@skyramp/mcp 0.2.9 → 0.2.10-rc.1

package/build/index.js

@@ -96,7 +96,7 @@ Before calling ANY test generation tool, you MUST follow this flow:
 4. **CRITICAL — endpointURL**: The \`endpointURL\` parameter MUST be the full URL to the specific endpoint being tested, NOT just the base URL. Construct it by combining \`api.baseUrl\` with the endpoint path. Example: if \`api.baseUrl\` is \`http://localhost:8000\` and the endpoint is \`/api/v1/products\`, pass \`endpointURL: "http://localhost:8000/api/v1/products"\`. NEVER pass just the base URL (e.g. \`http://localhost:8000\`) as \`endpointURL\`.
 5. **CRITICAL — scenario generation**: When calling \`skyramp_batch_scenario_test_generation\`, ALWAYS pass:
    - \`baseURL\`: The full base URL from \`api.baseUrl\` (e.g., \`http://localhost:3000\`). This determines the scheme, host, and port in the generated trace. Without it, the trace defaults to https:443 which is almost always wrong for local development.
-   - \`authHeader\`: Which HTTP header carries the auth credential. Get it from \`api.authHeader\` in workspace config. Examples: \`Authorization\` (Bearer/Token auth), \`X-Api-Key\` (API key auth), \`Cookie\` (session/cookie auth like NextAuth). Pass \`""\` to skip auth entirely (unauthenticated endpoints or \`api.authType: "none"\`).
+   - \`authHeader\`: Which HTTP header carries the auth credential. Get it from \`api.authHeader\` in workspace config. Examples: \`Authorization\` (Bearer/Token auth), \`X-Api-Key\` (API key auth), \`Cookie\` (session/cookie auth like NextAuth). Pass \`""\` to document the endpoint as unauthenticated in the generated test's assertions (unauthenticated endpoints or \`api.authType: "none"\`).
    - \`authScheme\`: Only when \`authHeader\` is \`Authorization\`. The prefix before the token (e.g., \`"Bearer"\` → \`Authorization: Bearer <token>\`). **Derive from**: (1) OpenAPI spec \`securitySchemes\`/\`securityDefinitions\`, (2) source code auth middleware, (3) workspace \`api.authType\`. **Do NOT guess.**
    - \`authToken\`: The full header value, used verbatim. When omitted, \`SKYRAMP_PLACEHOLDER_TOKEN\` is auto-generated. Only provide when the header needs a specific format (e.g., \`"session=${AUTH_PLACEHOLDER_TOKEN}"\` for Cookie). **Do NOT fabricate token values.**
    - \`apiSchema\` is OPTIONAL — omit it for code-first apps without OpenAPI specs.

