@skyramp/mcp 0.2.6 → 0.2.8-rc.1

package/build/utils/docker.test.js

@@ -1,5 +1,12 @@
+// @ts-nocheck - Jest ESM type inference issues
+import { jest } from "@jest/globals";
 // Mock logger before importing docker module
-jest.mock("./logger.js", () => ({
+const mockInspect = jest.fn();
+const mockGetImage = jest.fn(() => ({ inspect: mockInspect }));
+const mockFollowProgress = jest.fn();
+const mockPull = jest.fn();
+const mockModem = { followProgress: mockFollowProgress };
+jest.unstable_mockModule("./logger.js", () => ({
     logger: {
         debug: jest.fn(),
         info: jest.fn(),
@@ -7,18 +14,12 @@ jest.mock("./logger.js", () => ({
         warning: jest.fn(),
     },
 }));
-// Mock dockerode before importing docker module
-const mockInspect = jest.fn();
-const mockGetImage = jest.fn(() => ({ inspect: mockInspect }));
-const mockFollowProgress = jest.fn();
-const mockPull = jest.fn();
-const mockModem = { followProgress: mockFollowProgress };
 jest.mock("dockerode", () => jest.fn().mockImplementation(() => ({
     getImage: mockGetImage,
     pull: mockPull,
     modem: mockModem,
 })));
-import { dockerImageExistsLocally, pullDockerImage } from "./docker.js";
+const { dockerImageExistsLocally, pullDockerImage } = await import("./docker.js");
 // Helper: make docker.pull succeed (stream ends without error)
 function mockPullSuccess() {
     const fakeStream = {};
@@ -54,7 +55,7 @@ describe("dockerImageExistsLocally", () => {
     });
 });
 describe("pullDockerImage", () => {
-    const IMAGE = "skyramp/executor:v1.3.27";
+    const IMAGE = "skyramp/executor:v1.3.29";
     beforeEach(() => jest.clearAllMocks());
     describe("on amd64 host", () => {
         const originalArch = process.arch;

package/build/utils/featureFlags.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Feature flag helpers.
+ *
+ * Each helper in this module reads a `SKYRAMP_FEATURE_*` env var and returns
+ * a boolean. These helpers treat a flag as ON only when the env var is
+ * exactly `"1"`; anything else (unset, empty, "0", "true", "false", etc.) is
+ * treated as OFF.
+ */
+/**
+ * Gates BOTH consumer-side contract tests AND the SDK's "default mode"
+ * fallback (where omitting both `providerMode` and `consumerMode` causes the
+ * SDK to generate BOTH provider and consumer tests).
+ *
+ * `providerMode` itself is exposed regardless of this flag.
+ *
+ * When OFF (default):
+ *   - `skyramp_contract_test_generation` only exposes provider-mode
+ *     parameters in its input schema, and the tool description, validation,
+ *     and post-generation instructions all assume provider-only behavior.
+ *   - The SDK is always invoked with `providerMode: true`, so the
+ *     "neither mode set ⇒ generate both" default cannot leak through. Only
+ *     a provider contract test is ever generated.
+ *   - Testbot recommendation prompts no longer suggest `consumerMode: true`
+ *     contract tests.
+ *
+ * When ON (`SKYRAMP_FEATURE_CONTRACT_CONSUMER_MODE=1`):
+ *   - Restores the previous behavior: `consumerMode` / `consumerOutput` are
+ *     exposed on the input schema, recommendation prompts mention consumer
+ *     contract tests, and the SDK's "no mode set ⇒ generate both" default
+ *     is preserved.
+ */
+export declare function isContractConsumerModeEnabled(): boolean;
+/**
+ * Returns true when running inside a TestBot environment
+ * (SKYRAMP_FEATURE_TESTBOT=1).
+ */
+export declare function isTestbotEnabled(): boolean;

