@skyramp/mcp 0.0.63-rc.5 → 0.0.63-rc.6

package/build/prompts/test-recommendation/analysisOutputPrompt.js

@@ -14,9 +14,14 @@ Read \`package.json\` / \`requirements.txt\`, \`docker-compose.yml\`, route/cont
 and model/schema files (Zod schemas, Pydantic models, TypeScript interfaces, DTOs)
 to understand the tech stack, endpoint shapes, auth mechanisms, and request/response schemas.
 
-### Step 2: Identify resource relationships
+### Step 2: Identify resource relationships and parameter locations
 Map how endpoints relate to each other — which POST creates resources consumed by other endpoints?
 **Resolve nested/sub-router paths** from the Router Mounting section above.
+**CRITICAL — Distinguish query params vs request body:** For each endpoint, determine whether
+parameters are sent as URL query params (typical for GET search/filter/list) or request body
+(typical for POST/PUT/PATCH). Look at FastAPI \`Query()\` annotations, Express \`req.query\` usage,
+Spring \`@RequestParam\`, Flask \`request.args\`, etc. Populate \`queryParams\` in interactions
+for GET endpoints that accept search/filter/pagination parameters.
 
 ${nextStep}`;
     }
@@ -28,7 +33,11 @@ ${nextStep}`;
 Read handler code for the changed endpoints and their model/schema files (Zod schemas,
 Pydantic models, DTOs) to understand request/response shapes. Find related endpoints via
 imports, shared models, adjacent route files. Resolve nested/sub-router paths from Router
-Mounting context.`
+Mounting context.
+**CRITICAL — Query params vs body:** For GET endpoints (especially search/filter/list),
+identify which parameters are URL query params vs request body. Look at framework-specific
+annotations (FastAPI \`Query()\`, Express \`req.query\`, Spring \`@RequestParam\`, etc.).
+Pass these as \`queryParams\` (not \`requestBody\`) when generating scenarios.`
         : isUIOnly
             ? `### Step 2: Identify consumed API endpoints
 UI-only PR — read changed components to find API calls (fetch, axios, hooks).`
@@ -50,11 +59,13 @@ Call \`skyramp_analyze_test_health\` with \`stateFile: "${p.stateFile ?? p.sessi
         : `### Step 3: Draft integration scenarios
 Draft multi-step scenarios simulating realistic user workflows:
 - **Cross-resource data flow**: Foreign key relationships, parent→child creation, verification
-- **Search/filter verification**: Create data, search, verify results
+- **Search/filter verification**: Create data, search for it using \`queryParams\`, verify results
 - **Negative/error paths**: Invalid references → appropriate errors
 - **UI user journeys**: Concrete browser steps for frontend changes
 
-**Quality:** Realistic request bodies, response data verification, actual field names for chaining.
+**Quality:** Realistic request bodies for POST/PUT/PATCH, \`queryParams\` for GET search/filter,
+response data verification, actual field names for chaining.
+**Parameter placement:** GET search/filter endpoints MUST use \`queryParams\`, not \`requestBody\`.
 
 ### Step 4: Call recommend tests
 Call \`skyramp_recommend_tests\` with \`sessionId: "${p.sessionId}"\``;

package/build/prompts/test-recommendation/recommendationSections.js

@@ -20,6 +20,13 @@ export function getAuthSnippets(authHeaderValue) {
     }
     return { authSchemeSnippet: "", authTokenSnippet: "" };
 }
+export const PATH_PARAM_UUID_GUIDANCE = `**Path parameters in contract/fuzz tests:** for endpoints with path params (e.g. \`/coupons/{coupon_id}\`), ` +
+    `keep the placeholder in \`endpointURL\` — do NOT substitute it. ` +
+    `Pass the concrete value separately via \`pathParams\` (e.g. \`coupon_id=3fa85f64-5717-4562-b3fc-2c963f66afa6\`). ` +
+    `This lets the CLI derive a clean filename from the resource name (\`coupons_GET_...\`) instead of the UUID. ` +
+    `Prefer example values from the OpenAPI schema (\`example\`, \`x-example\`, or enum values). ` +
+    `If no example exists, use a realistic UUID with varied hex digits such as \`3fa85f64-5717-4562-b3fc-2c963f66afa6\`. ` +
+    `Never use all-same-digit patterns like \`00000000-0000-0000-0000-000000000000\` or \`22222222-2222-2222-2222-222222222222\` — these look like placeholders and are rarely valid resource IDs.`;
 export function buildPrioritizationDimensions() {
     return `## Prioritization Dimensions (evaluate each candidate test)
 
@@ -145,7 +152,27 @@ replace them with accurate ones.
 