package/build/prompts/enhance-assertions/uiAssertionsPrompt.js

@@ -4,6 +4,33 @@ const UI_ASSERTION_CATEGORIES = [
     {
         name: "Critical UI Assertions",
         rules: [
+            {
+                title: "Exercise the changed interaction (dynamic behavior)",
+                description: "When the PR introduces or changes interactive behavior (toggle, theme switch, expand/collapse, dialog open/close, focus management, optimistic update), the test MUST perform the triggering action and assert BOTH the state before AND after the action — not only the default or resting state. WHY: the PR's change IS the transition; a test that asserts only the initial/resting state would still pass even if the interaction were completely broken, so it gives zero coverage of what changed. If the test asserts only the resting state, add the action that triggers the change and assert the resulting transition — never mark this not applicable merely because the generated test lacks an action.",
+                subPoints: [
+                    "Toggle / switch: click the control and assert the observable flips (e.g. data-theme 'light' -> 'dark'), then click again and assert it reverses.",
+                    "Dialog / modal: open it and assert focus moves into the dialog; close via ESC or Cancel and assert focus returns to the trigger.",
+                    "The after-state must differ from the before-state — a single assertion of the unchanged default value does not verify the change.",
+                ],
+                examples: [
+                    {
+                        language: "javascript",
+                        code: `await expect(page.locator('html')).toHaveAttribute('data-theme', 'light');
+await page.getByTestId('theme-toggle').click();
+await expect(page.locator('html')).toHaveAttribute('data-theme', 'dark');`,
+                    },
+                    {
+                        // Python (playwright-python) — same before/after transition pattern
+                        language: "python",
+                        code: `trigger = page.get_by_test_id('delete-recipe')
+trigger.click()
+expect(page.get_by_role('dialog')).to_be_focused()
+page.keyboard.press('Escape')
+# focus returns to the trigger
+expect(trigger).to_be_focused()`,
+                    },
+                ],
+            },
             {
                 title: "Selector constraints",
                 description: "Every assertion uses a selector already in the file. Never invent `data-testid`, role names, or classes.",
@@ -240,7 +267,7 @@ Before editing the given test file, you must output a \`<thinking>\` block. The
 3. Classify each in-scope action / selector / captured response by its applicable assertion category, marking each category APPLICABLE or NOT APPLICABLE.
    - Critical UI Assertions applies when there is a collection / repeated element (\`toHaveCount\`), a pageerror handler, a captured network response, a negative-only or URL-only test needing a positive-path companion, or a tautological locator-by-text + assert-text to replace.
    - Computed Values applies when there is a knowable exact text / value / attribute, including a definition-page displayed value or an image \`src\`.
-   - Post-edit State applies only when the test contains a state-changing action (form fill+submit, save / delete / create / toggle, checkbox click, hover / mouseout, refresh, reload, JS update, form edit); otherwise NOT APPLICABLE.
+   - Post-edit State applies whenever EITHER (a) the test contains a state-changing action (form fill+submit, save / delete / create / toggle, checkbox click, hover / mouseout, refresh, reload, JS update, form edit), OR (b) the PR changes interactive behavior — in case (b), add the triggering action and assert the before/after transition (see "Exercise the changed interaction"). Mark NOT APPLICABLE only when the PR changes no interactive behavior and the test has no state-changing action.
 4. For each in-scope item, output one JSON object using the template below. The output is an array — repeat the object template below once per in-scope item.
    - \`action_or_selector_or_response\`: the selector, action, or captured network response this entry covers.
    - \`assertion_categories\`: an object that MUST contain every category name below as a key. The value of each category is itself an object that MUST contain every rule title under that category as a key. For each rule, the value is an array of assertion lines you will add for this item under that rule. Use \`[]\` only when the rule does not apply to this item — every category key and every rule key must still be present. This forces you to consider every rule for every item.

package/build/prompts/initialize-workspace/initializeWorkspacePrompt.js

@@ -97,6 +97,7 @@ Create one service entry per deployable unit. You MUST include every backend/API
 <api_fields>
 1. api.schemaPath: Path or URL to an OpenAPI or Swagger schema. Search for openapi.json, openapi.yaml, swagger.json, or swagger.yaml files. Framework defaults are: FastAPI serves /openapi.json, Express serves /api-docs, and Spring serves /v3/api-docs. For locally-run services, use a localhost URL. For cloud or externally hosted services (such as Salesforce, Vercel, or Cloudflare), use the actual deployment URL found in config or documentation.
 2. api.baseUrl (required): The base URL where the service is reachable, such as "http://localhost:3000" or "https://api.example.com". Derive from docker-compose ports, app config, README, or environment variables. Use localhost for services run locally and the actual deployment URL for cloud or externally hosted services. NEVER fabricate a URL. Only use URLs found in config files, README, or environment variables.
+   Include the API path prefix (e.g. \`/api\`, \`/api/v1\`, \`/v1\`) when one applies — not just \`host:port\`. A bare host means every test request hits the root and 404s. Derive the prefix from the strongest available signal: OpenAPI \`servers[].url\` or \`basePath\`; the app's routing config (FastAPI \`root_path\`, Express \`app.use('/api/v1', ...)\`, Rails routes prefix, Django \`urlpatterns\` mount); or the longest common leading path across the existing test suite's endpoints. If none of those yield a prefix, leave it bare AND flag it in your summary so the user can review.
 3. api.authType (required): The authentication type. Valid values are: ${AUTH_TYPES_PROMPT_LIST}
    Detect by checking in the following order (language-agnostic, apply whichever signals match):
    a. Dependencies and packages (package.json, requirements.txt, go.mod, Gemfile, composer.json, pom.xml, build.gradle):

