@skyramp/mcp 0.1.8 → 0.2.0-rc.2

package/build/prompts/testbot/testbot-prompts.test.js

@@ -203,6 +203,8 @@ describe("uiCredentials in getTestbotPrompt", () => {
     });
 });
 describe("drift analysis inline embedding", () => {
+    beforeAll(() => { process.env.SKYRAMP_FEATURE_TESTBOT = "1"; });
+    afterAll(() => { delete process.env.SKYRAMP_FEATURE_TESTBOT; });
     function basePrompt() {
         return getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
     }
@@ -226,11 +228,60 @@ describe("drift analysis inline embedding", () => {
         expect(rulesPos).toBeGreaterThan(task1Pos);
         expect(rulesPos).toBeLessThan(task2Pos);
     });
-    it("Task 1 step 2 prose references drift_analysis_rules tag", () => {
+    it("Task 1 step 3 prose references drift_analysis_rules tag", () => {
         const prompt = basePrompt();
         expect(prompt).toContain("rules in `<drift_analysis_rules>`");
     });
 });
+describe("UI grounding via Task 2 capture-act-capture", () => {
+    it("surfaces uiContext as guidance, not a contract", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        // uiContext fields are explained inline so the agent knows what to do with
+        // them. Step 1 provides candidate URLs but gives fallback instructions
+        // ("navigate from the workspace baseUrl and explore") for 404s/redirects,
+        // treating candidates as guidance not a rigid contract.
+        expect(prompt).toContain("uiContext");
+        expect(prompt).toContain("candidateUiPages");
+        expect(prompt).toContain("changedFrontendFiles");
+        expect(prompt).toMatch(/navigate from the workspace baseUrl and explore/i);
+    });
+    it("step 5 enforces Blueprint Citation Invariant in natural prose", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        // Step 5 is the citation-invariant guardrail, not a "fill in tuples"
+        // post-processing step (slice 4 cleanup: recs are grounded upstream).
+        expect(prompt).toContain("Blueprint Citation Invariant");
+        // Reasoning must be natural prose, NOT internal-identifier syntax.
+        expect(prompt).toMatch(/natural prose/i);
+        expect(prompt).toMatch(/internal-identifier syntax/i);
+    });
+    it("Task 2 no longer instructs the agent to fill in tuples post-hoc", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        // After slice 4 cleanup: Task 2 captures are for trace recording's own
+        // assertions, not for retroactively rewriting recommendation reasoning.
+        // The phrase "fill in tuples" must NOT appear anywhere in the prompt.
+        expect(prompt).not.toMatch(/fill in tuples/i);
+        expect(prompt).not.toMatch(/return to step 5 and fill/i);
+    });
+    it("Task 2 step 5 mentions possibleAssertions as available, NOT as required (slice 5.5 softening)", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        // Slice 5: AFTER-action browser_blueprint response includes
+        // possibleAssertions[] — mechanically translated candidates.
+        expect(prompt).toContain("possibleAssertions");
+        // Slice 5.5: prompt explicitly tells the agent NOT to feel obligated.
+        // Two P09 runs with the prior "emit at least one" directive showed the
+        // agent over-using shallow visibility assertions at the expense of
+        // integration-test depth. The softened version says: read them, use
+        // when they happen to match what you'd write anyway, ignore otherwise.
+        expect(prompt).toMatch(/do not feel obligated/i);
+        expect(prompt).toMatch(/biased toward visibility/i);
+        // The candidate format is still documented.
+        expect(prompt).toMatch(/\bcode\b.*\brationale\b.*\btier\b/i);
+        // The pre-existing "at least one browser_assert per page navigated"
+        // rule should be preserved (it's about meaningful business-outcome
+        // assertions, not about possibleAssertions).
