@skyramp/mcp 0.0.63 → 0.0.64-rc.2

package/build/prompts/testbot/testbot-prompts.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { logger } from "../../utils/logger.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
 import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS, PATH_PARAM_UUID_GUIDANCE } from "../test-recommendation/recommendationSections.js";
-function getTestbotPrompt(prTitle, prDescription, diffFile, testDirectory, summaryOutputFile, repositoryPath, baseBranch, maxRecommendations = MAX_RECOMMENDATIONS, maxGenerate = MAX_TESTS_TO_GENERATE, maxCritical = MAX_CRITICAL_TESTS, prNumber, userPrompt) {
+function getTestbotPrompt(prTitle, prDescription, diffFile, testDirectory, summaryOutputFile, repositoryPath, baseBranch, maxRecommendations = MAX_RECOMMENDATIONS, maxGenerate = MAX_TESTS_TO_GENERATE, _maxCritical = MAX_CRITICAL_TESTS, prNumber, userPrompt) {
     const promptSection = userPrompt ? `## Follow-up Request via @skyramp-testbot
 
 <USER_PROMPT>
@@ -32,12 +32,7 @@ Use those recommendations as your baseline. Only add or remove tests that the us
 Read the diff at \`${diffFile}\`.
 If all changed files are non-application (CI/CD, docs, lock files, config only) → skip to Step 4 (Submit Report) with empty arrays.
 
-Otherwise:
-1. Call \`skyramp_analyze_repository\` with \`repositoryPath\`: "${repositoryPath}", \`analysisScope\`: "current_branch_diff"${baseBranch ? `\n   , \`baseBranch\`: "${baseBranch}"` : ''}
-2. Call \`skyramp_recommend_tests\` with the returned \`sessionId\`.
-   It returns 10 ranked recommendations. Walk through them in rank order and generate
-   up to 4 tests. Any recommendation you skip or cannot generate goes to
-   \`additionalRecommendations\`.`;
+Otherwise: proceed to the numbered steps below.`;
     return `<TITLE>${prTitle}</TITLE>
 <DESCRIPTION>${prDescription}</DESCRIPTION>
 <CODE CHANGES>${diffFile}</CODE CHANGES>
@@ -53,7 +48,7 @@ working tree. Step 2/3 handles their maintenance (drift detection, health checks
 Only generate tests for NEW endpoints or code paths not already covered by existing bot
 tests. The analyze tool uses PR comment history to avoid duplicates.
 
-1. Call \`skyramp_analyze_changes\` with \`repositoryPath\`: "${repositoryPath}", \`scope\`: "branch_diff", \`topN\`: ${maxRecommendations}${prNumber ? `, \`prNumber\`: ${prNumber}` : ""} — discovers existing Skyramp tests, scans endpoints changed in the diff, loads workspace config, and returns ${maxRecommendations} ranked ADD recommendations.${prNumber ? " Uses PR comment history to avoid re-recommending already-generated tests." : ""}
+1. Call \`skyramp_analyze_changes\` with \`repositoryPath\`: "${repositoryPath}", \`scope\`: "branch_diff", \`topN\`: ${maxRecommendations}${baseBranch ? `, \`baseBranch\`: "${baseBranch}"` : ""}${prNumber ? `, \`prNumber\`: ${prNumber}` : ""} — discovers existing Skyramp tests, scans endpoints changed in the diff, loads workspace config, and returns ${maxRecommendations} ranked ADD recommendations.${prNumber ? " Uses PR comment history to avoid re-recommending already-generated tests." : ""}
 2. Call \`skyramp_analyze_test_health\` with the \`stateFile\` from step 1 (skip if zero existing tests found) — scores each existing test for drift against the diff and assigns UPDATE / REGENERATE / VERIFY / ADD actions.
 
 ---
@@ -93,10 +88,11 @@ Test/Endpoint | Action | Reason
 ## Step 3: Act
 
 Execute the actions from Step 2.
-- **Total generated**: EXACTLY ${maxGenerate} tests from the highest-ranked candidates. Do NOT generate fewer.
-- **Critical categories first**: up to ${Math.min(maxCritical, maxGenerate)} of the ${maxGenerate} tests MUST be from critical categories (security_boundary, business_rule, data_integrity, breaking_change).
-- **Fill remaining slots**: fill the remaining ${Math.max(maxGenerate - Math.min(maxCritical, maxGenerate), 0)} slot(s) with workflow/general candidates.
-- Critical-category tests MUST be in the generated set even if a workflow test scores higher on sophistication.
+- **Total generated**: Follow the **"Budget: N generate"** line in the Execution Plan returned by the analysis (section "## Execution Plan", "Budget: N generate + M additional = T total"). Generate exactly the GENERATE-tagged items in that plan. Do NOT generate fewer.
+- **UI test priority**: If the diff contains frontend/UI changes (e.g. \`.tsx\`, \`.jsx\`, \`.vue\`, \`.svelte\` files), you MUST attempt to generate at least one UI test. Use \`browser_navigate\` to the app's base URL — if the app responds, record a trace and generate the test. Only skip if the app is unreachable. This takes priority over generating additional backend-only tests.
+- **Critical categories first**: At least 1 of the generated tests MUST be from a critical category (new_endpoint, security_boundary, business_rule, data_integrity, breaking_change) if such candidates exist in the GENERATE set.
+- **Fill remaining slots**: Generate GENERATE-tagged items in the exact order listed. Do not skip or reorder.
+- Critical-category tests are already ranked first by the pre-computed scores — follow the plan order.
 