package/build/prompts/personas.d.ts

@@ -1,7 +1,7 @@
 /**
  * Skyramp personas injected into tool descriptions and prompts.
  *
- * In TestBot environments (SKYRAMP_FEATURE_TESTBOT=1), the persona is injected
+ * In Testbot environments (SKYRAMP_FEATURE_TESTBOT=1), the persona is injected
  * once via `claude --append-system-prompt` from the testbot GitHub Action
  * (see testbot.git `src/agents/claude.ts` `loadQaPersona()`) rather than
  * repeating it in every tool description. In that case getPersonaPrefix()
@@ -14,7 +14,7 @@
 export declare const SKYRAMP_QA_PERSONA = "You are acting as a Skyramp QA Automation Engineer. Your responsibility is to translate user test intent into precise, deterministic test artifacts \u2014 whether generating API tests from specs, recording browser interactions for UI flows, or maintaining existing test suites. Derive all parameters strictly from the codebase, workspace config, API schemas, and page snapshots. Never guess or hallucinate values.";
 /**
  * Returns the persona prefix for use in tool descriptions.
- * Returns an empty string when running inside TestBot — the testbot action
+ * Returns an empty string when running inside Testbot — the testbot action
  * appends the persona via `claude --append-system-prompt` instead, so we
  * avoid duplicating it in every tool description.
  */

package/build/prompts/personas.js

@@ -2,7 +2,7 @@ import { isTestbotEnabled } from "../utils/featureFlags.js";
 /**
  * Skyramp personas injected into tool descriptions and prompts.
  *
- * In TestBot environments (SKYRAMP_FEATURE_TESTBOT=1), the persona is injected
+ * In Testbot environments (SKYRAMP_FEATURE_TESTBOT=1), the persona is injected
  * once via `claude --append-system-prompt` from the testbot GitHub Action
  * (see testbot.git `src/agents/claude.ts` `loadQaPersona()`) rather than
  * repeating it in every tool description. In that case getPersonaPrefix()
@@ -15,7 +15,7 @@ import { isTestbotEnabled } from "../utils/featureFlags.js";
 export const SKYRAMP_QA_PERSONA = `You are acting as a Skyramp QA Automation Engineer. Your responsibility is to translate user test intent into precise, deterministic test artifacts — whether generating API tests from specs, recording browser interactions for UI flows, or maintaining existing test suites. Derive all parameters strictly from the codebase, workspace config, API schemas, and page snapshots. Never guess or hallucinate values.`;
 /**
  * Returns the persona prefix for use in tool descriptions.
- * Returns an empty string when running inside TestBot — the testbot action
+ * Returns an empty string when running inside Testbot — the testbot action
  * appends the persona via `claude --append-system-prompt` instead, so we
  * avoid duplicating it in every tool description.
  */

