@skyramp/mcp 0.0.59 → 0.0.60-rc.2

package/build/tools/test-recommendation/recommendTestsTool.js

@@ -1,207 +1,211 @@
+import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
 import { z } from "zod";
-import { StateManager, } from "../../utils/AnalysisStateManager.js";
-import { TestType } from "../../types/TestTypes.js";
+import { simpleGit } from "simple-git";
+import { StateManager, getSessionFilePath, getRegisteredSessions, getSessionData, hasSessionData, } from "../../utils/AnalysisStateManager.js";
 import { logger } from "../../utils/logger.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
-/** Maps each test type to the Skyramp MCP tool that generates it */
-const TEST_TYPE_TO_TOOL = {
-    [TestType.CONTRACT]: "skyramp_contract_test_generation",
-    [TestType.SMOKE]: "skyramp_smoke_test_generation",
-    [TestType.INTEGRATION]: "skyramp_integration_test_generation",
-    [TestType.FUZZ]: "skyramp_fuzz_test_generation",
-    [TestType.E2E]: "skyramp_e2e_test_generation",
-    [TestType.LOAD]: "skyramp_load_test_generation",
-    [TestType.UI]: "skyramp_ui_test_generation",
-};
+import { buildRecommendationPrompt } from "../../prompts/test-recommendation/test-recommendation-prompt.js";
+import { repositoryAnalysisSchema } from "../../types/RepositoryAnalysis.js";
+import { parsePRComments } from "../../utils/pr-comment-parser.js";
+import { getWorkspaceAuthHeader } from "../../utils/workspaceAuth.js";
 /**
- * Recommend Tests Tool
- * MCP tool for generating actionable test recommendations
+ * Extract GitHub owner/repo from the origin remote URL.
+ * Handles both SSH (git@github.com:owner/repo.git) and
+ * HTTPS (https://github.com/owner/repo.git) formats.
  */
-const recommendTestsSchema = z.object({
-    stateFile: z
-        .string()
-        .describe("Path to state file from skyramp_map_tests (contains both analysis and mapping results)"),
+async function getGitHubSlug(repoPath) {
+    try {
+        const git = simpleGit(repoPath);
+        const remotes = await git.getRemotes(true);
+        const origin = remotes.find((r) => r.name === "origin");
+        const url = origin?.refs?.fetch;
+        if (!url)
+            return null;
+        const sshMatch = url.match(/github\.com[:/]([^/]+)\/([^/.]+?)(?:\.git)?$/);
+        if (sshMatch)
+            return { owner: sshMatch[1], repo: sshMatch[2] };
+        const httpsMatch = url.match(/github\.com\/([^/]+)\/([^/.]+?)(?:\.git)?$/);
+        if (httpsMatch)
+            return { owner: httpsMatch[1], repo: httpsMatch[2] };
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+const recommendTestsSchema = {
+    sessionId: completable(z.string().describe("Session ID from skyramp_analyze_repository"), async (value) => {
+        return Array.from(getRegisteredSessions().keys()).filter((id) => id.startsWith(value.toString()));
+    }),
     topN: z
         .number()
-        .default(7)
-        .describe("Number of top test types to recommend (default: 5)"),
-    minScore: z
+        .optional()
+        .describe("Number of recommendations. Defaults to 5."),
+    prNumber: z
         .number()
-        .default(60)
-        .describe("Minimum score threshold for recommendations (default: 60)"),
-});
+        .optional()
+        .describe("GitHub PR number. When provided in diff scope, fetches previous TestBot comments to avoid re-recommendations."),
+};
 const TOOL_NAME = "skyramp_recommend_tests";
 export function registerRecommendTestsTool(server) {
     server.registerTool(TOOL_NAME, {
-        description: `Generate actionable test recommendations with ready-to-use generation prompts.
-
-**PREREQUISITE**: Call skyramp_map_tests first to get the stateFile path.
+        description: `Generate actionable test recommendations based on enriched repository analysis.
 
-This tool reads the saved test mapping results and generates:
-- Ordered list of recommended test types (high/medium/low priority)
-- Specific test scenarios based on actual repository endpoints and flows
-- Artifact availability status and guidance for missing artifacts
-- Step-by-step next actions
+**PREREQUISITE**: Call skyramp_analyze_repository first to get the sessionId.
 