 **Available test types:**
 - **Integration** — multi-endpoint workflows that chain data across resources
-- **Contract** — response schema validation for new/changed endpoints
+- **Contract** — validates API contracts between services. Two distinct modes — choose based on role:
+  - **Provider contract test** (\`providerMode: true\`): Recommend when this codebase IS the API provider/owner.
+    Use when: new endpoints are added, existing responses are modified, an OpenAPI spec exists to validate against,
+    or you need to verify the implementation still honors its contracts after a code change.
+    The test calls the real provider and asserts the response conforms to the spec.
+  - **Consumer contract test** (\`consumerMode: true\`): Recommend when this codebase CALLS another service's API.
+    Use when: the service makes outbound HTTP calls to downstream APIs, you need to verify outbound requests
+    conform to the downstream contract, or you want to catch consumer-side drift before it reaches the provider.
+    The test uses a request-aware mock as the provider — no live downstream service needed.
+  - **Both modes** (\`providerMode: true, consumerMode: true\`): Recommend for service boundaries where this
+    codebase is simultaneously an API owner (upstream) AND a client of another service (downstream).
+  - **Default (neither set)**: generates a standard contract test equivalent to both modes. Use only when
+    the role is unclear or as a fallback when no spec is available.
+
+**Signal for consumer contract test:** Look for outbound HTTP client code (fetch, axios, httpx, requests, http.Client),
+service client classes, or calls to external base URLs in the codebase. If an endpoint's implementation
+makes downstream calls, that downstream boundary is a consumer contract test candidate.
+
+**Signal for provider contract test:** Look for new or modified endpoint handlers, route changes, response
+shape modifications, or the presence of an OpenAPI spec. If the diff adds/changes an endpoint this service owns,
+that is a provider contract test candidate.
 
 **Do NOT recommend Fuzz tests.** Fuzz testing is available as a manual tool but must not appear in automated recommendations.
 - **E2E** — user journeys spanning frontend to backend (needs Playwright traces)
@@ -170,7 +197,11 @@ export function buildToolWorkflows(authHeaderValue, authTypeValue = "") {
     let authGuidance;
     let authParams;
     if (noAuth) {
-        authGuidance = "";
+        authGuidance = `**Auth Verification Required:** The workspace config indicates no authentication, but you MUST verify this independently before omitting auth:
+1. **OpenAPI spec** \u2192 check \`securitySchemes\` / \`securityDefinitions\` for \`type: http\`, \`type: apiKey\`, or \`type: oauth2\`
+2. **Source code** \u2192 look for auth middleware (\`passport\`, \`jwt.verify\`, \`authMiddleware\`, \`@requires_auth\`, \`Depends(get_current_user)\`, \`@UseGuards\`), route guards, or token extraction logic
+3. **Route definitions** \u2192 check if routes have auth decorators or middleware applied
+If you find auth requirements, pass the appropriate \`authHeader\` (e.g., "Authorization") and \`authScheme\` (e.g., "Bearer") to EVERY tool call. Only pass \`authHeader: ""\` if you confirm the API is truly unauthenticated.`;
         authParams = { authHeader: "" };
     }
     else if (isAuthorizationHeader) {
@@ -203,7 +234,7 @@ To skip auth for unauthenticated endpoints, pass \`authHeader: ""\`.`;
     }
     const authCallParams = serializeAuthCallParams(authParams);
     const authHeaderLine = noAuth
-        ? `**No Auth:** This API does not require authentication. Pass \`authHeader: ""\` or omit auth params.`
+        ? `**No Auth (from workspace config):** Workspace indicates no authentication. **Verify independently** — if you find auth in the OpenAPI spec or source code, override with the correct \`authHeader\` and \`authScheme\`.`
         : `**Auth params:** \`${authCallParams}\` — pass to EVERY tool call below.`;
     return `## How to Generate Tests — Tool Workflows
 
@@ -212,10 +243,14 @@ ${authGuidance}
 
 **For multi-endpoint workflows (integration tests) — Scenario → Integration pipeline:**
 1. Call \`skyramp_scenario_test_generation\` once per step: \`scenarioName\`, \`destination\`,
-   \`baseURL\`, \`method\`, \`path\`, \`requestBody\`, \`responseBody\`, \`${authCallParams}\`.
+   \`baseURL\`, \`method\`, \`path\`, \`requestBody\` OR \`queryParams\`, \`responseBody\`, \`${authCallParams}\`.
    \`statusCode\` is optional — defaults: POST→201, DELETE→204, GET/PUT/PATCH→200. Only override for non-standard codes.
    **OpenAPI spec is NOT required.** \`apiSchema\` is OPTIONAL — omit it if no spec exists.
-   \`requestBody\` should use realistic field values from source code schemas (Zod, Pydantic, DTOs).
+   **CRITICAL — Query params vs request body:**
+   - For **POST/PUT/PATCH**: use \`requestBody\` with realistic field values from source code schemas.
+   - For **GET/DELETE with search/filter/pagination**: use \`queryParams\` (JSON string, e.g., \`{"q": "bear", "limit": 10}\`).
+     NEVER put query parameters in \`requestBody\` for GET requests — GET request bodies are non-standard and may be ignored or rejected.
+   - For **GET by ID**: no \`requestBody\` or \`queryParams\` needed — the ID is in the path.
    \`responseBody\` should match the actual API response shape from source code (including all fields
    returned by the controller — e.g., \`id\`, \`ownerId\`, \`createdAt\`, included relations like \`collection\`, \`tags\`).
    Wrap in \`{"response": ...}\` if the API uses an envelope pattern. If omitted, a synthetic response is generated.
@@ -233,6 +268,16 @@ ${authGuidance}
 If an OpenAPI spec exists, ALSO pass \`apiSchema\` — it enables schema-aware validation
 (contract tests verify response structure against the spec).
 Without a spec, \`endpointURL\` alone is sufficient.
+${PATH_PARAM_UUID_GUIDANCE}
+
+**Contract test mode selection — set based on this service's role at the boundary:**
+- \`providerMode: true\` — this service IS the API; validates the implementation matches the spec.
+  Use for new or modified endpoints this codebase owns, especially when an OpenAPI spec is present.
+- \`consumerMode: true\` — this service CALLS another API; validates outbound requests conform to the downstream contract.
+  Use when the endpoint's implementation makes HTTP calls to external services (look for fetch/axios/httpx/http.Client/service clients).
+  A request-aware mock stands in for the real downstream service — no live dependency needed.
+- Both — use when the service boundary is both a provider (owns an API) and a consumer (calls a downstream API).
+- Neither (default) — use only when the role is ambiguous or no spec is available.
 