package/build/prompts/sut-setup/modes/dockerComposePrompt.js

@@ -93,6 +93,9 @@ Steps:
    - The \`--project-directory .\` means build context is the repository root (NOT .skyramp/sut/)
    - Healthchecks for ALL services (testbot relies on \`--wait\`)
    - Simple testbot credentials in environment (admin@testbot.com / testbot)
+   - Never paste cryptographic material into the \`environment:\` section of the compose file. This rule covers RSA and EC private keys, PEM blobs, JWK JSON, OAuth client secrets, and any other signing keypair. In practice, refuse anything that looks like a PEM block (text starting with \`-----BEGIN \` followed by \`PRIVATE KEY\`, \`RSA PRIVATE KEY\`, \`EC PRIVATE KEY\`, \`OPENSSH PRIVATE KEY\`, or \`ENCRYPTED PRIVATE KEY\` and the matching \`-----\`), a JWK in base64url-encoded JSON form (strings starting with \`eyJrdHkiOi\`, which decodes to \`{"kty":\`), or any base64 string longer than about 200 characters that looks like a key. The compose file is committed to the customer's repository, so anything written here lands in their PR diff and stays in git history — including the private half of any keypair. Two cases to handle:
+     1. **Symmetric secrets** — when the app accepts a plain string (\`JWT_SECRET\`, \`SESSION_SECRET\`, signing salts, HMAC keys), use a clearly-marked dummy literal so a code reviewer immediately recognizes it as fake. For example: \`JWT_SECRET: "testbot-dummy-do-not-use-in-production"\`.
+     2. **Asymmetric keys** — when the app requires a real keypair (RS256 JWT signing, gRPC TLS, signing keypairs), do not commit the keys. Instead, generate them inside the container at startup so they exist only for the container's lifetime. First look at the app's source or config to determine what format it expects: PEM, JWK, or raw base64. Then override the service's \`entrypoint\` with a short script that generates a keypair in that format, exports the key bodies into the env vars the app reads, and finally \`exec\`s the app's original command. Pick the tool that matches the format: \`openssl genpkey\` for PEM, \`python -m jwcrypto\` / \`node -e "require('jose')..."\` / \`step crypto jwk create\` for JWK, \`openssl rand -base64\` for a raw secret. Prefer a tool that already exists in the app's runtime image — for instance, a Django service usually has \`jwcrypto\` or \`josepy\` installed already — rather than installing one at startup. Testbot fetches its bearer token via \`get-auth-token.sh\`, which calls the app's login endpoint; the app signs the token with its in-container private key and returns it as an opaque string. The test client never reads the private key directly, so per-container ephemeral keys are enough — no GitHub repo secrets, no out-of-band key sharing.
    - Generous \`start_period\` (30-120s) for CI cold builds
    - For monorepos: may need a builder service that runs first
 

package/build/prompts/sut-setup/shared.js

@@ -80,9 +80,7 @@ export function buildWorkspaceInitSection() {
 1. Call \`skyramp_init_scan\` with \`workspacePath\` set to that repository root → follow the returned instructions to discover all services.
 2. Call \`skyramp_init_workspace\` with the same \`workspacePath\`, \`services\`, and the \`scanToken\` from step 1.
 
-This produces a baseline \`.skyramp/workspace.yml\` listing the services Testbot will test. Later steps in this SUT bootstrap run write \`.skyramp/sut/*\` files alongside it. You might have to update the per-service \`runtimeDetails.serverStartCommand\` to match the new SUT files created, so Testbot brings up the services correctly.
-
-Also verify each service's \`api.baseUrl\` includes the API path prefix (e.g. \`/api\`, \`/api/v1\`, \`/v1\`) — not just \`host:port\`. A bare host means every test request hits the root and 404s. Derive the prefix from the strongest available signal: OpenAPI \`servers[].url\` or \`basePath\`; the app's routing config (FastAPI \`root_path\`, Express \`app.use('/api/v1', ...)\`, Rails routes prefix, Django \`urlpatterns\` mount); or the longest common leading path across the existing test suite's endpoints. If none of those yield a prefix, leave it bare AND flag it in your summary so the user can review.`;
+Later steps in this SUT bootstrap run write \`.skyramp/sut/*\` files alongside the workspace file. If you need to update per-service \`runtimeDetails.serverStartCommand\` to match the new SUT files, call \`skyramp_init_workspace\` again with \`force: true\` and the full updated services array — never use Edit/Write directly on \`.skyramp/workspace.yml\`. See the \`skyramp_init_workspace\` tool description for the edit-mode contract.`;
 }
 export function buildLocalValidationSection() {
     return `Before reporting success, exercise the adapted workflow locally. Testbot's external fix loop only retries when SUT lifecycle commands are set on the Testbot action. When the SUT is brought up by surrounding GHA steps (skipTargetSetup: 'true'), the fix loop is skipped — so the local check below is the only safety net before the workflow is committed.