+        expect(prompt).toMatch(/at least one .browser_assert. per page navigated/i);
+    });
+});
 describe("buildWorkspaceRecoveryPrefix", () => {
     const { buildWorkspaceRecoveryPrefix } = require("./testbot-prompts.js");
     it("includes repositoryPath in both init_scan and init_workspace instructions", () => {
@@ -248,3 +299,65 @@ describe("buildWorkspaceRecoveryPrefix", () => {
         expect(prefix).toMatch(/^IMPORTANT:/);
     });
 });
+describe("testsRepoDir in getTestbotPrompt", () => {
+    function callWithTestsRepoDir(testsRepoDir) {
+        return getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath, undefined, // baseBranch
+        undefined, // maxRecommendations
+        undefined, // maxGenerate
+        undefined, // maxCritical
+        undefined, // prNumber
+        undefined, // userPrompt
+        undefined, // services
+        undefined, // stateOutputFile
+        undefined, // uiCredentials
+        testsRepoDir);
+    }
+    function callFollowUpWithTestsRepoDir(testsRepoDir) {
+        return getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath, undefined, // baseBranch
+        undefined, // maxRecommendations
+        undefined, // maxGenerate
+        undefined, // maxCritical
+        undefined, // prNumber
+        "add more tests", // userPrompt — triggers follow-up path
+        undefined, // services
+        undefined, // stateOutputFile
+        undefined, // uiCredentials
+        testsRepoDir);
+    }
+    it("includes testsRepoDir in skyramp_analyze_changes call for first-run prompt", () => {
+        const dir = "/home/runner/work/_temp/skyramp/test-repo";
+        const prompt = callWithTestsRepoDir(dir);
+        expect(prompt).toContain(`\`testsRepoDir\`: "${dir}"`);
+    });
+    it("includes testsRepoDir in skyramp_analyze_changes call for follow-up prompt", () => {
+        const dir = "/home/runner/work/_temp/skyramp/test-repo";
+        const prompt = callFollowUpWithTestsRepoDir(dir);
+        expect(prompt).toContain(`\`testsRepoDir\`: "${dir}"`);
+    });
+    it("omits testsRepoDir when not provided", () => {
+        const prompt = callWithTestsRepoDir(undefined);
+        expect(prompt).not.toContain("testsRepoDir");
+    });
+    it("omits testsRepoDir from follow-up prompt when not provided", () => {
+        const prompt = callFollowUpWithTestsRepoDir(undefined);
+        expect(prompt).not.toContain("testsRepoDir");
+    });
+});
+describe("testbot prompt blueprint-grounded recommendations (slice 4)", () => {
+    it("instructs the agent to call skyramp_ui_analyze_changes before skyramp_analyze_changes", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        const uiacIdx = prompt.indexOf("skyramp_ui_analyze_changes");
+        const acIdx = prompt.indexOf("skyramp_analyze_changes");
+        expect(uiacIdx).toBeGreaterThan(-1);
+        expect(acIdx).toBeGreaterThan(uiacIdx);
+    });
+    it("Task 1 step 1 instructs the agent to capture blueprints (without threading them through a param)", () => {
+        const prompt = getTestbotPrompt(baseArgs.prTitle, baseArgs.prDescription, baseArgs.summaryOutputFile, baseArgs.repositoryPath);
+        // Captures stay in tool-result history; analyze_changes returns the
+        // authoring rules and the agent supplies the captured vocabulary.
+        expect(prompt).toMatch(/browser_blueprint`?\s*to capture/i);
+        expect(prompt).toMatch(/tool-result history/i);
+        // Make sure we removed the old capturedBlueprints threading directive.