 ### UPDATE
 Edit the existing test file directly:
@@ -111,6 +107,16 @@ Use the same filename so it overwrites the old file.
 ### ADD
 Generate a net-new test. Use a unique descriptive filename to avoid overwriting existing files.
 
+**Auth — determine ONCE, apply to EVERY tool call:**
+1. Start from the Execution Plan returned by \`skyramp_analyze_changes\` — it includes pre-resolved auth params.
+2. **Override check (MANDATORY when workspace shows \`authType: none\` or \`authHeader: ""\`):** Read the source code for auth middleware — \`HTTPBearer\`, \`EnsureSessionDep\`, \`jwt.verify\`, \`@UseGuards\`, \`Depends(get_current_user)\`, \`passport\`, session middleware. If found, the workspace config is misconfigured — override with the correct \`authHeader\` and \`authScheme\` regardless.
+3. **For \`Authorization\` Bearer APIs:** pass \`authScheme: "Bearer"\` (or the correct scheme) to \`skyramp_scenario_test_generation\` and \`skyramp_contract_test_generation\` — this embeds auth in the generated test file so the executor sends the correct header at run time. **NEVER pass \`authToken\` with a fabricated value** — omitting \`authToken\` auto-inserts \`SKYRAMP_PLACEHOLDER_TOKEN\` correctly.
+   **Exception — \`skyramp_integration_test_generation\` with \`scenarioFile\` only:**
+   - If workspace has \`api.authType\` set: omit auth params entirely — passing auth here alongside workspace \`authType\` causes "Auth header and auth type cannot be supported at the same time".
+   - If workspace has no \`api.authType\`: pass \`authHeader\` only (no \`authScheme\`).
+4. **For non-Authorization headers** (e.g. \`X-Api-Key\`, \`Cookie\`): pass \`authHeader\` only — placeholder is auto-generated. Do NOT invent a token value.
+5. Only pass \`authHeader: ""\` if you can confirm the endpoint is truly unauthenticated.
+
 **How to generate each type (for ADD and REGENERATE):**
 - **Integration**: call \`skyramp_scenario_test_generation\` per step (sequentially), then \`skyramp_integration_test_generation\` with the scenario file.
   Scenario JSON goes in the same \`outputDir\` (e.g. \`tests/scenario_<name>.json\`), not \`.skyramp/\`.
@@ -120,15 +126,31 @@ Generate a net-new test. Use a unique descriptive filename to avoid overwriting
   For client-facing APIs consumed by frontend: add \`consumerMode: true\`.
   For critical service boundaries: pass both \`providerMode\` and \`consumerMode\`.
 - ${PATH_PARAM_UUID_GUIDANCE}
-- **E2E/UI**: only if relevant Playwright traces exist in \`${testDirectory}\`, repo root, or \`.skyramp/\`.
-  Without traces, move to \`additionalRecommendations\`. Do NOT suggest calling \`skyramp_ui_test_generation\`
-  or \`skyramp_e2e_test_generation\` — those require traces. Instead, tell the user to record Playwright
-  traces (via \`skyramp_start_trace_collection\` / \`skyramp_stop_trace_collection\`), commit the trace
-  files to the repo, and re-run Testbot so it can generate the tests.
+- **UI**: First check for existing Playwright trace \`.zip\` files in the repo (Testbot scans recursively up to 5 directory levels — \`${testDirectory}\`, \`frontend/\`, \`public/\`, \`.skyramp/\`, or any subdirectory).
+  If a relevant trace exists (covers the UI changes in this PR), use it directly with \`skyramp_ui_test_generation\`.
+  If NO relevant trace exists, record one using Playwright browser tools:
+    1. \`browser_navigate\` to the app's base URL (from workspace config \`api.baseUrl\`)
+    2. \`browser_snapshot\` to see the current page (ARIA tree)
+    3. Use \`browser_click\`, \`browser_type\`, \`browser_fill_form\`, etc. to perform the user interactions described in the test recommendation
+    4. \`browser_snapshot\` after each interaction that changes the page
+    5. \`skyramp_export_zip\` with an **absolute** output path: \`<repositoryPath>/.skyramp/<test_name>_trace.zip\`
+    6. \`skyramp_ui_test_generation\` with \`playwrightInput\` set to the **absolute** path of the exported zip
+  If \`browser_navigate\` fails (app not running / connection refused), move to \`additionalRecommendations\` with the failure reason.
+  Record at most 1-2 UI traces per run to stay within tool call budget.
+  Tips: Use \`browser_snapshot\` liberally. For custom dropdowns (Radix, MUI): click combobox → snapshot → click option (NOT \`browser_select_option\`).
+- **E2E**: Only if BOTH a backend trace \`.json\` AND a Playwright \`.zip\` already exist in the repo. Without both, move to \`additionalRecommendations\`.
 - Skip smoke tests entirely.
 