-SAMPLE OUTPUT:
-\`\`\`
-Recommended Tests (Prioritized)
-Priority: <PRIORITY HIGH, MEDIUM, OR LOW>
-1. <TEST TYPE> Tests [**CRITICAL: NEVER MENTION THE SCORE HERE IN THE OUTPUT**]
-Rationale: 
-Specific Tests to Create:
-Test 1: <TEST NAME>
-Description: <TEST DESCRIPTION>
-Target Flow: <TARGET FLOW>
-\`\`\`
+This tool reads the enriched analysis (endpoints with interactions, drafted scenarios)
+and generates prioritized test recommendations using LLM reasoning over the actual data.
 
-For each recommended test type, you'll get:
-- 2-3 specific tests you can create right now
-- Required vs. available artifacts. THIS SHOULD NOT CHANGE PRIORITIZATION OF THE TESTS.
-- Guidance for creating missing artifacts WITHOUT PROVIDING ANY CLI COMMANDS.
+For each recommended test, you'll get:
+- Priority (high/medium/low) with reasoning based on actual endpoint data
+- Specific test referencing concrete interactions (request→response pairs)
+- For integration/E2E: references to draftedScenarios by scenarioName
+- Which Skyramp tool to call for generation
 
 **CRITICAL RULES**:
 - THE PRIORITY SHOULD ONLY BE DEFINED AS HIGH, MEDIUM, OR LOW NOTHING ELSE.
 - DO NOT SHOW ANY PRIORITY BREAKDOWN IN THE OUTPUT.
 - DON'T MARK ANY TEST BLOCKED EVEN IF REQUIRED ARTIFACTS ARE MISSING.
+- Reference specific interactions by description when recommending smoke/contract/fuzz tests.
+- Reference specific draftedScenarios by scenarioName when recommending integration/E2E tests.
 