package/build/utils/featureFlags.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/gitStaging.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Check whether `child` is inside `parent` using resolved paths with
+ * a trailing separator to avoid prefix false positives (e.g. /tmp/test-repo2
+ * should not match /tmp/test-repo).
+ */
+export declare function isInsideDir(child: string, parent: string): boolean;
+/**
+ * In cross-repo mode, redirects an outputDir to be under the test repo clone
+ * if it isn't already. Returns the original path unchanged when testsRepoDir
+ * is unset or the path is already inside it.
+ */
+export declare function resolveOutputDir(outputDir: string, testsRepoDir: string | undefined): string;
+/**
+ * Stages a file path an MCP tool just wrote into the git index by
+ * running `git add -- <path>`.
+ *
+ * Automatically detects the git root of the target path so that staging
+ * works correctly in cross-repo mode (test repo clone separate from the
+ * source repo).
+ *
+ * Gated by the SKYRAMP_FEATURE_TESTBOT=1 env var, which is set only
+ * inside a testbot CI run.
+ */
+export declare function stageGeneratedPaths(filePath: string, cwd?: string): Promise<void>;

package/build/utils/gitStaging.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/gitStaging.test.js

@@ -1,4 +1,7 @@
-jest.mock("./logger.js", () => ({
+import { jest } from "@jest/globals";
+const execFileMock = jest.fn();
+const execFileSyncMock = jest.fn();
+jest.unstable_mockModule("./logger.js", () => ({
     logger: {
         debug: jest.fn(),
         info: jest.fn(),
@@ -6,14 +9,17 @@ jest.mock("./logger.js", () => ({
         error: jest.fn(),
     },
 }));
-jest.mock("fs", () => ({
+jest.unstable_mockModule("fs", () => ({
+    default: {
+        statSync: (p) => ({
+            isDirectory: () => !p.includes("."),
+        }),
+    },
     statSync: (p) => ({
         isDirectory: () => !p.includes("."),
     }),
 }));
-const execFileMock = jest.fn();
-const execFileSyncMock = jest.fn();
-jest.mock("child_process", () => ({
+jest.unstable_mockModule("child_process", () => ({
     execFile: (cmd, args, opts, cb) => {
         const result = execFileMock(cmd, args, opts);
         const cbErr = result && typeof result === "object" && "err" in result
@@ -26,8 +32,8 @@ jest.mock("child_process", () => ({
     },
     execFileSync: (cmd, args, opts) => execFileSyncMock(cmd, args, opts),
 }));
-import { stageGeneratedPaths } from "./gitStaging.js";
-import { logger } from "./logger.js";
+const { stageGeneratedPaths } = await import("./gitStaging.js");
+const { logger } = await import("./logger.js");
 const loggerInfoMock = logger.info;
 let originalTestbotEnv;
 beforeAll(() => {

package/build/utils/httpDefaults.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared HTTP method defaults used across scenario drafting and test generation.
+ */
+/**
+ * Returns the conventional success status code for a given HTTP method.
+ *   POST   → 201 Created
+ *   DELETE → 204 No Content
+ *   other  → 200 OK
+ */
+export declare function inferExpectedStatus(method: string): number;

package/build/utils/httpDefaults.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/initAgent.d.ts