 **Scenario quality:** Verify preconditions before each step (e.g. create before update).
 
+### Failure Recovery (MANDATORY)
+If a test generation tool call fails:
+1. **Retry once** with the same parameters.
+2. If it fails again, **skip** that candidate and move to the next ranked candidate.
+3. If all candidates in the GENERATE set fail, fall back to generating the **simplest possible test**: a single contract test for the highest-scored endpoint (GET → 200 or POST → 201).
+4. You MUST generate **at least 1 test** for any PR that touches application code. Zero generated tests is NOT acceptable.
+5. Log skipped candidates in \`issuesFound\` with the error message.
+
 **After generation, fix chaining only:**
 - Path params like \`id = 'id'\` → \`skyramp.get_response_value(prev_response, "id")\`
 - Hardcoded IDs in request bodies → dynamic values from prior response
@@ -151,7 +173,7 @@ Call \`skyramp_submit_report\` with \`summaryOutputFile\`: "${summaryOutputFile}
 \`commitMessage\`: under 72 chars, e.g. "add integration tests for /products and /orders"
 
 **newTestsCreated** — files that are new to the repo (ADD or REGENERATE actions, at most ${maxGenerate}):
-   \`testId\`, \`testType\`, \`category\`, \`endpoint\`, \`fileName\`, \`description\`, \`scenarioFile\`, \`reasoning\`
+   \`testId\` (human-readable kebab-case, e.g. \`contract-get-products\`), \`testType\`, \`category\`, \`endpoint\`, \`fileName\`, \`description\`, \`scenarioFile\`, \`reasoning\`
    If no tests were generated, pass an empty array.
    If you created a test and then fixed it (chaining, compilation, imports), report it only here.
 
@@ -161,12 +183,12 @@ Call \`skyramp_submit_report\` with \`summaryOutputFile\`: "${summaryOutputFile}
    Do NOT include files that were newly created in this run (those go in \`newTestsCreated\`).
 
 **additionalRecommendations** — items you could not act on (quota exceeded, missing traces, etc.):
-   \`testId\`, \`testType\`, \`category\`, \`scenarioName\`, \`priority\`, \`description\`, \`steps\`, \`reasoning\`
+   \`testId\` (human-readable kebab-case, e.g. \`integration-products-orders-workflow\`), \`testType\`, \`category\`, \`scenarioName\`, \`priority\` (high/medium/low — used for sorting, not displayed), \`description\`, \`steps\`, \`reasoning\`
    Keep each \`description\` to one sentence. Omit \`requestBody\` and \`responseBody\` from steps.
    Include at most 3 steps per recommendation.
-   If a test cannot be generated because Playwright/UI traces are missing, include it here
-   (not in \`issuesFound\`). Tell the user to record traces and commit them so Testbot can
-   generate E2E/UI tests on the next run. Do NOT suggest calling generation tools directly.
+   If a UI test cannot be generated because trace recording failed (app not accessible, browser error),
+   include it here (not in \`issuesFound\`) with the failure reason.
+   If an E2E test cannot be generated because the app was not running (browser_navigate failed), include it here with the failure reason.
 
 **nextSteps** — actionable next steps when test failures suggest misconfiguration.
    Each entry must be a single-line string (no embedded newlines).

package/build/services/ModularizationService.js

@@ -9,7 +9,7 @@ export class ModularizationService {
             testType: params.testType,
             language: params.language,
         });
-        const testType = params.testType;
+        const testType = (params.testType || TestType.UI);
         // Check if the test type is one that should not be modularized
         if (!params.isTraceBased) {
             return {

package/build/services/TestExecutionService.js

@@ -8,7 +8,7 @@ import { logger } from "../utils/logger.js";
 import { buildContainerEnv } from "./containerEnv.js";
 const DEFAULT_TIMEOUT = 300000; // 5 minutes
 const MAX_CONCURRENT_EXECUTIONS = 5;
-export const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.15";
+export const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.16";
 const DOCKER_PLATFORM = "linux/amd64";
 const EXECUTION_PROGRESS_INTERVAL = 10000; // 10 seconds between progress updates during execution
 // Temp file with valid empty JSON — used instead of /dev/null for .json config files