+        expect(prompt).not.toMatch(/capturedBlueprints/);
+    });
+});

package/build/resources/testbotResource.js

@@ -25,7 +25,7 @@ export function registerTestbotResource(server) {
         const maxCrit = parseInt(uri.searchParams.get("maxCritical") || "", 10);
         const repositoryPath = param("repositoryPath", ".");
         const services = await readWorkspaceServices(repositoryPath);
-        const prompt = getTestbotPrompt(param("prTitle", ""), param("prDescription", ""), param("summaryOutputFile", ""), repositoryPath, uri.searchParams.get("baseBranch") || undefined, isNaN(maxRec) ? MAX_RECOMMENDATIONS : maxRec, isNaN(maxGen) ? MAX_TESTS_TO_GENERATE : maxGen, isNaN(maxCrit) ? MAX_CRITICAL_TESTS : maxCrit, isNaN(prNum) ? undefined : prNum, uri.searchParams.get("userPrompt") || undefined, services.length ? services : undefined, uri.searchParams.get("stateOutputFile") || undefined, uri.searchParams.get("uiCredentials") || undefined);
+        const prompt = getTestbotPrompt(param("prTitle", ""), param("prDescription", ""), param("summaryOutputFile", ""), repositoryPath, uri.searchParams.get("baseBranch") || undefined, isNaN(maxRec) ? MAX_RECOMMENDATIONS : maxRec, isNaN(maxGen) ? MAX_TESTS_TO_GENERATE : maxGen, isNaN(maxCrit) ? MAX_CRITICAL_TESTS : maxCrit, isNaN(prNum) ? undefined : prNum, uri.searchParams.get("userPrompt") || undefined, services.length ? services : undefined, uri.searchParams.get("stateOutputFile") || undefined, uri.searchParams.get("uiCredentials") || undefined, uri.searchParams.get("testsRepoDir") || undefined);
         AnalyticsService.pushMCPToolEvent("skyramp_testbot_prompt", undefined, {}).catch(() => { });
         // Return the original URI — clients may use it to re-fetch the resource,
         // and the caller already has these params. Credentials never appear in

package/build/services/ScenarioGenerationService.integration.test.js

@@ -0,0 +1,158 @@
+/**
+ * Integration test: verifies query params survive the full pipeline
+ * TS (ScenarioGenerationService) → JSON file → Go binary → generated test code
+ *
+ * Requires: @skyramp/skyramp native dylib (skips if not available)
+ */
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { ScenarioGenerationService } from "./ScenarioGenerationService.js";
+let SkyrampClient;
+try {
+    SkyrampClient = require("@skyramp/skyramp").SkyrampClient;
+}
+catch {
+    SkyrampClient = null;
+}
+// These tests require the native Go binary which is platform-specific.
+// Skip in CI or when the binary isn't available for this OS/arch.
+const isCI = Boolean(process.env.CI || process.env.GITHUB_ACTIONS);
+const describeIfBinary = SkyrampClient && !isCI ? describe : describe.skip;
+function buildTrace(overrides) {
+    const service = new ScenarioGenerationService();
+    return service.generateTraceRequestFromInput({
+        scenarioName: "integration-qp-test",
+        destination: "localhost",
+        baseURL: "http://localhost:8080",
+        method: "GET",
+        path: "/api/v1/items",
+        outputDir: os.tmpdir(),
+        authHeader: "",
+        authScheme: "",
+        ...overrides,
+    });
+}
+describeIfBinary("QueryParams integration: TS → JSON → Go binary → generated code", () => {
+    let tmpDir;
+    let outputDir;
+    let client;
+    // Go dylib cold-starts can take a few seconds
+    jest.setTimeout(15000);
+    beforeAll(() => {
+        client = new SkyrampClient();
+    });
+    afterAll(() => {
+        client?.close?.();
+    });
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "skyramp-qp-integration-"));
+        outputDir = path.join(tmpDir, "output");
+        fs.mkdirSync(outputDir);
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    async function generateFromTrace(trace) {
+        const traceFile = path.join(tmpDir, "scenario.json");
+        fs.writeFileSync(traceFile, JSON.stringify([trace], null, 2));
+        await client.generateRestTest({
+            testType: "integration",
+            language: "python",
+            framework: "pytest",
+            outputDir,
+            force: true,
+            traceFilePath: traceFile,
+        });
+        const files = fs.readdirSync(outputDir).filter((f) => f.endsWith(".py"));
+        if (files.length === 0)
+            throw new Error("No generated test file found");
+        return fs.readFileSync(path.join(outputDir, files[0]), "utf8");
+    }
+    it("bracket-notation keys pass through to generated test code", async () => {
+        // Simulates: GET /api/v1/items?filter[status][_eq]=published&limit=25
+        const trace = buildTrace({
+            queryParams: '{"filter[status][_eq]":"published","limit":25}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            "filter[status][_eq]": ["published"],
+            "limit": ["25"],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("filter[status][_eq]");
+        expect(code).toContain("published");
+        expect(code).toContain("limit");
+        expect(code).toContain("25");
+    });
+    it("simple flat params pass through to generated test code", async () => {