@@ -0,0 +1,36 @@
+import { WORKER_DOCKER_IMAGE } from "./versions.js";
+export { WORKER_DOCKER_IMAGE };
+/**
+ * Install or refresh SKYRAMP_MD_CONTENT at global skill discovery paths only (~/.claude, ~/.cursor, ~/.github/skills).
+ * No workspace path required. Creates files if missing; overwrites if content differs.
+ */
+export declare function ensureSkyrampMdInstalled(): Promise<void>;
+/**
+ * Skyramp init:
+ * install/refresh global skill files (~/.claude, ~/.cursor, ~/.github/skills) (errors logged but do not block init),
+ * check which images are missing, then kick off any needed pulls in the background and return immediately.
+ * Deduplication for the MCP oninitialized path is handled by registerInitTriggerOnMCPInitialized in this module.
+ *
+ * Pull improvements over the previous SkyrampClient.initAgent() FFI approach:
+ * - Skip-if-present: each image is checked independently via a fast daemon inspect (~5ms)
+ *   before any pull is attempted, avoiding unnecessary network calls.
+ * - Pull only what is missing: if one image is already present, only the other is pulled.
+ *   Previously both images were always pulled regardless.
+ * - Parallel pulls: missing images are pulled concurrently via Promise.all, halving
+ *   wall-clock time when both need to be downloaded.
+ * - Arch-aware: pull platform is detected from process.arch (linux/arm64 on Apple Silicon,
+ *   linux/amd64 otherwise) with an automatic amd64 fallback if no arm64 manifest exists
+ *   (e.g. skyramp/executor is amd64-only; skyramp/worker supports both).
+ * - No FFI overhead: direct Dockerode calls replace the Go shared-library bridge,
+ *   removing the cost of loading the .so and marshalling output through a C string.
+ * - Cleaner error propagation: structured errors from Dockerode replace parsing a
+ *   stringified Go output from the C FFI boundary.
+ */
+export declare function initCheck(): Promise<void>;
+/**
+ * Runs initCheck asynchronously after the MCP handshake completes.
+ * Prevents duplicate concurrent runs and skips future runs after a successful init.
+ * If initCheck fails, a later call can retry within the same process.
+ * Assign to server.server.oninitialized in main().
+ */
+export declare function registerInitTriggerOnMCPInitialized(): Promise<void>;

package/build/utils/language-helper.d.ts

@@ -0,0 +1,6 @@
+export interface LanguageStepsParams {
+    language: string;
+    testType?: string;
+    framework?: string;
+}
+export declare function getLanguageSteps(params: LanguageStepsParams): string;

package/build/utils/logger.d.ts

@@ -0,0 +1,11 @@
+export declare class McpLogger {
+    private loggerName;
+    constructor(loggerName?: string);
+    private sendLogMessage;
+    debug(message: string, data?: any): void;
+    info(message: string, data?: any): void;
+    warning(message: string, data?: any): void;
+    error(message: string, data?: any): void;
+    critical(message: string, data?: any): void;
+}
+export declare const logger: McpLogger;

package/build/utils/normalizeParams.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Normalize tool parameters to handle common LLM mistakes:
+ * - Case-insensitive language/framework values
+ * - Common parameter name aliases
+ */
+/**
+ * Normalize language and framework to lowercase accepted values.
+ */
+export declare function normalizeLanguageParams(params: Record<string, any>): void;
+/**
+ * Resolve common parameter name aliases that LLMs use.
+ * e.g., zipPath -> playwrightInput, testFilePath -> testFile
+ */
+export declare function resolveParamAliases(params: Record<string, any>, aliases: Record<string, string>): void;

package/build/utils/normalizeSkyrampImports.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Ensure `expect` is imported from `@skyramp/skyramp` rather than `@playwright/test`.
+ * - Strips `expect` from any `@playwright/test` import (keeps other identifiers).
+ * - If the file uses `expect(...)`, ensures an `@skyramp/skyramp` import carries `expect`.
+ * Returns the original string if no rewrite was needed.
+ */
+export declare function normalizeSkyrampExpectImport(source: string): string;
+/**
+ * Normalize the `expect` import in a file on disk. No-op if the file is missing,
+ * unreadable, or already correct. Errors are swallowed — this is a safety net,
+ * not a blocking step.
+ */
+export declare function normalizeSkyrampImportsInFile(testFile: string | undefined): void;