-Output: TestRecommendation with prioritized, actionable test recommendations.
-**CRITICAL:**  At the end of the tool execution, MUST display the below message:
 ** This tool is currently in Early Preview stage. Please verify the results. **`,
-        inputSchema: recommendTestsSchema.shape,
+        inputSchema: recommendTestsSchema,
     }, async (params) => {
         let errorResult;
         try {
             logger.info("Recommend tests tool invoked", {
-                stateFile: params.stateFile,
+                sessionId: params.sessionId,
                 topN: params.topN,
-                minScore: params.minScore,
             });
-            // Read state file using StateManager
-            if (!params.stateFile) {
-                throw new Error("stateFile is required");
+            if (!params.sessionId) {
+                throw new Error("sessionId is required");
             }
-            const stateManager = StateManager.fromStatePath(params.stateFile);
-            if (!stateManager.exists()) {
-                throw new Error(`State file not found: ${params.stateFile}. Run skyramp_map_tests first.`);
+            // Load session data: try process memory first, then fall back to state file
+            let stateData = null;
+            if (hasSessionData(params.sessionId)) {
+                stateData = getSessionData(params.sessionId);
+                logger.info("Loaded analysis from process memory", { sessionId: params.sessionId });
+            }
+            else {
+                // Fall back to state file for backward compatibility
+                const registeredPath = getSessionFilePath(params.sessionId);
+                const stateManager = registeredPath
+                    ? StateManager.fromStatePath(registeredPath)
+                    : StateManager.fromSessionId(params.sessionId);
+                if (!stateManager.exists()) {
+                    throw new Error(`Analysis session not found: ${params.sessionId}. Run skyramp_analyze_repository first.`);
+                }
+                stateData = await stateManager.readData();
+                logger.info("Loaded analysis from state file (legacy)", { sessionId: params.sessionId });
             }
-            const stateData = await stateManager.readData();
             if (!stateData) {
-                throw new Error(`Failed to read state file: ${params.stateFile}. Run skyramp_map_tests first.`);
+                throw new Error(`Failed to read analysis session: ${params.sessionId}. Run skyramp_analyze_repository first.`);
+            }
+            const { analysisScope } = stateData;
+            let { repositoryPath, analysis } = stateData;
+            // Fallback: if the LLM saved RepositoryAnalysis at the root level
+            // (without the wrapper), detect it and use the data directly.
+            if (!analysis && stateData.apiEndpoints) {
+                logger.info("Detected unwrapped RepositoryAnalysis — using root data");
+                analysis = stateData;
+                repositoryPath = repositoryPath || analysis?.metadata?.repositoryName || "unknown";
             }
-            const { mapping, repositoryPath, analysisScope, analysis } = stateData;
-            if (!mapping) {
-                throw new Error("State file is missing required data (mapping). Run skyramp_map_tests first.");
+            if (!analysis) {
+                throw new Error("Session is missing analysis data. Run skyramp_analyze_repository first.");
+            }
+            // Validate analysis against the Zod schema to catch malformed LLM output early
+            const parseResult = repositoryAnalysisSchema.safeParse(analysis);
+            if (!parseResult.success) {
+                const issues = parseResult.error.issues.slice(0, 5).map((i) => `${i.path.join(".")}: ${i.message}`);
+                logger.warning("Analysis data has schema issues (proceeding with best-effort)", {
+                    issueCount: parseResult.error.issues.length,
+                    sample: issues,
+                });
+            }
+            // Guard critical nested fields the prompt builder accesses
+            if (!analysis.apiEndpoints?.endpoints) {
+                analysis.apiEndpoints = { totalCount: 0, baseUrl: "", endpoints: [] };
+            }
+            if (!analysis.businessContext?.draftedScenarios) {
+                analysis.businessContext = {
+                    ...(analysis.businessContext || { mainPurpose: "", userFlows: [], dataFlows: [], integrationPatterns: [] }),
+                    draftedScenarios: analysis.businessContext?.draftedScenarios || [],
+                };
+            }
+            if (!analysis.authentication) {
+                analysis.authentication = { method: "none", configLocation: "", envVarsRequired: [], setupExample: "" };
+            }
+            if (!analysis.existingTests) {
+                analysis.existingTests = {
+                    frameworks: [], coverage: { unit: 0, integration: 0, e2e: 0, ui: 0, load: 0, contract: 0, smoke: 0 },
+                    testLocations: {}, hasCoverageReports: false,
+                };
             }
             const scope = analysisScope || "full_repo";
-            const isDiffScope = scope === "current_branch_diff";
-            // Build a diff-context section that gives the LLM explicit targets to test
-            const apiBaseUrl = (analysis?.apiEndpoints?.baseUrl || "").replace(/\/+$/, "");
-            let diffContextSection = "";
-            if (isDiffScope) {
-                const diff = analysis?.branchDiffContext;
-                const hasEndpoints = diff &&
-                    (diff.newEndpoints.length > 0 || diff.modifiedEndpoints.length > 0);
-                const hasChangedFiles = diff && diff.changedFiles.length > 0;