 **For UI tests (no Playwright recording):**
 1. \`skyramp_start_trace_collection\` (playwright: true)

package/build/prompts/test-recommendation/test-recommendation-prompt.js

@@ -108,9 +108,10 @@ Affected services: ${diffContext.affectedServices.join(", ") || "N/A"}
         const detailBlocks = detailEndpoints
             .flatMap((ep) => (ep.methods ?? []).flatMap((m) => (m.interactions ?? []).map((i) => {
             const reqBody = i.request.body ? `\n    requestBody: ${JSON.stringify(i.request.body)}` : "";
+            const qParams = i.request.queryParams ? `\n    queryParams: ${JSON.stringify(i.request.queryParams)}` : "";
             const resBody = i.response.body ? `\n    responseBody: ${JSON.stringify(i.response.body)}` : "";
             const headers = i.request.headers ? `\n    headers: ${JSON.stringify(i.request.headers)}` : "";
-            return `  ${m.method} ${ep.path} → ${i.response.statusCode} (${i.type}): ${i.description}${reqBody}${resBody}${headers}`;
+            return `  ${m.method} ${ep.path} → ${i.response.statusCode} (${i.type}): ${i.description}${reqBody}${qParams}${resBody}${headers}`;
         })))
             .join("\n");
         interactionSection = `
@@ -118,7 +119,7 @@ Affected services: ${diffContext.affectedServices.join(", ") || "N/A"}
 ${summaryLines}
 
 ### Detailed (request/response bodies)
-${isDiffScope ? "Changed endpoints only. " : ""}Use source code schemas (Zod/Pydantic/DTOs) for actual request bodies.
+${isDiffScope ? "Changed endpoints only. " : ""}Use source code schemas (Zod/Pydantic/DTOs) for actual request bodies and query parameters.
 ${detailBlocks}
 `;
     }
@@ -131,24 +132,51 @@ ${detailBlocks}
             const scenarioBlocks = scenarios
                 .map((s) => {
                 const stepLines = s.steps.map((st) => `      ${st.order ?? ""}. **${st.method} ${st.path}** → ${st.expectedStatusCode ?? 200}: ${st.description || ""}`).join("\n");
-                const toolCalls = s.steps.map((st) => `      skyramp_scenario_test_generation({ scenarioName: "${s.scenarioName}", destination: "${s.scenarioName}", baseURL: "${baseUrl}", method: "${st.method}", path: "${st.path}", statusCode: ${st.expectedStatusCode ?? 200}, authHeader: "${authHeaderValue}"${authSchemeSnippet}${authTokenSnippet}, requestBody: <from source schemas for ${st.method} ${st.path}> })`).join("\n");
+                const toolCalls = s.steps.map((st) => {
+                    const isBodyMethod = ["POST", "PUT", "PATCH"].includes(st.method);
+                    const hasQueryParams = st.queryParams && Object.keys(st.queryParams).length > 0;
+                    const isIdPath = /\{\w+\}$/.test(st.path);
+                    let dataParam;
+                    if (isBodyMethod) {
+                        dataParam = `requestBody: <from source schemas for ${st.method} ${st.path}>`;
+                    }
+                    else if (hasQueryParams) {
+                        dataParam = `queryParams: '${JSON.stringify(st.queryParams)}'`;
+                    }
+                    else if (isIdPath) {
+                        dataParam = "";
+                    }
+                    else {
+                        dataParam = `queryParams: <derive from source code for ${st.method} ${st.path} as a JSON string of URL query params>`;
+                    }
+                    const dataSnippet = dataParam ? `, ${dataParam}` : "";
+                    const authSnippet = authHeaderValue
+                        ? `, authHeader: "${authHeaderValue}"${authSchemeSnippet}${authTokenSnippet}`
+                        : `, authHeader: <determine from OpenAPI spec securitySchemes or source code auth middleware — use "" ONLY if confirmed unauthenticated>`;
+                    return `      skyramp_scenario_test_generation({ scenarioName: "${s.scenarioName}", destination: "${s.scenarioName}", baseURL: "${baseUrl}", method: "${st.method}", path: "${st.path}", statusCode: ${st.expectedStatusCode ?? 200}${authSnippet}${dataSnippet} })`;
+                }).join("\n");
                 return (`  ### ${s.scenarioName} (${s.category}, ${s.priority})\n` +
                     `  ${s.description}\n` +
                     `  **Steps:**\n${stepLines}\n` +
                     `  **Chaining keys:** ${s.chainingKeys.join(", ") || "none"}\n` +
                     `  **Tool calls:**\n${toolCalls}\n` +
-                    `  Then: skyramp_integration_test_generation({ scenarioFile: "scenario_${s.scenarioName}.json", authHeader: "${authHeaderValue}"${authSchemeSnippet}${authTokenSnippet} })`);
+                    `  Then: skyramp_integration_test_generation({ scenarioFile: "scenario_${s.scenarioName}.json"${authHeaderValue ? `, authHeader: "${authHeaderValue}"${authSchemeSnippet}${authTokenSnippet}` : `, authHeader: <same auth as scenario calls above>`} })`);
             })
                 .join("\n\n");
+            const authWarning = !authHeaderValue
+                ? `\n**WARNING — No auth configured.** Before generating scenarios without auth, verify the API does not require authentication by checking the OpenAPI spec \`securitySchemes\` and source code auth middleware. If auth is needed, include \`authHeader\` (and \`authScheme\` if applicable) in every \`skyramp_scenario_test_generation\` call.\n`
+                : "";
             scenarioSection = `
 ## Drafted Scenarios
-**Base URL:** \`${baseUrl}\` | **Auth:** \`${authHeaderValue}\`${authTypeValue ? ` | **Auth type:** \`${authTypeValue}\`` : ""}
+**Base URL:** \`${baseUrl}\` | **Auth:** \`${authHeaderValue || "none (verify independently)"}\`${authTypeValue ? ` | **Auth type:** \`${authTypeValue}\`` : ""}${authWarning}
 