package/build/utils/pr-comment-parser.d.ts

@@ -0,0 +1,31 @@
+/**
+ * PR Comment Parser — extracts TestBot history from GitHub PR comments.
+ *
+ * Parses previous Skyramp TestBot comments on a PR to build context
+ * about what has already been recommended, implemented, and tested.
+ * This prevents re-recommendations and enables contextual awareness
+ * across the PR lifecycle.
+ */
+export interface PRTestContext {
+    prNumber: number;
+    previousRecommendations: Array<{
+        testType: string;
+        endpoint: string;
+        scenarioName?: string;
+        status: "recommended" | "implemented" | "dismissed";
+        commentId: string;
+    }>;
+    implementedTestFiles: string[];
+    executionResults: Array<{
+        testFile: string;
+        status: "pass" | "fail" | "skipped";
+        timestamp: string;
+    }>;
+}
+/**
+ * Fetch and parse PR comments to build TestBot history context.
+ *
+ * Uses the `gh` CLI (available in CI and local dev environments with
+ * GitHub CLI installed). Falls back gracefully if `gh` is unavailable.
+ */
+export declare function parsePRComments(repoOwner: string, repoName: string, prNumber: number, _token?: string): Promise<PRTestContext>;

package/build/utils/pr-comment-parser.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/pr-comment-parser.test.js

@@ -1,9 +1,10 @@
-import { parsePRComments } from "./pr-comment-parser.js";
-import { execFileSync } from "child_process";
-jest.mock("child_process", () => ({
-    execFileSync: jest.fn(),
+import { jest } from "@jest/globals";
+// Mock child_process before importing the module under test
+const mockedExecFileSync = jest.fn();
+jest.unstable_mockModule("child_process", () => ({
+    execFileSync: mockedExecFileSync,
 }));
-const mockedExecFileSync = execFileSync;
+const { parsePRComments } = await import("./pr-comment-parser.js");
 // ---------------------------------------------------------------------------
 // Fixture helpers — build PR comment bodies matching the real renderReport()
 // output wrapped in the progress comment from testbot/src/progress.ts.

package/build/utils/projectMetadata.d.ts

@@ -0,0 +1,15 @@
+export type ProjectType = "rest-api" | "frontend" | "full-stack" | "microservices" | "library" | "cli" | "other";
+export type DeploymentPattern = "microservices" | "full-stack" | "containerized-monolith" | "traditional" | "unknown";
+export interface ProjectMeta {
+    projectType: ProjectType;
+    primaryLanguage: string;
+    primaryFramework: string;
+    deploymentPattern: DeploymentPattern;
+    languages: string[];
+    frameworks: string[];
+    runtime: string;
+    isContainerized: boolean;
+    hasDockerCompose: boolean;
+    hasCiCd: boolean;
+}
+export declare function detectProjectMetadata(repositoryPath: string): ProjectMeta;

package/build/utils/projectMetadata.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/proxy-terminal.d.ts

@@ -0,0 +1,2 @@
+export default function openProxyTerminal(): Promise<void>;
+export declare function closeProxyTerminal(): Promise<void>;

package/build/utils/repoScanner.d.ts

@@ -0,0 +1,27 @@
+export interface ScannedEndpoint {
+    path: string;
+    methods: string[];
+    sourceFile: string;
+}
+/**
+ * Returns the relative paths of entry-point files that define the routing
+ * hierarchy for this repository. The LLM reads these files in Step 1.5 to
+ * trace router/module nesting and build an authoritative path resolution table.
+ *
+ * Intentionally returns only file paths — no extracted lines. Static regex
+ * extraction is fragile and framework-specific; the LLM reads the files directly
+ * and understands any framework's routing syntax.
+ */
+export declare function grepRouterMountingContext(repositoryPath: string): string[];
+/**
+ * Return relative paths of all source files that are likely to define API
+ * routes. Two-pass strategy:
+ *   1. Fast: filename matches ROUTE_FILE_PATTERN (no file I/O needed).
+ *   2. Content: files not matched by name are read and checked for both a
+ *      URL-path literal AND an HTTP method registration. This covers any
+ *      framework the filename filter misses — Axum, Ktor, .NET, Hono, etc.
+ * Result is capped at MAX_CANDIDATE_FILES to keep the LLM prompt bounded.
+ */
+export declare function findCandidateRouteFiles(repositoryPath: string): string[];
+export declare function scanAllRepoEndpoints(repositoryPath: string): ScannedEndpoint[];
+export declare function scanRelatedEndpoints(repositoryPath: string, changedFiles: string[]): ScannedEndpoint[];

package/build/utils/repoScanner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/routeParsers.d.ts