package/build/services/TestGenerationService.js

@@ -6,6 +6,7 @@ import { getPathParameterValidationError, OUTPUT_DIR_FIELD_NAME, PATH_PARAMS_FIE
 import { getEntryPoint } from "../utils/telemetry.js";
 import { getLanguageSteps } from "../utils/language-helper.js";
 import { logger } from "../utils/logger.js";
+import { normalizeLanguageParams } from "../utils/normalizeParams.js";
 export class TestGenerationService {
     client;
     constructor() {
@@ -13,6 +14,8 @@ export class TestGenerationService {
     }
     async generateTest(params) {
         try {
+            // Normalize language/framework to handle LLM case variations
+            normalizeLanguageParams(params);
             // Log prompt parameter using reusable utility
             logger.info("Generating test", {
                 prompt: params.prompt,
@@ -220,7 +223,11 @@ The generated test file remains unchanged and ready to use as-is.
                     }
                 }
             }
-            delete generateOptions.authType;
+            // Map authScheme → authType for the npm client which uses authType internally
+            if (generateOptions.authScheme !== undefined) {
+                generateOptions.authType = generateOptions.authScheme;
+            }
+            delete generateOptions.authScheme;
             const result = await this.client.generateRestTest(generateOptions);
             // Check if the result indicates failure
             if (result && result.length > 0) {

package/build/services/TestGenerationService.test.js

@@ -92,7 +92,7 @@ describe("TestGenerationService — authType/authScheme not passed to library",
             generateRestTest: mockGenerateRestTest,
         }));
     });
-    it("strips authType but keeps authScheme", async () => {
+    it("maps authScheme to authType for the npm client", async () => {
         const svc = new StubService();
         svc.buildGenerationOptions = () => ({
             authHeader: "Authorization",
@@ -105,8 +105,8 @@ describe("TestGenerationService — authType/authScheme not passed to library",
         svc.handleApiAnalysis = async () => null;
         await svc.generateTest({ ...BASE });
         const callArgs = mockGenerateRestTest.mock.calls[0][0];
-        expect(callArgs.authType).toBeUndefined();
-        expect(callArgs.authScheme).toBe("Token");
+        expect(callArgs.authType).toBe("Token");
+        expect(callArgs.authScheme).toBeUndefined();
         expect(callArgs.authHeader).toBe("Authorization");
     });
     it("passes authHeader through to library without modification", async () => {
@@ -259,8 +259,8 @@ describe("TestGenerationService — trace-based auth in executeGeneration", () =
         await svc.generateTest({ ...BASE });
         const callArgs = mockGenerateRestTest.mock.calls[0][0];
         expect(callArgs.authHeader).toBe("Authorization");
-        expect(callArgs.authScheme).toBe("Token");
-        expect(callArgs.authType).toBeUndefined();
+        expect(callArgs.authType).toBe("Token");
+        expect(callArgs.authScheme).toBeUndefined();
     });
     it("populates X-Api-Key from trace with empty authScheme", async () => {
         const traceFile = writeTrace([
@@ -284,8 +284,8 @@ describe("TestGenerationService — trace-based auth in executeGeneration", () =
         await svc.generateTest({ ...BASE });
         const callArgs = mockGenerateRestTest.mock.calls[0][0];
         expect(callArgs.authHeader).toBe("X-Api-Key");
-        expect(callArgs.authScheme).toBe("");
-        expect(callArgs.authType).toBeUndefined();
+        expect(callArgs.authType).toBe("");
+        expect(callArgs.authScheme).toBeUndefined();
     });
     it("overrides conflicting authScheme with trace value", async () => {
         const traceFile = writeTrace([
@@ -309,8 +309,8 @@ describe("TestGenerationService — trace-based auth in executeGeneration", () =
         await svc.generateTest({ ...BASE });
         const callArgs = mockGenerateRestTest.mock.calls[0][0];
         expect(callArgs.authHeader).toBe("Authorization");
-        expect(callArgs.authScheme).toBe("Token");
-        expect(callArgs.authType).toBeUndefined();
+        expect(callArgs.authType).toBe("Token");
+        expect(callArgs.authScheme).toBeUndefined();
     });
     it("does not override auth when trace has no auth header", async () => {
         const traceFile = writeTrace([
@@ -333,7 +333,7 @@ describe("TestGenerationService — trace-based auth in executeGeneration", () =
         await svc.generateTest({ ...BASE });
         const callArgs = mockGenerateRestTest.mock.calls[0][0];
         expect(callArgs.authHeader).toBe("Authorization");
-        expect(callArgs.authScheme).toBe("Bearer");
-        expect(callArgs.authType).toBeUndefined();
+        expect(callArgs.authType).toBe("Bearer");
+        expect(callArgs.authScheme).toBeUndefined();
     });
 });