 Only use scenarios where resources are ACTUALLY related in the codebase. Replace any
 scenario that pairs unrelated resources with one reflecting real foreign key relationships.
 
 **Quality bar:** Realistic request bodies, actual foreign keys for chaining, response data
 verification (not just status codes), realistic test data (not "test product").
+**Query vs Body:** For GET/DELETE requests, use \`queryParams\` (not \`requestBody\`) for search terms,
+filters, pagination. Only POST/PUT/PATCH use \`requestBody\`.
 **Path verification:** Cross-reference paths against Router Mounting context — use correct
 nested paths. **Request bodies:** Replace placeholders with actual schemas from source code.
 
@@ -164,7 +192,8 @@ Draft at least 2-3 MEANINGFUL scenarios based on your codebase analysis:
 2. **Search/filter + verify** — create data, search, verify results
 3. **Error handling** — invalid cross-resource references → appropriate errors
 
-Use base URL: \`${analysis.apiEndpoints.baseUrl}\` and auth: \`${authHeaderValue}\`${authTypeValue ? ` (auth type: \`${authTypeValue}\`)` : ""}.
+Use base URL: \`${analysis.apiEndpoints.baseUrl}\` and auth: \`${authHeaderValue || "none — verify independently from OpenAPI spec and source code"}\`${authTypeValue ? ` (auth type: \`${authTypeValue}\`)` : ""}.
+${!authHeaderValue ? "**Verify auth requirements** from OpenAPI spec and source code before omitting auth headers." : ""}
 `;
         }
     }

package/build/prompts/test-recommendation/test-recommendation-prompt.test.js

@@ -242,6 +242,7 @@ describe("buildRecommendationPrompt — PR History section", () => {
         expect(getOccurrences).toBe(1);
         expect(recSection).toContain("contract — POST /api/items");
     });
+    // Ensure de-duplicates across different scenarios independently
     it("de-duplicates across different scenarios independently", () => {
         const ctx = makePRContext({
             previousRecommendations: [

package/build/prompts/testbot/testbot-prompts.js

@@ -2,7 +2,7 @@ import { ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { logger } from "../../utils/logger.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
-import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS } from "../test-recommendation/recommendationSections.js";
+import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS, PATH_PARAM_UUID_GUIDANCE } from "../test-recommendation/recommendationSections.js";
 function getTestbotPrompt(prTitle, prDescription, diffFile, testDirectory, summaryOutputFile, repositoryPath, baseBranch, maxRecommendations = MAX_RECOMMENDATIONS, maxGenerate = MAX_TESTS_TO_GENERATE, maxCritical = MAX_CRITICAL_TESTS, prNumber, userPrompt) {
     const promptSection = userPrompt ? `## Follow-up Request via @skyramp-testbot
 
@@ -119,6 +119,7 @@ Generate a net-new test. Use a unique descriptive filename to avoid overwriting
   For internal/microservice APIs: add \`providerMode: true\` to verify implementation matches the contract.
   For client-facing APIs consumed by frontend: add \`consumerMode: true\`.
   For critical service boundaries: pass both \`providerMode\` and \`consumerMode\`.
+- ${PATH_PARAM_UUID_GUIDANCE}
 - **E2E/UI**: only if relevant Playwright traces exist in \`${testDirectory}\`, repo root, or \`.skyramp/\`.
   Without traces, move to \`additionalRecommendations\`. Do NOT suggest calling \`skyramp_ui_test_generation\`
   or \`skyramp_e2e_test_generation\` — those require traces. Instead, tell the user to record Playwright