package/build/prompts/test-maintenance/drift-analysis-prompt.d.ts

@@ -14,4 +14,4 @@ export type UiDriftParams = {
 export declare function buildDriftAnalysisPrompt(stateFile: string | undefined, apiTests: Array<{
     testFile: string;
     source?: string;
-}>, ui?: UiDriftParams): string;
+}>, ui?: UiDriftParams, repoPaths?: string[]): string;

package/build/prompts/test-maintenance/drift-analysis-prompt.js

@@ -1,6 +1,6 @@
 import { buildActionDecisionTree, buildCheckAdditiveFields, buildCheckEndpointExistence, buildCheckResponseShape, buildCheckAuthAndAuthorization, buildCheckBehavioralContract, buildCheckAssignAction, buildDriftOutputChecklist, } from "./driftAnalysisSections.js";
-import { buildUiActionDecisionTree, buildUiCheckRouteExistence, buildUiCheckSelectors, buildUiCheckPageObjects, buildUiCheckBehavioralChanges, buildUiCheckAssignAction, buildUiCheckExportedSymbols, buildUiDriftOutputChecklist, } from "./uiDriftAnalysisSections.js";
-import { RECOMMENDATIONS_INSTRUCTION } from "./driftAnalysisShared.js";
+import { buildUiActionDecisionTree, buildUiCheckRouteExistence, buildUiCheckSelectors, buildUiCheckPageObjects, buildUiCheckBehavioralChanges, buildUiCheckAssignAction, buildUiDriftOutputChecklist, } from "./uiDriftAnalysisSections.js";
+import { RECOMMENDATIONS_INSTRUCTION, buildSymbolDiscoveryStep } from "./driftAnalysisShared.js";
 import { PromptPlan } from "../test-recommendation/promptPlan.js";
 const _apiPlan = new PromptPlan()
     .addPhase("maintenance", "Test Maintenance Assessment", {
@@ -21,7 +21,6 @@ const _uiPlan = new PromptPlan()
     headerLevel: "##",
     stepFormat: "hash",
 })
-    .step("UI_SYMBOL_PRESCAN", "Exported symbol pre-scan — find additional impacted tests via grep", (p) => buildUiCheckExportedSymbols(p.changedFrontendFiles))
     .step("UI_ASSESS", "UI Action Decision Tree — assess each UI test against the diff and blueprints", () => buildUiActionDecisionTree())
     .subStep("UI_ROUTE_EXISTENCE", "Route existence", () => buildUiCheckRouteExistence())
     .subStep("UI_SELECTORS", "Selector validity", () => buildUiCheckSelectors())
@@ -36,8 +35,14 @@ const _uiPlan = new PromptPlan()
  * - ui: when provided, appends a UI drift section for component/browser tests.
  *   Omit when no frontend files changed or no UI tests exist.
  */
-export function buildDriftAnalysisPrompt(stateFile, apiTests, ui) {
+export function buildDriftAnalysisPrompt(stateFile, apiTests, ui, repoPaths) {
     const parts = [];
+    // Emit symbol discovery once at the top regardless of how many sections follow.
+    // Placing it inside each plan's checklist caused duplication on mixed diffs.
+    const hasAnyTests = apiTests.length > 0 || (ui?.tests?.length ?? 0) > 0;
+    const discovery = buildSymbolDiscoveryStep(hasAnyTests, repoPaths);
+    if (discovery)
+        parts.push(discovery);
     // Include API drift when there are API tests, or when UI drift is not running
     // (ensures skyramp_actions is always reachable even if apiTests is empty).
     if (apiTests.length > 0 || !ui) {
@@ -67,7 +72,7 @@ For each test above, read it to determine its type, then apply the scope gate fr
 </ui_analysis_context>
 