package/build/tools/code-refactor/modularizationTool.js

@@ -1,23 +1,30 @@
 import { z } from "zod";
+import fs from "fs";
 import { logger } from "../../utils/logger.js";
 import { TestType } from "../../types/TestTypes.js";
 import { ModularizationService, } from "../../services/ModularizationService.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
+import { normalizeLanguageParams, resolveParamAliases, } from "../../utils/normalizeParams.js";
 const modularizationSchema = {
     testFile: z
         .string()
         .describe("The test file to process with modularization principles applied"),
-    language: z.string().describe("The programming language of the test file"),
+    language: z
+        .string()
+        .optional()
+        .describe("The programming language of the test file. Inferred from file extension if not provided."),
     testType: z
         .enum([TestType.UI, TestType.E2E, TestType.INTEGRATION])
-        .describe("Specifies the type of test (UI, E2E, or Integration). DO NOT USE TEST NAME/DESCRIPTION AS TEST TYPE. ONLY USE UI, E2E, OR INTEGRATION."),
+        .optional()
+        .describe("Specifies the type of test (UI, E2E, or Integration). Defaults to 'ui'. DO NOT USE TEST NAME/DESCRIPTION AS TEST TYPE."),
     isTraceBased: z
         .boolean()
         .default(false)
-        .describe("Whether the test is generated from traces. Scan the test file and check if the test is generated from traces."),
+        .describe("Whether the test is generated from traces. MUST be set to true when the test was generated from a Playwright trace (browser_* tools + skyramp_export_zip) or from skyramp_start/stop_trace_collection."),
     prompt: z
         .string()
-        .describe("The prompt or code content to process with modularization principles applied"),
+        .optional()
+        .describe("The prompt or code content to process. If not provided, the test file content is used."),
 };
 const TOOL_NAME = "skyramp_modularization";
 export function registerModularizationTool(server) {
@@ -44,10 +51,45 @@ After modularization, if errors remain, call skyramp_fix_errors.
     }, async (params) => {
         let errorResult;
         try {
+            // Resolve aliases and normalize
+            resolveParamAliases(params, {
+                testFilePath: "testFile",
+                file: "testFile",
+            });
+            normalizeLanguageParams(params);
+            // Infer language from file extension if not provided
+            if (!params.language && params.testFile) {
+                if (params.testFile.endsWith(".ts"))
+                    params.language = "typescript";
+                else if (params.testFile.endsWith(".js"))
+                    params.language = "javascript";
+                else if (params.testFile.endsWith(".py"))
+                    params.language = "python";
+                else if (params.testFile.endsWith(".java"))
+                    params.language = "java";
+                else
+                    params.language = "typescript";
+            }
+            // Default testType to 'ui'
+            if (!params.testType)
+                params.testType = TestType.UI;
+            // For UI/E2E/Integration tests, always enable modularization.
+            // These test types are trace-based and benefit from modularization.
+            if (!params.isTraceBased && [TestType.UI, TestType.E2E, TestType.INTEGRATION].includes(params.testType))
+                params.isTraceBased = true;
+            // Default prompt to test file content
+            if (!params.prompt && params.testFile) {
+                try {
+                    params.prompt = fs.readFileSync(params.testFile, "utf8");
+                }
+                catch {
+                    params.prompt = `Modularize the test in ${params.testFile}`;
+                }
+            }
             logger.info("Generating modularization", {
                 testFile: params.testFile,
                 language: params.language,
-                prompt: params.prompt,
+                prompt: params.prompt?.substring(0, 100),
                 testType: params.testType,
             });
             const service = new ModularizationService();
@@ -69,10 +111,10 @@ After modularization, if errors remain, call skyramp_fix_errors.
         }
         finally {
             AnalyticsService.pushMCPToolEvent(TOOL_NAME, errorResult, {
-                prompt: params.prompt,
+                prompt: params.prompt ? `[${params.prompt.length} chars]` : "",
                 testFile: params.testFile,
-                language: params.language,
-                testType: params.testType,
+                language: params.language ?? "",
+                testType: params.testType ?? "",
             });
         }
     });

package/build/tools/generate-tests/generateContractRestTool.js

@@ -96,16 +96,24 @@ export class ContractTestService extends TestGenerationService {
         const result = await super.generateTest(params);
         if (result.isError)
             return result;
-        const postInstructions = this.buildSampleDataInstructions(params);
-        if (!postInstructions)
-            return result;
-        return {
-            ...result,
-            content: [
-                ...result.content,
-                { type: "text", text: postInstructions },
-            ],
-        };
+        const content = [...result.content];
+        const sampleDataInstructions = this.buildSampleDataInstructions(params);
+        if (sampleDataInstructions) {
+            content.push({ type: "text", text: sampleDataInstructions });
+        }
+        if (params.providerMode) {
+            content.push({
+                type: "text",
+                text: this.buildAssertionEnhancementInstructions(),
+            });
+        }
+        if (params.consumerMode) {
+            content.push({
+                type: "text",
+                text: this.buildConsumerStubReplacementInstructions(),
+            });
+        }
+        return { ...result, content };
     }
     buildSampleDataInstructions(params) {
         const sections = [];
@@ -114,7 +122,7 @@ export class ContractTestService extends TestGenerationService {
             sections.push("- **Parent provisioning request data**: the inline JSON/dict literals passed as request bodies inside setup/teardown functions that create parent resources.");
         }
         return `
-⏭️ **CRITICAL NEXT STEP — Replace unrealistic placeholder values in sample data only:**
+⏭️ **CRITICAL STEP 1 OF 2 — Do this immediately along with test generation:**
 