package/build/services/ScenarioGenerationService.js

@@ -134,6 +134,29 @@ ${JSON.stringify(traceRequest, null, 2)}
         const requestHeaders = {
             "Content-Type": ["application/json"],
         };
+        let queryParams = {};
+        if (params.queryParams) {
+            try {
+                const parsed = JSON.parse(params.queryParams);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    for (const [k, v] of Object.entries(parsed)) {
+                        queryParams[k] = Array.isArray(v)
+                            ? v.map(String)
+                            : [String(v)];
+                    }
+                }
+                else {
+                    logger.warning("queryParams JSON is not a plain object, ignoring", {
+                        queryParams: params.queryParams,
+                    });
+                }
+            }
+            catch {
+                logger.warning("Could not parse queryParams, ignoring", {
+                    queryParams: params.queryParams,
+                });
+            }
+        }
         const authHeaderName = params.authHeader ?? "";
         if (authHeaderName) {
             if (params.authToken) {
@@ -158,7 +181,7 @@ ${JSON.stringify(traceRequest, null, 2)}
             ResponseHeaders: responseHeaders,
             Method: method,
             Path: basePath ? basePath + params.path : params.path,
-            QueryParams: {},
+            QueryParams: queryParams,
             StatusCode: statusCode,
             Port: port,
             Timestamp: timestamp,

package/build/services/TestExecutionService.js

@@ -8,7 +8,7 @@ import { logger } from "../utils/logger.js";
 import { buildContainerEnv } from "./containerEnv.js";
 const DEFAULT_TIMEOUT = 300000; // 5 minutes
 const MAX_CONCURRENT_EXECUTIONS = 5;
-export const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.13";
+export const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.14";
 const DOCKER_PLATFORM = "linux/amd64";
 const EXECUTION_PROGRESS_INTERVAL = 10000; // 10 seconds between progress updates during execution
 // Temp file with valid empty JSON — used instead of /dev/null for .json config files

package/build/tools/executeSkyrampTestTool.js

@@ -99,7 +99,7 @@ For detailed documentation visit: https://www.skyramp.dev/docs/quickstart`,
                                     `Cannot determine SKYRAMP_TEST_BASE_URL — test file matches multiple services:`,
                                     ...candidates.map((c) => `  • ${c.serviceName}: ${c.baseUrl}`),
                                     ``,
-                                    `Re-invoke with SKYRAMP_TEST_BASE_URL set to the correct service URL, or make each service's outputDir unique in .skyramp/workspace.yml.`,
+                                    `Re-invoke with SKYRAMP_TEST_BASE_URL set to the correct service URL, or make each service's testDirectory unique in .skyramp/workspace.yml.`,
                                 ].join("\n"),
                             }],
                         isError: true,

package/build/tools/generate-tests/generateScenarioRestTool.js

@@ -2,6 +2,8 @@ import { z } from "zod";
 import { ScenarioGenerationService } from "../../services/ScenarioGenerationService.js";
 import { baseSchema, AUTH_PLACEHOLDER_TOKEN } from "../../types/TestTypes.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
+import { getWorkspaceAuthConfig, WorkspaceAuthType } from "../../utils/workspaceAuth.js";
+import { logger } from "../../utils/logger.js";
 const scenarioTestSchema = {
     scenarioName: z
         .string()
@@ -29,7 +31,16 @@ const scenarioTestSchema = {
     requestBody: z
         .string()
         .optional()
-        .describe("JSON string of the request body parsed by AI from the scenario"),
+        .describe("JSON string of the request body parsed by AI from the scenario. "
+        + "IMPORTANT: For GET and DELETE requests, do NOT put query/filter/search parameters here — use queryParams instead. "
+        + "requestBody should only contain data sent in the HTTP body (typically for POST, PUT, PATCH)."),
+    queryParams: z
+        .string()
+        .optional()
+        .describe("JSON string of URL query parameters (e.g., '{\"q\": \"bear\", \"limit\": 10}'). "
+        + "Use this for GET request filters, search terms, pagination, sorting — any parameter that belongs in the URL query string. "
+        + "CRITICAL: For search/filter/list endpoints (e.g., GET /products/search?q=bear&limit=10), parameters MUST go here, NOT in requestBody. "
+        + "GET request bodies are non-standard and may be ignored or rejected by servers and frameworks, so always encode these parameters in the URL query string instead of the request body."),
     responseBody: z
         .string()
         .optional()
@@ -91,7 +102,8 @@ Returns a single TraceRequest object with:
 The AI should parse the natural language scenario and provide:
 - HTTP method (POST, GET, PUT, DELETE)
 - API path with CONCRETE ID values, not templates (e.g., /api/v1/products/70885, NOT /api/v1/products/{product_id})
-- Request body (JSON string, if applicable)
+- Request body (JSON string) for POST/PUT/PATCH requests
+- Query parameters (JSON string) for GET search/filter/list requests — NEVER put query params in requestBody
 - Response body (JSON string, if applicable)
 - Status code (optional, defaults based on method)
 - Entity details (name, price, quantity, ID as needed)
@@ -112,6 +124,25 @@ When generating an integration test using the scenario file created by this tool
 Passing both scenarioFile and apiSchema/endpointURL will cause the test generation to fail.`,
         inputSchema: scenarioTestSchema,
     }, async (params) => {
+        if (!params.authHeader) {
+            try {
+                const repoPath = params.outputDir || process.cwd();
+                const wsAuth = await getWorkspaceAuthConfig(repoPath);
+                if (wsAuth.authHeader && wsAuth.authType !== WorkspaceAuthType.None) {
+                    logger.info("Auth header was empty — resolved from workspace config", {
+                        authHeader: wsAuth.authHeader,
+                        authType: wsAuth.authType,
+                    });
+                    params.authHeader = wsAuth.authHeader;
+                    if (/^authorization$/i.test(wsAuth.authHeader) && wsAuth.authType) {
+                        params.authScheme = params.authScheme || wsAuth.authType;
+                    }
+                }
+            }
+            catch {
+                logger.warning("Could not resolve auth from workspace config");
+            }
+        }
         const service = new ScenarioGenerationService();
         const result = await service.parseScenario(params);
         AnalyticsService.pushMCPToolEvent(TOOL_NAME, result, params).catch(() => {