@@ -0,0 +1,53 @@
+import { BranchDiffData } from "./branchDiff.js";
+import type { ScannedEndpoint } from "./repoScanner.js";
+export interface ParsedDiffEndpoint {
+    method: string;
+    path: string;
+    sourceFile: string;
+}
+export declare function nextjsFileToApiPath(filePath: string): string | null;
+export declare const UI_FILE_EXTENSIONS: readonly ["tsx", "jsx", "vue", "svelte", "html", "xml"];
+export declare const UI_FILE_GIT_PATHSPEC: string;
+export declare const UI_FILE_EXTENSIONS_PIPED: string;
+export declare function parseRouteLine(line: string, sourceFile: string): ParsedDiffEndpoint | null;
+/**
+ * Scan all route definitions in a single source file, combining prefix declarations
+ * with method-level annotations. Two orthogonal state machines run in parallel:
+ *
+ * 1. Class-prefix (Spring, NestJS, ASP.NET, Kotlin):
+ *    @Controller/@RestController/@RequestMapping (class level) + class declaration →
+ *    activates classPrefix, applied to all @Get/@Post/@GetMapping etc. below.
+ *
+ * 2. Router-variable prefix (FastAPI, Flask Blueprint):
+ *    varName = APIRouter(prefix=...) or Blueprint(url_prefix=...) — handles both
+ *    single-line and multi-line declarations — maps the variable name to its prefix.
+ *    Applied when @varName.method(...) is seen.
+ *
+ * Falls back to pure parseRouteLine for all other frameworks (Express inline, Gin,
+ * Rails, Laravel, Actix, Hapi, Go stdlib, etc.), which remain unaffected.
+ */
+export declare function parseFileEndpoints(content: string, sourceFile: string): ParsedDiffEndpoint[];
+export declare const SKIP_PATH_SEGMENTS: Set<string>;
+/**
+ * Extract the primary resource key from an endpoint path for use as a dedup key.
+ *
+ * For top-level resources (e.g. "/api/v1/orders/{id}") returns the resource name ("orders").
+ * For sub-resources (e.g. "/orders/{id}/items") returns "orders_items" — including the
+ * parent prevents "/orders/{id}/items" and "/products/{id}/items" from colliding on "items".
+ */
+export declare function extractResourceFromPath(endpointPath: string): string;
+export interface ClassifiedEndpoints {
+    /** Endpoints in scanned catalog whose sourceFile is in changedFiles (not new/deleted). */
+    changedEndpoints: ScannedEndpoint[];
+    /** Endpoints whose sourceFile is in a newly-created file. */
+    newEndpoints: ScannedEndpoint[];
+    /** Endpoints whose sourceFile is in a deleted file (recovered from base branch). */
+    removedEndpoints: ScannedEndpoint[];
+    /** Changed files that don't map to any scanned endpoint. */
+    unmatchedFiles: string[];
+    changedFiles: string[];
+    currentBranch: string;
+    baseBranch: string;
+    affectedServices: string[];
+}
+export declare function classifyEndpointsByChangedFiles(diffData: BranchDiffData, scannedEndpoints: ScannedEndpoint[], deletedFileEndpoints?: ScannedEndpoint[]): ClassifiedEndpoints;