+        // Simulates: GET /api/v1/items?page=2&status=active
+        const trace = buildTrace({
+            queryParams: '{"page":2,"status":"active"}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            page: ["2"],
+            status: ["active"],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("page");
+        expect(code).toContain("2");
+        expect(code).toContain("status");
+        expect(code).toContain("active");
+    });
+    it("JSON-encoded string value (Elasticsearch-style) passes through intact", async () => {
+        // Simulates: GET /search?source={"query":{"match":{"name":"bear"}}}
+        const trace = buildTrace({
+            queryParams: '{"source":"{\\"query\\":{\\"match\\":{\\"name\\":\\"bear\\"}}}"}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            source: ['{"query":{"match":{"name":"bear"}}}'],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("source");
+        expect(code).toMatch(/query.*match.*name.*bear/);
+    });
+    it("array params are comma-joined into a single value in generated code", async () => {
+        // Simulates: GET /products?tags=sale,new
+        const trace = buildTrace({
+            queryParams: '{"tags":["sale","new"]}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            tags: ["sale,new"],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("tags");
+        expect(code).toContain("sale,new");
+    });
+    it("null params are omitted — not present in generated code", async () => {
+        // null means "don't include this param" — same as axios/fetch omitting undefined
+        const trace = buildTrace({
+            queryParams: '{"limit":10,"cursor":null}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            limit: ["10"],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("limit");
+        expect(code).toContain("10");
+        expect(code).not.toContain("cursor");
+    });
+    it("nested object fallback produces valid JSON string in generated code", async () => {
+        // LLM mistakenly sends nested object — service JSON-stringifies it
+        const trace = buildTrace({
+            queryParams: '{"filter":{"status":"active"}}',
+        });
+        expect(trace).not.toBeNull();
+        expect(trace.QueryParams).toEqual({
+            filter: ['{"status":"active"}'],
+        });
+        const code = await generateFromTrace(trace);
+        expect(code).toContain("filter");
+        expect(code).not.toContain("[object Object]");
+        expect(code).not.toContain("map[");
+    });
+});

package/build/services/ScenarioGenerationService.js

@@ -2,9 +2,14 @@ import { AUTH_PLACEHOLDER_TOKEN } from "../types/TestTypes.js";
 import { isAuthorizationHeaderName } from "../utils/workspaceAuth.js";
 import { inferExpectedStatus } from "../utils/httpDefaults.js";
 import { logger } from "../utils/logger.js";
-import { stageGeneratedPaths } from "../utils/gitStaging.js";
+import { stageGeneratedPaths, resolveOutputDir } from "../utils/gitStaging.js";
+import { getTestsRepoDir } from "../utils/AnalysisStateManager.js";
 import fs from "fs";
 import path from "path";
+// Keys that trigger built-in prototype setters when used as bracket-notation
+// property names on a plain object — guard against prototype pollution from
+// LLM-controlled or user-controlled JSON input.
+const PROTO_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 export class ScenarioGenerationService {
     async parseScenario(params) {
         try {
@@ -23,6 +28,15 @@ export class ScenarioGenerationService {
                     isError: true,
                 };
             }
+            // In cross-repo mode, redirect outputDir to the test repo clone.
+            const resolved = resolveOutputDir(params.outputDir, getTestsRepoDir());
+            if (resolved !== params.outputDir) {
+                logger.info("Cross-repo: redirecting scenario outputDir to test repo", {
+                    original: params.outputDir,
+                    redirected: resolved,
+                });
+                params.outputDir = resolved;
+            }
             const scenarioName = params.scenarioName.replace(/ /g, "-").toLowerCase();
             const fileName = `scenario_${scenarioName}.json`;
             const filePath = path.join(params.outputDir, fileName);
@@ -40,6 +54,12 @@ export class ScenarioGenerationService {
                         existingRequests = [];
                     }
                 }
+                if (existingRequests.length > 0) {
+                    const lastTimestamp = existingRequests[existingRequests.length - 1].Timestamp;
+                    const lastMs = new Date(lastTimestamp).getTime();
+                    const newMs = Math.max(lastMs + 1000, Date.now());
+                    traceRequest.Timestamp = new Date(newMs).toISOString();
+                }
                 existingRequests.push(traceRequest);
                 fs.writeFileSync(filePath, JSON.stringify(existingRequests, null, 2), "utf8");
                 // Stage so testbot includes the generated files in its output commit.