package/build/tools/test-management/analyzeChangesTool.js

@@ -463,10 +463,15 @@ to produce a unified state file for the test health workflow.
                         if (methodObj) {
                             const alreadyHasStatus = methodObj.interactions.some((i) => i.response.statusCode === entry.statusCode);
                             if (!alreadyHasStatus) {
+                                const traceRequest = {};
+                                if (entry.requestBody)
+                                    traceRequest.body = entry.requestBody;
+                                if (entry.queryParams)
+                                    traceRequest.queryParams = entry.queryParams;
                                 methodObj.interactions.push({
                                     description: `${entry.method} ${entry.path} \u2192 ${entry.statusCode} (from trace)`,
                                     type: "success",
-                                    request: entry.requestBody ? { body: entry.requestBody } : {},
+                                    request: Object.keys(traceRequest).length > 0 ? traceRequest : {},
                                     response: {
                                         statusCode: entry.statusCode,
                                         description: `Observed in trace (${traceResult.format})`,

package/build/tools/test-management/executeTestsTool.js

@@ -140,7 +140,7 @@ back into the state file for use by \`skyramp_actions\`.
                                     `Cannot determine SKYRAMP_TEST_BASE_URL — one or more test files match multiple services:`,
                                     ...lines,
                                     ``,
-                                    `Re-invoke with SKYRAMP_TEST_BASE_URL set to the correct service URL, or make each service's outputDir unique in .skyramp/workspace.yml.`,
+                                    `Re-invoke with SKYRAMP_TEST_BASE_URL set to the correct service URL, or make each service's testDirectory unique in .skyramp/workspace.yml.`,
                                 ].join("\n"),
                             }],
                         isError: true,

package/build/tools/workspace/initializeWorkspaceTool.js

@@ -29,7 +29,7 @@ Fields per service:
       python  → pytest or robot
       typescript / javascript → playwright
       java → junit
-  outputDir — service root relative to repo root where the test files will be generated, e.g. "services/api-gateway"
+  testDirectory — service root relative to repo root where the test files will be generated, e.g. "services/api-gateway"
   api.schemaPath — path or URL to OpenAPI/Protobuf/GraphQL schema
     Search for: openapi.json, swagger.yaml, *.proto, *.graphql
     Framework defaults: FastAPI → /openapi.json, Express → /api-docs, Spring → /v3/api-docs
@@ -188,8 +188,8 @@ Create one service entry per deployable unit. You MUST include:
                         parts.push(svc.language);
                     if (svc.framework)
                         parts.push(svc.framework);
-                    if (svc.outputDir)
-                        parts.push(`@ ${svc.outputDir}`);
+                    if (svc.testDirectory)
+                        parts.push(`@ ${svc.testDirectory}`);
                     lines.push(`  - ${parts.join(" | ")}`);
                     if (svc.api?.schemaPath)
                         lines.push(`    API: ${svc.api.schemaPath}`);

package/build/types/RepositoryAnalysis.js

@@ -64,6 +64,7 @@ export const scenarioStepSchema = z.object({
     description: z.string(),
     interactionType: z.enum(["success", "error", "edge-case"]),
     requestBody: z.record(z.any()).optional(),
+    queryParams: z.record(z.any()).optional(),
     responseBody: z.record(z.any()).optional(),
     expectedStatusCode: z.number(),
     expectedResponseFields: z.array(z.string()).optional(),