package/build/utils/routeParsers.js

@@ -406,21 +406,36 @@ const GENERIC_ROUTE_BASENAMES = new Set(["api", "app", "handler", "handlers", "i
 function normalizeSourcePath(filePath) {
     return filePath.replace(/\\/g, "/");
 }
-/**
- * Classify endpoints by cross-referencing `changedFiles` against `scannedEndpoints[].sourceFile`.
- *
- * This replaces `parseEndpointsFromDiff` — instead of regex-parsing diff hunks for route
- * annotations (fragile for 15+ frameworks), it uses the already-scanned endpoint catalog
- * which has full, resolved paths and concrete HTTP methods.
- *
- * For deleted files, the caller must supply endpoints recovered from the base branch
- * (via `parseFileEndpoints` on `git show base:<file>`) in `deletedFileEndpoints`.
- */
+function staticPathSegments(urlPath) {
+    return urlPath.split("/").filter(s => s && !/^[:{[]/.test(s)).map(s => s.toLowerCase());
+}
+function endpointSourceResource(ep) {
+    const sourceSegments = ep.sourceFile.split(/[\\/]/).filter(Boolean);
+    const filename = sourceSegments.at(-1)?.replace(/\.[^.]+$/, "") ?? "";
+    const normalizedFilename = filename.replace(/^(?:old|new)[-_]/i, "").toLowerCase();
+    const isDynamic = /^\[.*\]$/.test(normalizedFilename) || /^\{.*\}$/.test(normalizedFilename);
+    if (!isDynamic && !GENERIC_ROUTE_BASENAMES.has(normalizedFilename) && normalizedFilename) {
+        return normalizedFilename;
+    }
+    else if (GENERIC_ROUTE_BASENAMES.has(normalizedFilename)) {
+        // Generic filename: walk up the directory tree for a more specific ancestor name.
+        const parentSegments = sourceSegments.slice(0, -1).reverse();
+        const contextSegment = parentSegments
+            .map(s => s.replace(/\.[^.]+$/, "").replace(/^(?:old|new)[-_]/i, "").toLowerCase())
+            .find(s => s && !GENERIC_ROUTE_BASENAMES.has(s) && !/^\[.*\]$/.test(s) && !/^\{.*\}$/.test(s));
+        if (contextSegment)
+            return `${contextSegment}/${normalizedFilename}`;
+    }
+    // Fall back to the last static segment of the endpoint's URL path.
+    const segments = staticPathSegments(ep.path);
+    return segments.at(-1) ?? normalizedFilename;
+}
+function endpointMovedKey(path, resource, method) {
+    return method ? `${path}::${resource}::${method}` : `${path}::${resource}`;
+}
 export function classifyEndpointsByChangedFiles(diffData, scannedEndpoints, deletedFileEndpoints) {
     const newFileSet = new Set(diffData.newFiles.map(normalizeSourcePath));
     const deletedFileSet = new Set(diffData.deletedFiles.map(normalizeSourcePath));
-    // Build sourceFile -> ScannedEndpoint[] map from the post-change catalog.
-    // Git diffs use POSIX separators; scanner output can reflect OS-native paths.
     const bySourceFile = new Map();
     for (const ep of scannedEndpoints) {
         const sourceKey = normalizeSourcePath(ep.sourceFile);
@@ -435,7 +450,6 @@ export function classifyEndpointsByChangedFiles(diffData, scannedEndpoints, dele
     const unmatchedFiles = [];
     for (const file of diffData.changedFiles) {
         const fileKey = normalizeSourcePath(file);
-        // Deleted files won't appear in scanned catalog — handled separately below
         if (deletedFileSet.has(fileKey))
             continue;