@@ -139,15 +159,38 @@ ${JSON.stringify(traceRequest, null, 2)}
         const requestHeaders = {
             "Content-Type": ["application/json"],
         };
+        // Go backend expects url.Values (map[string][]string). We always produce
+        // single-element arrays — the Go codegen normalises multi-element string arrays
+        // into a JSON array string (e.g. ["sale","new"]), which is not what most APIs
+        // expect. Comma-joining covers the common case; APIs needing true repeated keys
+        // (e.g. ?tags=sale&tags=new) are not supported by the current Go codegen path.
         const queryParams = {};
         if (params.queryParams) {
             try {
                 const parsed = JSON.parse(params.queryParams);
                 if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
                     for (const [k, v] of Object.entries(parsed)) {
-                        queryParams[k] = Array.isArray(v)
-                            ? v.map((item) => typeof item === "object" && item !== null ? JSON.stringify(item) : String(item))
-                            : [typeof v === "object" && v !== null ? JSON.stringify(v) : String(v)];
+                        if (PROTO_KEYS.has(k))
+                            continue;
+                        if (v === null)
+                            continue;
+                        let value;
+                        if (Array.isArray(v)) {
+                            const items = v
+                                .filter((item) => item !== null)
+                                .map((item) => (typeof item === "object" ? JSON.stringify(item) : String(item)));
+                            if (items.length === 0)
+                                continue;
+                            value = items.join(",");
+                        }
+                        else if (typeof v === "object") {
+                            logger.warning("Nested object in queryParams — JSON-stringifying as fallback; LLM should provide flat keys", { key: k });
+                            value = JSON.stringify(v);
+                        }
+                        else {
+                            value = String(v);
+                        }
+                        queryParams[k] = [value];
                     }
                 }
                 else {

package/build/services/ScenarioGenerationService.test.js

@@ -1,3 +1,6 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
 import { ScenarioGenerationService } from "./ScenarioGenerationService.js";
 import { AUTH_PLACEHOLDER_TOKEN } from "../types/TestTypes.js";
 const BASE_PARAMS = {
@@ -197,39 +200,145 @@ describe("ScenarioGenerationService — auth header flavors", () => {
     });
 });
 describe("ScenarioGenerationService — queryParams handling", () => {
-    it("serializes a flat primitive object correctly", () => {
-        const trace = generateTrace({ queryParams: '{"limit":"10","status":"active"}' });
-        expect(trace.QueryParams).toEqual({ limit: ["10"], status: ["active"] });
+    // --- Primitive values (strings, numbers, booleans) ---
+    it("coerces string values into single-element arrays", () => {
+        const trace = generateTrace({ queryParams: '{"status":"active"}' });
+        expect(trace.QueryParams).toEqual({ status: ["active"] });
     });
-    it("serializes numeric and boolean primitive values as strings", () => {
-        const trace = generateTrace({ queryParams: '{"page":2,"active":true}' });
-        expect(trace.QueryParams).toEqual({ page: ["2"], active: ["true"] });
+    it("coerces numeric values to string", () => {
+        const trace = generateTrace({ queryParams: '{"limit":10,"offset":0}' });
+        expect(trace.QueryParams).toEqual({ limit: ["10"], offset: ["0"] });
     });
-    it("JSON-stringifies nested object values instead of producing [object Object]", () => {
-        const trace = generateTrace({ queryParams: '{"filter":{"status":"active","min_price":10}}' });
-        expect(trace).not.toBeNull();
-        const filterVal = trace.QueryParams["filter"][0];
-        expect(filterVal).not.toBe("[object Object]");
-        expect(filterVal).toBe('{"status":"active","min_price":10}');
+    it("coerces boolean values to string", () => {
+        const trace = generateTrace({ queryParams: '{"active":true,"deleted":false}' });
+        expect(trace.QueryParams).toEqual({ active: ["true"], deleted: ["false"] });
     });
-    it("JSON-stringifies nested objects inside an array value", () => {
-        const trace = generateTrace({ queryParams: '{"ids":[{"id":1},{"id":2}]}' });
-        expect(trace).not.toBeNull();
-        expect(trace.QueryParams["ids"]).toEqual(['{"id":1}', '{"id":2}']);
+    it("coerces empty string to single-element array", () => {
+        const trace = generateTrace({ queryParams: '{"q":""}' });
+        expect(trace.QueryParams).toEqual({ q: [""] });
+    });
+    it("passes bracket-notation keys through verbatim (Directus regression)", () => {
+        // Root cause of the original P0: filter[title][_neq] must reach the Go backend
+        // as the literal key string, not as a nested object or [object Object].