-                if (hasEndpoints) {
-                    const lines = [];
-                    for (const ep of diff.newEndpoints) {
-                        lines.push(`- **${ep.method} ${apiBaseUrl}${ep.path}** (new) — \`${ep.sourceFile}\``);
+            const sessionId = params.sessionId;
+            const effectiveTopN = params.topN ?? (scope === "current_branch_diff" ? 7 : 10);
+            // Fetch PR context when prNumber is provided and in diff scope
+            let prContext = stateData.prContext;
+            if (!prContext && params.prNumber && scope === "current_branch_diff") {
+                const slug = await getGitHubSlug(repositoryPath);
+                if (slug) {
+                    try {
+                        prContext = await parsePRComments(slug.owner, slug.repo, params.prNumber);
                     }
-                    for (const ep of diff.modifiedEndpoints) {
-                        lines.push(`- **${ep.method} ${apiBaseUrl}${ep.path}** (modified) — \`${ep.sourceFile}\``);
+                    catch (err) {
+                        logger.warning("Failed to fetch PR context", {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
                     }
-                    diffContextSection = `
-## Changed Endpoints in This PR
-${lines.join("\n")}
-
-`;
                 }
-                else if (hasChangedFiles) {
-                    // No route decorators parsed, but files did change — show them so the
-                    // LLM can infer which endpoints are affected
-                    diffContextSection = `
-## Changed Files in This PR
-${diff.changedFiles.map((f) => `- \`${f}\``).join("\n")}
-
-`;
+                else {
+                    logger.debug("Could not determine GitHub owner/repo from git remotes — skipping PR context");
                 }
             }
-            // Build an explicit action list so the agent knows exactly which
-            // generate tools to call — ordered by priority.
-            const buildActionList = (types) => types
-                .map((t) => {
-                const tool = TEST_TYPE_TO_TOOL[t];
-                return tool ? `- **${t}** → call \`${tool}\`` : `- **${t}**`;
-            })
-                .join("\n");
-            const highActions = buildActionList(mapping.summary.highPriority);
-            const mediumActions = buildActionList(mapping.summary.mediumPriority);
-            // Check if E2E or UI tests are in the priority lists
-            const allPriority = [
-                ...mapping.summary.highPriority,
-                ...mapping.summary.mediumPriority,
-            ];
-            const hasE2EOrUI = allPriority.some((t) => t === TestType.E2E || t === TestType.UI);
-            const traceGuidance = hasE2EOrUI
-                ? `
-### Trace Files for E2E/UI Tests
-
-E2E and UI test generation requires pre-recorded trace files. Search the repository for:
-- Backend traces: \`**/skyramp*trace*.json\`, \`**/skyramp-traces.json\`
-- Playwright traces: \`**/skyramp*playwright*.zip\`, \`**/*playwright*.zip\`
-
-Look in the test directory, repository root, and \`.skyramp/\` directories.
-
-**IMPORTANT — Verify trace relevance before using it:**
-Before passing a trace file to a test generation tool, inspect its contents to confirm it actually exercises the UI components or pages affected by the PR. A trace recorded before the current changes will not cover new UI elements. If the trace does NOT cover the changed UI:
-- Do NOT use it for generating tests for the new changes.
-- Report in \`issuesFound\`: "A Playwright trace file was found (<filename>) but it does not cover the new UI changes in this PR. To generate UI tests for the new functionality, record a new trace that exercises the changed pages/components and commit it, then re-run the Testbot."
+            const workspaceAuthHeader = repositoryPath
+                ? await getWorkspaceAuthHeader(repositoryPath)
+                : undefined;
+            const prompt = buildRecommendationPrompt(analysis, scope, "all", effectiveTopN, prContext, workspaceAuthHeader);
+            // H3: Mode-specific output header
+            const modeLabel = scope === "current_branch_diff" ? "PR Mode" : "Repo Mode";
+            const modeDesc = scope === "current_branch_diff"
+                ? `Focused on branch changes. Top ${effectiveTopN} recommendations — top 4 will be generated, remaining reported.`
+                : `Comprehensive test strategy. Top ${effectiveTopN} tests across the entire application.`;
+            // J4: PR awareness messaging
+            let prAwareness = "";
+            if (prContext && prContext.previousRecommendations.length > 0) {
+                const implemented = prContext.previousRecommendations.filter(r => r.status === "implemented").length;
+                const pending = prContext.previousRecommendations.filter(r => r.status === "recommended").length;
+                prAwareness = `\n**PR History**: ${implemented} tests already implemented, ${pending} previously recommended.`;
+                if (implemented > 0) {
+                    prAwareness += ` Building on existing coverage — new recommendations complement what\'s already been added.`;
+                }
+            }
+            // G4: Include totalConsidered instruction in output
+            const totalEndpointMethods = analysis.apiEndpoints.endpoints.reduce((acc, ep) => acc + (ep.methods?.length || 0), 0);
+            const totalInteractions = analysis.apiEndpoints.endpoints.reduce((acc, ep) => acc + (ep.methods || []).reduce((a2, m) => a2 + (m.interactions?.length || 0), 0), 0);
+            const totalScenarios = analysis.businessContext.draftedScenarios.length;
+            const output = `# Test Recommendations (${modeLabel})
 