 Inspect the following locations in the generated file and replace any placeholder values with realistic ones:
 
@@ -136,7 +144,7 @@ ${sections.join("\n")}
 2. Find only the inline JSON/dict literals identified above.
 3. Replace every placeholder value using the rules above.
 4. Leave all realistic values unchanged.
-5. Write the updated file. Stop there.
+5. Write the updated file. Then immediately proceed to STEP 2 OF 2.
 
 **What NOT to do — any of these is a violation:**
 - Do NOT change function signatures, method names, class names, imports, or variable names.
@@ -147,6 +155,111 @@ ${sections.join("\n")}
 - Do NOT extract, hoist, or expose any request body or data as a global variable, module-level constant, or shared fixture — keep all data inline exactly where it already is.
 - Do NOT reference or reuse request body data across functions for comparison or any other purpose.
 - Do NOT make any other "improvements" beyond the value replacements described above.
+`;
+    }
+    buildAssertionEnhancementInstructions() {
+        return `
+⏭️ **CRITICAL STEP 2 OF 2 — Do this immediately along with test generation:**
+
+**Enhance response body assertions in test functions immediately.** Do NOT proceed to test execution until this step is complete.
+
+The generated contract test contains only basic assertions (status code, top-level schema checks). For each **test function** (NOT \`beforeAll\` or \`afterAll\`), inspect the response body assertions and add or strengthen them using the rules below.
+
+---
+
+**IMPORTANT — How to access response body fields (use the SDK helpers, NOT dict/attribute access on the response variable):**
+
+- **Python**: \`skyramp.get_response_value(<response_var>, "<json_path>")\`
+  - e.g. \`skyramp.get_response_value(products_POST_response, "id")\`
+  - e.g. \`skyramp.get_response_value(orders_POST_response, "items.0.product_id")\`
+- **TypeScript (Playwright)**: \`getResponseValue(<response_var>, "<json_path>")\` (already imported from \`@skyramp/skyramp\`)
+  - e.g. \`getResponseValue(productsPostResponse, "id")\`
+- **JavaScript (Playwright)**: \`getResponseValue(<response_var>, "<json_path>")\` (already imported from \`@skyramp/skyramp\`)
+  - e.g. \`getResponseValue(productsPostResponse, "id")\`
+- **Java**: \`getValue(<response_var>, "<json_path>")\` (already imported)
+  - e.g. \`getValue(productsPostResponse, "id")\`
+
+---
+
+**What to assert after each request:**
+
+1. **Non-null / non-empty fields** — After any POST or PUT that creates or updates a resource, assert that key identifying fields are present and non-empty:
+   - IDs, names, emails, and other primary fields must not be null/None/empty.
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "id") is not None\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "id"), 'id').not.toBeNull();\`
+   - JavaScript: \`assert.notStrictEqual(getResponseValue(productsPostResponse, "id"), null, 'id should not be null');\`
+   - Java: \`assertNotNull(getValue(productsPostResponse, "id"));\`
+
+2. **Echo-back values** — When the request body sends a value the response is expected to return unchanged (name, email, status, price, etc.), assert the response value equals the sent value:
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "name") == "Skyramp Tester"\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "name"), 'name').toBe("Skyramp Tester");\`
+   - JavaScript: \`assert.strictEqual(getResponseValue(productsPostResponse, "name"), "Skyramp Tester", 'name should match request');\`
+   - Java: \`assertEquals("Skyramp Tester", getValue(productsPostResponse, "name"));\`
+
+3. **Value ranges** — For numeric fields where a realistic range is inferable from the field name, schema constraints (minimum/maximum), or domain knowledge:
+   - Assert the value falls within the expected range.
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "price") >= 0\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "price")).toBeGreaterThanOrEqual(0);\`
+   - JavaScript: \`assert.ok(getResponseValue(productsPostResponse, "price") >= 0, 'price should be non-negative');\`
+   - Include upper bounds when the OpenAPI schema defines them (e.g. \`maximum\`, \`minimum\`).
+
+4. **Format/type constraints** — For string fields with a known format, assert the format rather than just the type:
+   - **UUID**: assert the value matches the UUID pattern (\`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\`).
+   - **Date / date-time**: assert the value is a valid ISO 8601 date or datetime string.
+   - **IP address**: assert the value matches IPv4 or IPv6 format.
+   - **Email**: assert the value contains \`@\` and a domain.
+   - **URL / URI**: assert the value starts with \`http://\` or \`https://\`.
+   - Use format info from the OpenAPI schema (\`format: uuid\`, \`format: date-time\`, etc.) to identify these fields.
+
+5. **Specific known values** — For fields where the expected value can be determined from context:
+   - Check the OpenAPI schema for \`enum\`, \`const\`, or \`example\` values and assert accordingly.
+   - Python: \`assert skyramp.get_response_value(orders_POST_response, "status") == "pending"\`
+   - TypeScript: \`expect(getResponseValue(ordersPostResponse, "status"), 'status').toBe("pending");\`
+   - JavaScript: \`assert.strictEqual(getResponseValue(ordersPostResponse, "status"), "pending", 'status should be pending');\`
+   - Java: \`assertEquals("pending", getValue(ordersPostResponse, "status"));\`
+
+---
+
+**Scope rules:**
+- Only modify test functions — do NOT touch \`beforeAll\`, \`afterAll\`, or any setup/teardown helper.
+- Only add assertions that are clearly supported by the schema, field name, request body, or observable codebase evidence. Do not invent constraints.
+- Add new assertions **immediately after** the existing status-code and schema assertions — do not restructure the test.
+
+**What NOT to do — any of these is a violation:**
+- Do NOT access response body fields via dict syntax (\`response["field"]\`) or attribute access (\`response.field\`) — always use the SDK helper (\`get_response_value\` / \`getResponseValue\` / \`getValue\`).
+- Do NOT modify \`beforeAll\` or \`afterAll\` functions.
+- Do NOT change existing assertions — only add new ones.
+- Do NOT add assertions for fields where no constraint is clearly inferable.
+- Do NOT restructure, reformat, or reorder any existing code.
+- Do NOT add comments or docstrings.
+- Do NOT change function signatures, imports, or variable names.
+`;
+    }
+    buildConsumerStubReplacementInstructions() {
+        return `
+⏭️ **CRITICAL NEXT STEP — Replace stub test function with real consumer-side code:**
+
+The generated consumer contract test contains a stub test function that uses Skyramp's \`send_request\` library to directly call the mocked endpoint. The purpose of a consumer contract test is to verify that the consumer's own code correctly interacts with the mocked endpoint — not to call it directly. You must create a meaningful version of this test alongside the original stub.
+
+**What to do:**
+
+1. **Keep the original stub test function exactly as generated** — do not modify it.
+
+2. **Duplicate the test function** and give the copy a distinct name (e.g., append \`_consumer\` or \`_real\` to the function name).
+
+3. **In the duplicate only**, replace the stub function body (the \`send_request\` call and any surrounding boilerplate that directly hits the endpoint) with the actual consumer-side code that triggers the same endpoint:
+   - Search the codebase for the consumer code that calls this endpoint (look for the HTTP method + path pattern, SDK client calls, or service layer methods).
+   - Import or invoke that consumer code in place of the \`send_request\` stub.
+   - Ensure the mock is still active during the call so the response is intercepted by Skyramp.
+
+4. **Preserve everything else in the duplicate unchanged**: mock setup, teardown, response assertions, test structure, imports (add only what is needed for the consumer code).
+
+**Scope rules:**
+- Do NOT modify the original stub test function or any other function in the file.
+- Only change the stub call inside the duplicated test function — not assertions, mock configuration, or setup/teardown.
+- If the consumer code cannot be found in the codebase, leave a clearly marked \`TODO\` comment in the duplicate's body and do not fabricate code.
+- Do NOT restructure, reformat, or reorder any existing code outside the new duplicate function.
+- Do NOT add comments or docstrings beyond the \`TODO\` if needed.
 `;
     }
     validateInputs(params) {