+        const trace = generateTrace({
+            queryParams: '{"filter[status][_eq]":"published","filter[date_created][_gte]":"2024-01-01","limit":25}',
+        });
+        expect(trace.QueryParams["filter[status][_eq]"]).toEqual(["published"]);
+        expect(trace.QueryParams["filter[date_created][_gte]"]).toEqual(["2024-01-01"]);
+        expect(trace.QueryParams["limit"]).toEqual(["25"]);
+    });
+    // --- Null omission ---
+    it("omits null values entirely (prevents ?status=null in URL)", () => {
+        // null means "omit this param" — same convention as axios/fetch omitting undefined params
+        const trace = generateTrace({ queryParams: '{"cursor":null,"limit":20}' });
+        expect(trace.QueryParams["cursor"]).toBeUndefined();
+        expect(trace.QueryParams["limit"]).toEqual(["20"]);
+    });
+    it("omits all-null object leaving only non-null keys", () => {
+        const trace = generateTrace({ queryParams: '{"a":null,"b":null,"c":"keep"}' });
+        expect(trace.QueryParams).toEqual({ c: ["keep"] });
+    });
+    // --- Array values: filter nulls, comma-join into single element ---
+    it("array of strings joins into single comma-separated value", () => {
+        const trace = generateTrace({ queryParams: '{"tags":["sale","new","featured"]}' });
+        expect(trace.QueryParams["tags"]).toEqual(["sale,new,featured"]);
+    });
+    it("array of mixed primitives coerces each to string then joins", () => {
+        const trace = generateTrace({ queryParams: '{"ids":[1,2,"three",true,0,false]}' });
+        expect(trace.QueryParams["ids"]).toEqual(["1,2,three,true,0,false"]);
+    });
+    it("array with null items filters nulls before joining", () => {
+        const trace = generateTrace({ queryParams: '{"tags":[null,"active",null,"pending"]}' });
+        expect(trace.QueryParams["tags"]).toEqual(["active,pending"]);
+    });
+    it("array with all-null items omits the key entirely", () => {
+        const trace = generateTrace({ queryParams: '{"tags":[null,null],"limit":5}' });
+        expect(trace.QueryParams["tags"]).toBeUndefined();
+        expect(trace.QueryParams["limit"]).toEqual(["5"]);
     });
-    it("passes through an array of primitive values unchanged", () => {
-        const trace = generateTrace({ queryParams: '{"tags":["a","b","c"]}' });
-        expect(trace.QueryParams["tags"]).toEqual(["a", "b", "c"]);
+    it("empty array omits the key (no items after filtering)", () => {
+        const trace = generateTrace({ queryParams: '{"ids":[],"limit":10}' });
+        expect(trace.QueryParams["ids"]).toBeUndefined();
+        expect(trace.QueryParams["limit"]).toEqual(["10"]);
     });
-    it("produces empty QueryParams when queryParams is omitted", () => {
+    it("array containing objects JSON-stringifies each then joins", () => {
+        const trace = generateTrace({
+            queryParams: '{"filters":[{"field":"status","value":"active"},{"field":"price","op":"gte","value":"10"}]}',
+        });
+        expect(trace.QueryParams["filters"]).toEqual([
+            '{"field":"status","value":"active"},{"field":"price","op":"gte","value":"10"}',
+        ]);
+    });
+    it("array mixing objects, primitives, and nulls: filters nulls, stringifies objects, joins all", () => {
+        const trace = generateTrace({
+            queryParams: '{"mixed":[null,{"nested":true},"plain",42,null]}',
+        });
+        expect(trace.QueryParams["mixed"]).toEqual(['{"nested":true},plain,42']);
+    });
+    // --- Nested object fallback: JSON.stringify ---
+    it("nested object is JSON-stringified as fallback", () => {
+        const trace = generateTrace({
+            queryParams: '{"filter":{"status":"active","min_price":10}}',
+        });
+        expect(trace.QueryParams["filter"]).toEqual(['{"status":"active","min_price":10}']);
+    });
+    it("deeply nested object is fully JSON-stringified", () => {
+        const trace = generateTrace({
+            queryParams: '{"filter":{"title":{"_neq":"not-a-number"}}}',
+        });
+        expect(trace.QueryParams["filter"]).toEqual(['{"title":{"_neq":"not-a-number"}}']);
+    });
+    it("empty nested object is JSON-stringified to '{}'", () => {