-- **Both found and relevant** → call \`skyramp_e2e_test_generation\` with both trace files
-- **Only Playwright ZIP found and relevant** → call \`skyramp_ui_test_generation\` with the Playwright file
-- **No traces found** → do NOT silently skip. Include in \`issuesFound\` when submitting your report: "E2E/UI tests were recommended but could not be generated because no Playwright trace file (.zip) was found in the repository. To enable E2E/UI test generation, record a Playwright trace and commit the .zip file, then re-run the Testbot."
-`
-                : "";
-            const nextActionsSection = mapping.summary.highPriority.length > 0 ||
-                mapping.summary.mediumPriority.length > 0
-                ? `
-## Required Next Actions
+**Session**: \`${sessionId}\`
+**Repository**: \`${repositoryPath}\`
+**Mode**: ${modeLabel} — ${modeDesc}${prAwareness}
+**Catalog**: ${totalEndpointMethods} endpoint methods, ${totalInteractions} interactions, ${totalScenarios} scenarios
+**Target**: Top ${effectiveTopN} recommendations ranked by value. Top 4 = generate & execute. #5-#${effectiveTopN} = report as additional recommendations.
 
-You MUST call the following Skyramp MCP generate tools, in order.
-Do NOT skip any. Do NOT just run existing tests — generate new ones.
+## Available Resources
+- Summary: \`skyramp://analysis/${sessionId}/summary\`
+- Endpoints: \`skyramp://analysis/${sessionId}/endpoints\`
+- Scenarios: \`skyramp://analysis/${sessionId}/scenarios\`
 
-### High Priority (call these first)
-${highActions || "none"}
+---
 
-${mediumActions ? `### Medium Priority (call after high)\n${mediumActions}\n` : ""}${isDiffScope && ((analysis?.branchDiffContext?.newEndpoints?.length ?? 0) + (analysis?.branchDiffContext?.modifiedEndpoints?.length ?? 0)) > 0 ? `\nTarget the changed endpoint(s) listed above for each generated test. Use the full URL (including base URL) as the \`endpointURL\` parameter when calling generate tools.` : ""}${traceGuidance}
-`
-                : "";
-            const output = `# Test Recommendations
-
-**State File**: \`${params.stateFile}\`
-**Repository**: \`${repositoryPath}\`
-**Scope**: ${isDiffScope ? "current branch diff" : "full repository"}
-${diffContextSection}
-## Priority Summary
-- High: ${mapping.summary.highPriority.join(", ") || "none"}
-- Medium: ${mapping.summary.mediumPriority.join(", ") || "none"}
-- Low: ${mapping.summary.lowPriority.join(", ") || "none"}
-${nextActionsSection}
-**MANDATORY RULES**:
-1. Use ONLY "high", "medium", "low" for priority — NO numeric scores.
-2. DO NOT mark any test "blocked" even if artifacts are missing.
-3. DO NOT create or save any files — output everything inline.
-4. For each generated test, pass the proper endpoint URL as the \`endpointURL\` parameter to the generate tool and DO NOT pass base URL as the \`endpointURL\` parameter.
+${prompt}
 
 ** This tool is currently in Early Preview stage. Please verify the results. **`;
             return {
-                content: [
-                    {
-                        type: "text",
-                        text: output,
-                    },
-                ],
+                content: [{ type: "text", text: output }],
                 isError: false,
             };
         }

package/build/tools/workspace/initializeWorkspaceTool.js

@@ -29,7 +29,7 @@ Fields per service:
       python  → pytest or robot
       typescript / javascript → playwright
       java → junit
-  outputDir — service root relative to repo root, e.g. "services/api-gateway"
+  outputDir — service root relative to repo root where the test files will be generated, e.g. "services/api-gateway"
   api.schemaPath — path or URL to OpenAPI/Protobuf/GraphQL schema
     Search for: openapi.json, swagger.yaml, *.proto, *.graphql
     Framework defaults: FastAPI → /openapi.json, Express → /api-docs, Spring → /v3/api-docs