         const eps = bySourceFile.get(fileKey);
@@ -454,47 +468,26 @@ export function classifyEndpointsByChangedFiles(diffData, scannedEndpoints, dele
     // Filter out endpoints that still exist in the current catalog as moved/refactored.
     // Same router-relative paths can exist in sibling files, so only treat them as moved
     // when the source resource also matches.
-    function endpointSourceResource(ep) {
-        const sourceSegments = ep.sourceFile.split(/[\\/]/).filter(Boolean);
-        const base = sourceSegments.at(-1)?.replace(/\.[^.]+$/, "") ?? "";
-        const normalizedBase = base.replace(/^(?:old|new)[-_]/i, "").toLowerCase();
-        const isDynamicBase = /^\[.*\]$/.test(normalizedBase) || /^\{.*\}$/.test(normalizedBase);
-        if (normalizedBase && !isDynamicBase && !GENERIC_ROUTE_BASENAMES.has(normalizedBase)) {
-            return normalizedBase;
-        }
-        if (normalizedBase && GENERIC_ROUTE_BASENAMES.has(normalizedBase)) {
-            const contextSegment = [...sourceSegments]
-                .slice(0, -1)
-                .reverse()
-                .map((segment) => segment.replace(/\.[^.]+$/, "").replace(/^(?:old|new)[-_]/i, "").toLowerCase())
-                .find((segment) => segment && !GENERIC_ROUTE_BASENAMES.has(segment) && !/^\[.*\]$/.test(segment) && !/^\{.*\}$/.test(segment));
-            if (contextSegment)
-                return `${contextSegment}/${normalizedBase}`;
-        }
-        const staticSegments = ep.path.split("/").filter(Boolean).filter((segment) => !/^[:{[]/.test(segment));
-        return staticSegments[staticSegments.length - 1]?.toLowerCase() ?? normalizedBase;
-    }
     const currentMethodKeys = new Set();
     const currentPathResourceKeys = new Set();
     const currentMultiKeys = new Set();
-    const movedKey = (path, resource, method) => method ? `${path}::${resource}::${method}` : `${path}::${resource}`;
     for (const current of scannedEndpoints) {
         const currentResource = endpointSourceResource(current);
-        const pathResourceKey = movedKey(current.path, currentResource);
+        const pathResourceKey = endpointMovedKey(current.path, currentResource);
         currentPathResourceKeys.add(pathResourceKey);
         for (const method of current.methods) {
             if (method === "MULTI")
                 currentMultiKeys.add(pathResourceKey);
-            currentMethodKeys.add(movedKey(current.path, currentResource, method));
+            currentMethodKeys.add(endpointMovedKey(current.path, currentResource, method));
         }
     }
     function isMovedEndpoint(deleted, method) {
         const deletedResource = endpointSourceResource(deleted);
-        const pathResourceKey = movedKey(deleted.path, deletedResource);
+        const pathResourceKey = endpointMovedKey(deleted.path, deletedResource);
         if (method === "MULTI")
             return currentPathResourceKeys.has(pathResourceKey);
         return currentMultiKeys.has(pathResourceKey) ||
-            currentMethodKeys.has(movedKey(deleted.path, deletedResource, method));
+            currentMethodKeys.has(endpointMovedKey(deleted.path, deletedResource, method));
     }
     const removedEndpoints = (deletedFileEndpoints ?? [])
         .map((ep) => ({