+        const trace = generateTrace({ queryParams: '{"filter":{}}' });
+        expect(trace.QueryParams["filter"]).toEqual(["{}"]);
+    });
+    // --- JSON parsing and object validation ---
+    it("omitted queryParams produces empty QueryParams", () => {
         const trace = generateTrace({});
         expect(trace.QueryParams).toEqual({});
     });
-    it("produces empty QueryParams and does not throw for invalid JSON", () => {
-        const trace = generateTrace({ queryParams: "not-valid-json" });
+    it("invalid JSON produces empty QueryParams without throwing", () => {
+        const trace = generateTrace({ queryParams: "not-valid-json{" });
         expect(trace).not.toBeNull();
         expect(trace.QueryParams).toEqual({});
     });
+    it("JSON array (not object) produces empty QueryParams", () => {
+        const trace = generateTrace({ queryParams: '["limit","10"]' });
+        expect(trace.QueryParams).toEqual({});
+    });
+    it("JSON null produces empty QueryParams", () => {
+        const trace = generateTrace({ queryParams: "null" });
+        expect(trace.QueryParams).toEqual({});
+    });
+    it("JSON number produces empty QueryParams", () => {
+        const trace = generateTrace({ queryParams: "42" });
+        expect(trace.QueryParams).toEqual({});
+    });
+    it("JSON string produces empty QueryParams", () => {
+        const trace = generateTrace({ queryParams: '"just a string"' });
+        expect(trace.QueryParams).toEqual({});
+    });
+    it("empty object produces empty QueryParams", () => {
+        const trace = generateTrace({ queryParams: '{}' });
+        expect(trace.QueryParams).toEqual({});
+    });
+    // --- Security: PROTO_KEYS guard ---
+    it("skips __proto__ key to prevent prototype pollution via setter", () => {
+        const trace = generateTrace({
+            queryParams: '{"__proto__":{"polluted":true},"limit":10}',
+        });
+        expect(Object.hasOwn(trace.QueryParams, "__proto__")).toBe(false);
+        expect(Object.getPrototypeOf(trace.QueryParams)).toBe(Object.prototype);
+        expect(trace.QueryParams["limit"]).toEqual(["10"]);
+    });
+    it("skips constructor and prototype keys", () => {
+        const trace = generateTrace({
+            queryParams: '{"constructor":"pwned","prototype":"evil","valid":"yes"}',
+        });
+        expect(Object.hasOwn(trace.QueryParams, "constructor")).toBe(false);
+        expect(Object.hasOwn(trace.QueryParams, "prototype")).toBe(false);
+        expect(trace.QueryParams["valid"]).toEqual(["yes"]);
+    });
 });
 describe("ScenarioGenerationService — baseURL parsing", () => {
     it("parses http baseURL correctly", () => {
@@ -262,3 +371,30 @@ describe("ScenarioGenerationService — baseURL parsing", () => {
         expect(trace.Port).toBe(80);
     });
 });
+describe("ScenarioGenerationService — timestamp chaining", () => {
+    it("assigns strictly increasing timestamps across multiple parseScenario calls", async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "skyramp-ts-test-"));
+        const service = new ScenarioGenerationService();
+        const baseParams = {
+            scenarioName: "timestamp-chain-test",
+            destination: "api.example.com",
+            method: "GET",
+            path: "/api/v1/items",
+            outputDir: tmpDir,
+            baseURL: "http://localhost:8000",
+        };
+        await service.parseScenario({ ...baseParams, method: "POST", path: "/api/v1/items" });
+        await service.parseScenario({ ...baseParams, method: "GET", path: "/api/v1/items/1" });
+        await service.parseScenario({ ...baseParams, method: "DELETE", path: "/api/v1/items/1" });
+        const fileName = "scenario_timestamp-chain-test.json";
+        const filePath = path.join(tmpDir, fileName);
+        const requests = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        expect(requests).toHaveLength(3);
+        for (let i = 1; i < requests.length; i++) {
+            const prev = new Date(requests[i - 1].Timestamp).getTime();
+            const curr = new Date(requests[i].Timestamp).getTime();
+            expect(curr).toBeGreaterThan(prev);
+        }
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+});