package/build/types/RepositoryAnalysis.js

@@ -1,19 +1,111 @@
 import { z } from "zod";
-// Zod schemas for validation
+// ── Zod schemas ──
 export const analysisScopeSchema = z.enum(["full_repo", "current_branch_diff"]);
+export const paramInfoSchema = z.object({
+    name: z.string(),
+    type: z.string(),
+    required: z.boolean(),
+    description: z.string().optional(),
+    constraints: z.string().optional(),
+});
+export const cookieInfoSchema = z.object({
+    name: z.string(),
+    sampleValue: z.string(),
+    purpose: z.string(),
+    httpOnly: z.boolean(),
+    secure: z.boolean(),
+});
+export const endpointInteractionSchema = z.object({
+    description: z.string(),
+    type: z.enum(["success", "error", "edge-case"]),
+    request: z.object({
+        contentType: z.string().optional(),
+        body: z.record(z.any()).optional(),
+        headers: z.record(z.string()).optional(),
+        queryParams: z.record(z.any()).optional(),
+    }),
+    response: z.object({
+        statusCode: z.number(),
+        description: z.string(),
+        body: z.record(z.any()).optional(),
+        headers: z.record(z.string()).optional(),
+        cookies: z.array(cookieInfoSchema).optional(),
+    }),
+});
+export const endpointMethodSchema = z.object({
+    method: z.string(),
+    description: z.string(),
+    queryParams: z.array(paramInfoSchema),
+    authRequired: z.boolean(),
+    authType: z.string().optional(),
+    scopes: z.array(z.string()).optional(),
+    sourceFile: z.string(),
+    interactions: z.array(endpointInteractionSchema),
+    dependsOn: z.array(z.string()).optional(),
+    createsResource: z.string().optional(),
+});
+export const enrichedEndpointSchema = z.object({
+    path: z.string(),
+    resourceGroup: z.string(),
+    pathParams: z.array(paramInfoSchema),
+    methods: z.array(endpointMethodSchema),
+});
+export const chainingRefSchema = z.object({
+    sourceStep: z.number(),
+    sourceField: z.string(),
+    sourceLocation: z.enum(["body", "header", "cookie"]),
+    targetParam: z.string(),
+    targetLocation: z.enum(["path", "body", "query", "header", "cookie"]),
+});
+export const scenarioStepSchema = z.object({
+    order: z.number(),
+    method: z.string(),
+    path: z.string(),
+    description: z.string(),
+    interactionType: z.enum(["success", "error", "edge-case"]),
+    requestBody: z.record(z.any()).optional(),
+    expectedStatusCode: z.number(),
+    expectedResponseFields: z.array(z.string()).optional(),
+    chainsFrom: z
+        .union([chainingRefSchema, z.array(chainingRefSchema)])
+        .optional(),
+});
+export const draftedScenarioSchema = z.object({
+    scenarioName: z.string(),
+    description: z.string(),
+    category: z.enum([
+        "crud",
+        "workflow",
+        "auth",
+        "error-handling",
+        "data-validation",
+    ]),
+    priority: z.enum(["high", "medium", "low"]),
+    steps: z.array(scenarioStepSchema),
+    chainingKeys: z.array(z.string()),
+    requiresAuth: z.boolean(),
+    estimatedComplexity: z.enum(["simple", "moderate", "complex"]),
+    source: z.enum(["code-inferred", "trace", "documentation"]).optional(),
+});
 export const branchDiffContextSchema = z.object({
     currentBranch: z.string(),
     baseBranch: z.string(),
     changedFiles: z.array(z.string()),
     newEndpoints: z.array(z.object({
         path: z.string(),
-        method: z.string(),
-        sourceFile: z.string(),
+        methods: z.array(z.object({
+            method: z.string(),
+            sourceFile: z.string(),
+            interactionCount: z.number(),
+        })),
     })),
     modifiedEndpoints: z.array(z.object({
         path: z.string(),
-        method: z.string(),
-        sourceFile: z.string(),
+        methods: z.array(z.object({
+            method: z.string(),
+            sourceFile: z.string(),
+            changeType: z.enum(["added", "modified", "removed"]),
+        })),
     })),
     affectedServices: z.array(z.string()),
     summary: z.string().optional(),
@@ -62,6 +154,7 @@ export const repositoryAnalysisSchema = z.object({
         userFlows: z.array(z.string()),
         dataFlows: z.array(z.string()),
         integrationPatterns: z.array(z.string()),
+        draftedScenarios: z.array(draftedScenarioSchema),
     }),
     artifacts: z.object({
         openApiSpecs: z.array(z.object({
@@ -86,13 +179,7 @@ export const repositoryAnalysisSchema = z.object({
     apiEndpoints: z.object({
         totalCount: z.number(),
         baseUrl: z.string(),
-        endpoints: z.array(z.object({
-            path: z.string(),
-            method: z.string(),
-            resourceGroup: z.string(),
-            authRequired: z.boolean(),
-            sourceFile: z.string().optional(),
-        })),
+        endpoints: z.array(enrichedEndpointSchema),
     }),
     authentication: z.object({
         method: z.enum(["bearer", "api-key", "oauth2", "basic", "jwt", "none"]),