package/build/tools/generate-tests/generateIntegrationRestTool.js

@@ -25,6 +25,88 @@ export class IntegrationTestService extends TestGenerationService {
     getTestType() {
         return TestType.INTEGRATION;
     }
+    async generateTest(params) {
+        const result = await super.generateTest(params);
+        if (result.isError)
+            return result;
+        const content = [...result.content];
+        content.push({
+            type: "text",
+            text: this.buildAssertionEnhancementInstructions(),
+        });
+        return { ...result, content };
+    }
+    buildAssertionEnhancementInstructions() {
+        return `
+⏭️ **CRITICAL NEXT STEP — Enhance response body assertions after each request:**
+
+The generated integration test contains only basic status-code assertions after each \`send_request\` / \`sendRequest\` call. For every request in the test (especially POST, PUT, and GET), add meaningful assertions on the response body using the rules below.
+
+---
+
+**IMPORTANT — How to access response body fields (use the SDK helpers, NOT dict/attribute access on the response variable):**
+
+- **Python**: \`skyramp.get_response_value(<response_var>, "<json_path>")\`
+  - e.g. \`skyramp.get_response_value(products_POST_response, "id")\`
+  - e.g. \`skyramp.get_response_value(orders_POST_response, "items.0.product_id")\`
+- **TypeScript (Playwright)**: \`getResponseValue(<response_var>, "<json_path>")\` (already imported from \`@skyramp/skyramp\`)
+  - e.g. \`getResponseValue(productsPostResponse, "id")\`
+- **JavaScript (Playwright)**: \`getResponseValue(<response_var>, "<json_path>")\` (already imported from \`@skyramp/skyramp\`)
+  - e.g. \`getResponseValue(productsPostResponse, "id")\`
+- **Java**: \`getValue(<response_var>, "<json_path>")\` (already imported)
+  - e.g. \`getValue(productsPostResponse, "id")\`
+
+---
+
+**What to assert after each request:**
+
+1. **Non-null / non-empty fields** — After any POST or PUT that creates or updates a resource, assert that key identifying fields are present and non-empty:
+   - IDs, names, emails, and other primary fields must not be null/None/empty.
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "id") is not None\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "id"), 'id').not.toBeNull();\`
+   - JavaScript: \`assert.notStrictEqual(getResponseValue(productsPostResponse, "id"), null, 'id should not be null');\`
+   - Java: \`assertNotNull(getValue(productsPostResponse, "id"));\`
+
+2. **Echo-back values** — When the request body sends a value the response is expected to return unchanged (name, email, status, price, etc.), assert the response value equals the sent value:
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "name") == "Skyramp Tester"\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "name"), 'name').toBe("Skyramp Tester");\`
+   - JavaScript: \`assert.strictEqual(getResponseValue(productsPostResponse, "name"), "Skyramp Tester", 'name should match request');\`
+   - Java: \`assertEquals("Skyramp Tester", getValue(productsPostResponse, "name"));\`
+
+3. **Chained values** — When a value extracted from a prior response (e.g., a POST-created ID) is already used in a subsequent request's \`path_params\` / \`data_override\`, also assert the later response echoes that value back where applicable:
+   - Python: \`assert skyramp.get_response_value(product_GET_response, "id") == skyramp.get_response_value(products_POST_response, "id")\`
+   - TypeScript: \`expect(getResponseValue(productGetResponse, "id"), 'id').toBe(getResponseValue(productsPostResponse, "id"));\`
+
+4. **Value ranges** — For numeric fields where a realistic range is inferable from the field name or domain:
+   - Python: \`assert skyramp.get_response_value(products_POST_response, "price") >= 0\`
+   - TypeScript: \`expect(getResponseValue(productsPostResponse, "price")).toBeGreaterThanOrEqual(0);\`
+   - JavaScript: \`assert.ok(getResponseValue(productsPostResponse, "price") >= 0, 'price should be non-negative');\`
+
+5. **Format/type constraints** — For string fields with a known format:
+   - **UUID**: assert the value matches \`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\` (use a regex check or string length check).
+   - **Date / date-time**: assert the value is a non-empty string parseable as an ISO 8601 date.
+   - **Email**: assert the value contains \`@\`.
+   - **URL**: assert the value starts with \`http://\` or \`https://\`.
+
+6. **Specific known values** — For enum/status fields where only one outcome is valid for this flow:
+   - Python: \`assert skyramp.get_response_value(orders_POST_response, "status") == "pending"\`
+
+---
+
+**Scope rules:**
+- Apply to every \`send_request\` / \`sendRequest\` call — including GET and DELETE if they return a body.
+- Only add assertions that are clearly supported by the request body, prior response values, field names, or codebase evidence. Do not invent constraints.
+- Add new assertions **immediately after** the existing status-code assertion for each request — do not move or remove anything.
+
+**What NOT to do — any of these is a violation:**
+- Do NOT access response body fields via dict syntax (\`response["field"]\`) or attribute access (\`response.field\`) — always use the SDK helper (\`get_response_value\` / \`getResponseValue\` / \`getValue\`).
+- Do NOT remove or modify existing assertions.
+- Do NOT add assertions for fields where no constraint is clearly inferable.
+- Do NOT restructure, reformat, or reorder any existing code.
+- Do NOT add comments or docstrings.
+- Do NOT change function signatures, imports, or variable names.
+`;
+    }
     buildGenerationOptions(params) {
         return {
             ...super.buildBaseGenerationOptions(params),
@@ -33,7 +115,7 @@ export class IntegrationTestService extends TestGenerationService {
             scenarioFile: params.scenarioFile,
         };
     }
-    async handleApiAnalysis(params, generateOptions) {
+    async handleApiAnalysis(_params, _generateOptions) {
         return null;
     }
 }