package/build/utils/trace-parser.js

@@ -38,16 +38,27 @@ function sanitizeHeaders(headers) {
     return result;
 }
 function parseSkyrampTrace(data) {
-    return data.map((entry) => ({
-        method: (entry.method || entry.request?.method || "GET").toUpperCase(),
-        path: entry.path || entry.url || entry.request?.url || "/",
-        statusCode: entry.statusCode || entry.status || entry.response?.status || 0,
-        requestHeaders: entry.request?.headers ? sanitizeHeaders(entry.request.headers) : undefined,
-        requestBody: entry.request?.body || entry.requestBody,
-        responseHeaders: entry.response?.headers ? sanitizeHeaders(entry.response.headers) : undefined,
-        responseBody: summarizeBody(entry.response?.body || entry.responseBody),
-        timestamp: entry.timestamp || entry.request?.timestamp || "",
-    }));
+    return data.map((entry) => {
+        const rawQp = entry.QueryParams || entry.queryParams;
+        let queryParams;
+        if (rawQp && typeof rawQp === "object" && !Array.isArray(rawQp) && Object.keys(rawQp).length > 0) {
+            queryParams = {};
+            for (const [k, v] of Object.entries(rawQp)) {
+                queryParams[k] = Array.isArray(v) ? v.map(String) : [String(v)];
+            }
+        }
+        return {
+            method: (entry.method || entry.Method || entry.request?.method || "GET").toUpperCase(),
+            path: entry.path || entry.Path || entry.url || entry.request?.url || "/",
+            statusCode: entry.statusCode || entry.StatusCode || entry.status || entry.response?.status || 0,
+            requestHeaders: entry.request?.headers ? sanitizeHeaders(entry.request.headers) : undefined,
+            requestBody: entry.request?.body || entry.requestBody || entry.RequestBody,
+            queryParams,
+            responseHeaders: entry.response?.headers ? sanitizeHeaders(entry.response.headers) : undefined,
+            responseBody: summarizeBody(entry.response?.body || entry.responseBody || entry.ResponseBody),
+            timestamp: entry.timestamp || entry.Timestamp || entry.request?.timestamp || "",
+        };
+    });
 }
 function parseHarTrace(harData) {
     const entries = harData?.log?.entries || [];
@@ -79,12 +90,22 @@ function parseHarTrace(harData) {
                 resBody = res.content.text;
             }
         }
+        const queryParams = {};
+        url.searchParams.forEach((v, k) => {
+            if (queryParams[k]) {
+                queryParams[k].push(v);
+            }
+            else {
+                queryParams[k] = [v];
+            }
+        });
         return {
             method: (req.method || "GET").toUpperCase(),
-            path: url.pathname + (url.search || ""),
+            path: url.pathname,
             statusCode: res.status || 0,
             requestHeaders: sanitizeHeaders(reqHeaders),
             requestBody: reqBody,
+            queryParams: Object.keys(queryParams).length > 0 ? queryParams : undefined,
             responseHeaders: sanitizeHeaders(resHeaders),
             responseBody: summarizeBody(resBody),
             timestamp: entry.startedDateTime || "",

package/build/utils/workspaceAuth.js

@@ -20,12 +20,12 @@ export async function getWorkspaceAuthHeader(repositoryPath) {
  * Returns scheme+host+port for the service that owns the given test file.
  *
  * Matching strategy (in order):
- * 1. Filter services whose `outputDir` is a path prefix of `testFile`.
- * 2. If multiple services match (shared outputDir), narrow by `language`.
+ * 1. Filter services whose `testDirectory` is a path prefix of `testFile`.
+ * 2. If multiple services match (shared testDirectory), narrow by `language`.
  * 3. If still ambiguous, return all candidates so the LLM can resolve it —
  *    never guess when multiple services are plausible owners.
  *
- * e.g. repositoryPath=/repo, outputDir=backend/tests, testFile=/repo/backend/tests/test_api.py
+ * e.g. repositoryPath=/repo, testDirectory=backend/tests, testFile=/repo/backend/tests/test_api.py
  *   → { baseUrl: "http://localhost:8000", candidates: [] }
  */
 export async function getWorkspaceBaseUrl(repositoryPath, testFile, language) {
@@ -42,12 +42,12 @@ export async function getWorkspaceBaseUrl(repositoryPath, testFile, language) {
         const absTestFile = path.isAbsolute(testFile)
             ? testFile
             : path.resolve(repositoryPath, testFile);
-        // Step 1: filter by outputDir prefix
+        // Step 1: filter by testDirectory prefix
         let matches = services.filter((s) => {
-            if (!s.outputDir || !s.api?.baseUrl)
+            if (!s.testDirectory || !s.api?.baseUrl)
                 return false;
-            const absOutputDir = path.resolve(repositoryPath, s.outputDir);
-            return absTestFile.startsWith(absOutputDir + path.sep) || absTestFile === absOutputDir;
+            const absTestDirectory = path.resolve(repositoryPath, s.testDirectory);
+            return absTestFile.startsWith(absTestDirectory + path.sep) || absTestFile === absTestDirectory;
         });
         // Step 2: narrow by language if still ambiguous
         if (matches.length > 1 && language) {
@@ -64,7 +64,7 @@ export async function getWorkspaceBaseUrl(repositoryPath, testFile, language) {
             return {
                 baseUrl: undefined,
                 candidates: matches.map((s) => ({
-                    serviceName: s.serviceName ?? s.outputDir,
+                    serviceName: s.serviceName ?? s.testDirectory,
                     baseUrl: s.api.baseUrl,
                 })),
             };