package/build/utils/AnalysisStateManager.js

@@ -1,7 +1,39 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
+import * as crypto from "crypto";
 import { logger } from "./logger.js";
+/**
+ * Per-process registry mapping sessionId → stateFilePath.
+ * Resource list callbacks iterate this map so each stdio process only
+ * advertises its own sessions, eliminating cross-process leakage when
+ * multiple MCP clients share the same filesystem (e.g. /tmp).
+ */
+const processSessionRegistry = new Map();
+/**
+ * In-memory session store: sessionId → analysis data.
+ * Eliminates the need for the LLM to read/write state files on disk.
+ * The analyze tool stores a skeleton here; the recommend tool reads it.
+ */
+const inMemorySessionStore = new Map();
+export function registerSession(sessionId, stateFilePath) {
+    processSessionRegistry.set(sessionId, stateFilePath);
+}
+export function getSessionFilePath(sessionId) {
+    return processSessionRegistry.get(sessionId);
+}
+export function getRegisteredSessions() {
+    return processSessionRegistry;
+}
+export function storeSessionData(sessionId, data) {
+    inMemorySessionStore.set(sessionId, data);
+}
+export function getSessionData(sessionId) {
+    return inMemorySessionStore.get(sessionId);
+}
+export function hasSessionData(sessionId) {
+    return inMemorySessionStore.has(sessionId);
+}
 /**
  * File prefix mapping for each state type
  */
@@ -24,16 +56,22 @@ export class StateManager {
     /**
      * Create a new state manager
      * @param stateType Type of state (analysis, recommendation)
-     * @param sessionId Unique session identifier (defaults to timestamp)
+     * @param sessionId Unique session identifier (defaults to UUID)
      * @param stateDir Directory to store state files (defaults to /tmp)
      */
     constructor(stateType = "analysis", sessionId, stateDir) {
         this.stateType = stateType;
-        this.sessionId = sessionId || Date.now().toString();
+        this.sessionId = sessionId || crypto.randomUUID();
         const baseDir = stateDir || os.tmpdir();
         const prefix = STATE_FILE_PREFIXES[stateType];
         this.stateFile = path.join(baseDir, `${prefix}-${this.sessionId}.json`);
     }
+    /**
+     * Create state manager from a sessionId (resolves the state file path internally)
+     */
+    static fromSessionId(sessionId, stateType = "recommendation", stateDir) {
+        return new StateManager(stateType, sessionId, stateDir);
+    }
     /**
      * Create state manager from existing state file path
      */
@@ -118,42 +156,24 @@ export class StateManager {
             throw new Error(`Failed to write state file: ${error.message}`);
         }
     }
-    /**
-     * Get the state file path
-     */
     getStatePath() {
         return this.stateFile;
     }
-    /**
-     * Get the session ID
-     */
     getSessionId() {
         return this.sessionId;
     }
-    /**
-     * Get the state type
-     */
     getStateType() {
         return this.stateType;
     }
-    /**
-     * Check if state file exists
-     */
     exists() {
         return fs.existsSync(this.stateFile);
     }
-    /**
-     * Delete the state file
-     */
     async delete() {
         if (this.exists()) {
             await fs.promises.unlink(this.stateFile);
             logger.debug(`Deleted state file: ${this.stateFile}`);
         }
     }
-    /**
-     * Get state file size in bytes
-     */
     async getSize() {
         if (!this.exists()) {
             return 0;
@@ -161,9 +181,6 @@ export class StateManager {
         const stats = await fs.promises.stat(this.stateFile);
         return stats.size;
     }
-    /**
-     * Get human-readable state file size
-     */
     async getSizeFormatted() {
         const bytes = await this.getSize();
         if (bytes === 0)