package/build/utils/routeParsers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/scenarioDrafting.d.ts

@@ -0,0 +1,71 @@
+import { DraftedScenario } from "../types/RepositoryAnalysis.js";
+import { WorkspaceAuthType } from "./workspaceAuth.js";
+export declare function isRealResource(r: string): boolean;
+type MethodInput = string | {
+    method: string;
+    sourceFile?: string;
+    interactions?: Array<{
+        request?: {
+            body?: Record<string, unknown>;
+        };
+    }>;
+};
+type EndpointInput = {
+    path: string;
+    methods: Array<MethodInput>;
+};
+type EndpointRef = {
+    method: string;
+    path: string;
+    sourceFile?: string;
+};
+type ScenarioDraftOptions = {
+    /** Existing endpoints touched by a security/destructive diff; used only for attack-surface expansion. */
+    changedEndpoints?: Array<EndpointRef>;
+    /** Gate sibling destructive expansion to diffs with auth/permission/admin-key signals. */
+    securityRelevantDiff?: boolean;
+};
+export type ResourceRelationships = Map<string, Set<string>>;
+/**
+ * Infer parent→child resource relationships from two signals already present
+ * in the endpoint data — no source code scanning required.
+ *
+ * Signal 1 — path nesting (always available):
+ *   /collections/{id}/links  →  links depends on collections
+ *
+ * Signal 2 — request body FK fields (available when trace data is merged):
+ *   POST /orders body: { product_id: "..." }  →  orders depends on products
+ *
+ * Returns a map of `dependent → Set<parent>`. Only confirmed, real-resource
+ * pairs are included. When no signal is found the map is empty, which tells
+ * the caller to fall back to heuristic pairing.
+ */
+export declare function inferResourceRelationships(endpoints: Array<EndpointInput>): ResourceRelationships;
+export declare function draftScenariosFromEndpoints(endpoints: Array<EndpointInput>, newEndpoints?: Array<EndpointRef>, wsAuthType?: WorkspaceAuthType, options?: ScenarioDraftOptions, removedEndpoints?: Array<EndpointRef>): DraftedScenario[];
+/**
+ * Draft scenarios that directly test each new endpoint in the branch diff.
+ *
+ * For each new endpoint, method-specific scenarios are produced:
+ *   PUT/PATCH  → mutation-recalc integration, boundary-values integration, contract, not-found
+ *   POST       → lifecycle integration (create + optional GET), contract, validation error
+ *   DELETE     → lifecycle integration (create + delete + 404), contract
+ *   GET /{id}  → contract, not-found
+ *   GET /coll  → contract + collection-list integration (create-then-GET) or contract-only
+ *
+ * Additionally, PUT/PATCH/DELETE methods get an auth-boundary scenario
+ * (category "security_boundary" → HIGH priority, not CRITICAL) so it
+ * lands in ADDITIONAL deterministically instead of depending on LLM
+ * supplement. GET is excluded (often public); POST is excluded because
+ * the security-boundary supplement tier covers it. Exception: execution
+ * endpoints (/execute, /run, /trigger, etc.) include auth-boundary for
+ * all non-GET methods (including POST) since they are high-value targets.
+ */
+export declare function draftDiffDirectScenarios(newEndpoints: Array<{
+    method: string;
+    path: string;
+}>, resourceGroups: Map<string, {
+    basePath: string;
+    methods: Set<string>;
+    paramPath?: string;
+}>, wsAuthType?: WorkspaceAuthType): DraftedScenario[];
+export {};

package/build/utils/scenarioDrafting.js

@@ -142,7 +142,7 @@ export function inferResourceRelationships(endpoints) {
     }
     return relationships;
 }
-export function draftScenariosFromEndpoints(endpoints, newEndpoints = [], wsAuthType, options = {}) {
+export function draftScenariosFromEndpoints(endpoints, newEndpoints = [], wsAuthType, options = {}, removedEndpoints = []) {
     const scenarios = [];
     const resourceGroups = new Map();
     for (const ep of endpoints) {
@@ -191,6 +191,28 @@ export function draftScenariosFromEndpoints(endpoints, newEndpoints = [], wsAuth
     }
     scenarios.push(...draftDiffDirectScenarios(newEndpoints, resourceGroups, wsAuthType));
     scenarios.push(...draftAttackSurfaceExpansionScenarios(endpoints, options.changedEndpoints ?? [], wsAuthType, options.securityRelevantDiff ?? false));
+    // 404-guard scenarios for removed endpoints — absence assertions confirming
+    // the endpoint is gone. Single-step contract tests, no chaining needed.
+    for (const ep of removedEndpoints) {
+        scenarios.push({
+            scenarioName: `verify-removed-${ep.method.toLowerCase()}-${ep.path.replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "")}`,
+            description: `Verify ${ep.method} ${ep.path} returns 404 — endpoint was removed in this PR`,
+            category: "breaking_change",
+            priority: "high",
+            steps: [{
+                    order: 1,
+                    method: ep.method,
+                    path: ep.path,
+                    description: `${ep.method} ${ep.path} → 404 (endpoint removed)`,
+                    interactionType: "error",
+                    expectedStatusCode: 404,
+                }],
+            chainingKeys: [],
+            requiresAuth: false,
+            estimatedComplexity: "simple",
+            source: ScenarioSource.CodeInferred,
+        });
+    }
     return capScenarios(scenarios);
 }
 const MAX_TOTAL_SCENARIOS = 30;

package/build/utils/scenarioDrafting.test.d.ts

@@ -0,0 +1 @@
+export {};