package/build/utils/workspaceAuth.test.js

@@ -6,13 +6,13 @@ jest.mock("@skyramp/skyramp", () => {
             {
                 serviceName: "backend",
                 language: "python",
-                outputDir: "backend/tests",
+                testDirectory: "backend/tests",
                 api: { baseUrl: "http://localhost:8000" },
             },
             {
                 serviceName: "frontend",
                 language: "typescript",
-                outputDir: "frontend/tests",
+                testDirectory: "frontend/tests",
                 api: { baseUrl: "http://localhost:5173" },
             },
         ],
@@ -30,17 +30,17 @@ describe("getWorkspaceBaseUrl", () => {
         expect(result.baseUrl).toBeUndefined();
         expect(result.candidates).toHaveLength(0);
     });
-    it("should match backend service by outputDir prefix", async () => {
+    it("should match backend service by testDirectory prefix", async () => {
         const result = await getWorkspaceBaseUrl(REPO, `${REPO}/backend/tests/test_api.py`);
         expect(result.baseUrl).toBe("http://localhost:8000");
         expect(result.candidates).toHaveLength(0);
     });
-    it("should match frontend service by outputDir prefix", async () => {
+    it("should match frontend service by testDirectory prefix", async () => {
         const result = await getWorkspaceBaseUrl(REPO, `${REPO}/frontend/tests/auth.spec.ts`);
         expect(result.baseUrl).toBe("http://localhost:5173");
         expect(result.candidates).toHaveLength(0);
     });
-    it("should return no match when testFile does not match any service outputDir", async () => {
+    it("should return no match when testFile does not match any service testDirectory", async () => {
         const result = await getWorkspaceBaseUrl(REPO, `${REPO}/other/tests/test_something.py`);
         expect(result.baseUrl).toBeUndefined();
         expect(result.candidates).toHaveLength(0);
@@ -53,7 +53,7 @@ describe("getWorkspaceBaseUrl", () => {
                 services: [
                     {
                         serviceName: "api",
-                        outputDir: "tests",
+                        testDirectory: "tests",
                         api: { baseUrl: "http://localhost:8000/api/v2" },
                     },
                 ],
@@ -73,7 +73,7 @@ describe("getWorkspaceBaseUrl", () => {
         expect(result.baseUrl).toBeUndefined();
         expect(result.candidates).toHaveLength(0);
     });
-    it("should disambiguate by language when multiple services share the same outputDir", async () => {
+    it("should disambiguate by language when multiple services share the same testDirectory", async () => {
         const { WorkspaceConfigManager } = await import("@skyramp/skyramp");
         WorkspaceConfigManager.mockImplementationOnce(() => ({
             exists: jest.fn().mockResolvedValue(true),
@@ -82,13 +82,13 @@ describe("getWorkspaceBaseUrl", () => {
                     {
                         serviceName: "svc-python",
                         language: "python",
-                        outputDir: "shared/tests",
+                        testDirectory: "shared/tests",
                         api: { baseUrl: "http://localhost:8000" },
                     },
                     {
                         serviceName: "svc-ts",
                         language: "typescript",
-                        outputDir: "shared/tests",
+                        testDirectory: "shared/tests",
                         api: { baseUrl: "http://localhost:9000" },
                     },
                 ],
@@ -98,7 +98,7 @@ describe("getWorkspaceBaseUrl", () => {
         expect(result.baseUrl).toBe("http://localhost:8000");
         expect(result.candidates).toHaveLength(0);
     });
-    it("should return candidates when outputDir and language are both shared across services", async () => {
+    it("should return candidates when testDirectory and language are both shared across services", async () => {
         const { WorkspaceConfigManager } = await import("@skyramp/skyramp");
         WorkspaceConfigManager.mockImplementationOnce(() => ({
             exists: jest.fn().mockResolvedValue(true),
@@ -107,13 +107,13 @@ describe("getWorkspaceBaseUrl", () => {
                     {
                         serviceName: "svc-a",
                         language: "python",
-                        outputDir: "shared/tests",
+                        testDirectory: "shared/tests",
                         api: { baseUrl: "http://localhost:8000" },
                     },
                     {
                         serviceName: "svc-b",
                         language: "python",
-                        outputDir: "shared/tests",
+                        testDirectory: "shared/tests",
                         api: { baseUrl: "http://localhost:9000" },
                     },
                 ],
@@ -128,12 +128,30 @@ describe("getWorkspaceBaseUrl", () => {
             "http://localhost:9000",
         ]);
     });
+    it("should match service using testDirectory as the workspace field for test file lookup", async () => {
+        const { WorkspaceConfigManager } = await import("@skyramp/skyramp");
+        WorkspaceConfigManager.mockImplementationOnce(() => ({
+            exists: jest.fn().mockResolvedValue(true),
+            read: jest.fn().mockResolvedValue({
+                services: [
+                    {
+                        serviceName: "api",
+                        testDirectory: "tests",
+                        api: { baseUrl: "http://localhost:9000" },
+                    },
+                ],
+            }),
+        }));
+        const result = await getWorkspaceBaseUrl(REPO, `${REPO}/tests/test_api.py`);
+        expect(result.baseUrl).toBe("http://localhost:9000");
+        expect(result.candidates).toHaveLength(0);
+    });
     it("should return no match when matched service baseUrl is not a valid URL", async () => {
         const { WorkspaceConfigManager } = await import("@skyramp/skyramp");
         WorkspaceConfigManager.mockImplementationOnce(() => ({
             exists: jest.fn().mockResolvedValue(true),
             read: jest.fn().mockResolvedValue({
-                services: [{ api: { baseUrl: "not-a-valid-url" }, outputDir: "tests" }],
+                services: [{ api: { baseUrl: "not-a-valid-url" }, testDirectory: "tests" }],
             }),
         }));
         const result = await getWorkspaceBaseUrl(REPO, `${REPO}/tests/test_api.py`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyramp/mcp",
-  "version": "0.0.63-rc.5",
+  "version": "0.0.63-rc.6",
   "main": "build/index.js",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.24.3",
     "@playwright/test": "^1.55.0",
-    "@skyramp/skyramp": "1.3.13",
+    "@skyramp/skyramp": "1.3.14",
     "dockerode": "^4.0.6",
     "fast-glob": "^3.3.3",
     "simple-git": "^3.30.0",