.id === checkpoint.eventId);
+  } else if (checkpoint.eventId === null) {
+    event = events[0];
+  } else {
+    // Timelines are newest-first. Only entries before the baseline were created
+    // after the checkpoint; an absent baseline must fail closed.
+    const baselineIndex = events.findIndex(
+      (candidate) => candidate.id === checkpoint.eventId,
+    );
+    event = baselineIndex > 0 ? events.slice(0, baselineIndex)[0] : undefined;
+  }
   if (!event || event.status === "IN_PROGRESS") {
     return { state: "pending", connection: latest };
   }

src/lib/mcp/tools/managed-auth-wait.test.ts

@@ -157,7 +157,14 @@ describe("managed-auth wait", () => {
     });
     const staleClient = waitClient({
       states: [authenticated],
-      events: [oldEvent],
+      events: [
+        oldEvent,
+        timelineEvent({
+          id: "flow_older",
+          type: "reauth",
+          status: "SUCCESS",
+        }),
+      ],
     }).client;
     const selector = {
       connectionId: authenticated.id,
@@ -188,6 +195,33 @@ describe("managed-auth wait", () => {
     ).toBe("authenticated");
   });
 
+  test("after-checkpoint fails closed when its baseline is absent", async () => {
+    const authenticated = connection({
+      status: "AUTHENTICATED",
+      flow_status: "SUCCESS",
+      flow_type: "REAUTH",
+    });
+    const { client } = waitClient({
+      states: [authenticated],
+      events: [
+        timelineEvent({
+          id: "flow_historical",
+          type: "reauth",
+          status: "SUCCESS",
+        }),
+      ],
+    });
+    const result = await waitForAuthConnection(
+      client,
+      {
+        connectionId: authenticated.id,
+        flowCheckpoint: checkpoint("after", "flow_missing"),
+      },
+      { timeoutMs: 0 },
+    );
+    expect(result.state).toBe("pending");
+  });
+
   test("explicitly empty baseline catches the first flow's terminal failure", async () => {
     const failed = connection({
       flow_status: "FAILED",