 `;
-        parts.push(contextHeader + `<ui_drift_analysis_rules>\n${_uiPlan.render({ stateFile, tests: ui.tests, changedFrontendFiles: ui.changedFrontendFiles, blueprintCaptured: ui.blueprintCaptured })}\n</ui_drift_analysis_rules>`);
+        parts.push(contextHeader + `<ui_drift_analysis_rules>\n${_uiPlan.render({ stateFile, tests: ui.tests, blueprintCaptured: ui.blueprintCaptured })}\n</ui_drift_analysis_rules>`);
     }
     parts.push(RECOMMENDATIONS_INSTRUCTION);
     return parts.join("\n\n");

package/build/prompts/test-maintenance/driftAnalysisSections.js

@@ -210,9 +210,6 @@ export function buildDriftOutputChecklist(stateFile, existingTests) {
     const noTestsNote = !hasTests
         ? `\nNo existing tests were found. Call \`skyramp_actions\` with \`recommendations: []\` and explain in your report why no maintenance was needed (e.g. "no existing tests cover the changed endpoints" or "PR adds a new endpoint with no prior coverage").\n`
         : "";
-    const symbolDiscoveryStep = hasTests
-        ? `**Symbol import discovery (before assessing tests):** If the diff adds or modifies class, function, or type definitions, grep the repository for test files that import those symbol names. Add any matched test files not already in the list below to your assessment — these files may need updating even if their path doesn't match the changed resource name. Include all discovered files in the \`recommendations[]\` passed to \`skyramp_actions\`.`
-        : "";
     const existingTestSection = `**Existing tests (${existingTests?.length ?? 0} total) — assess ALL of the following:**
 ${testList}
 ${noTestsNote}
@@ -244,7 +241,7 @@ Action: DELETE
 Rationale: DELETE because {quoted diff signal}; all covered endpoints removed
 \`\`\`
 Be concise — one line per VERIFY/IGNORE entry.`;
-    const sections = [symbolDiscoveryStep, existingTestSection, finalStep].filter(Boolean);
+    const sections = [existingTestSection, finalStep];
     return `<output_format>
 Complete ALL of the following:
 

package/build/prompts/test-maintenance/driftAnalysisShared.d.ts

@@ -1,4 +1,10 @@
-/** Shared drift prompt sections (assign-action, external test policy) for API and UI prompts. */
+/** Shared drift prompt sections (assign-action, external test policy, symbol discovery) for API and UI prompts. */
+/**
+ * Build the symbol-discovery grep instruction — unified for API and UI tests.
+ * Two-pass: hunk-context symbols (what changed) + full file exports (what exists),
+ * covering aliases, indirect renders, and shared hooks the diff doesn't mention.
+ */
+export declare function buildSymbolDiscoveryStep(hasTests: boolean, repoPaths?: string[]): string;
 /** One source of truth for the recommendations[] contract passed to skyramp_actions. */
 export declare const RECOMMENDATIONS_INSTRUCTION = "Pass VERIFY, UPDATE, REGENERATE, and DELETE entries to `recommendations[]`. Omit IGNORE.";
 export declare function buildSharedExternalTestPolicy(): string;

package/build/prompts/test-maintenance/driftAnalysisShared.js

@@ -1,4 +1,22 @@
-/** Shared drift prompt sections (assign-action, external test policy) for API and UI prompts. */
+/** Shared drift prompt sections (assign-action, external test policy, symbol discovery) for API and UI prompts. */
+/**
+ * Build the symbol-discovery grep instruction — unified for API and UI tests.
+ * Two-pass: hunk-context symbols (what changed) + full file exports (what exists),
+ * covering aliases, indirect renders, and shared hooks the diff doesn't mention.
+ */
+export function buildSymbolDiscoveryStep(hasTests, repoPaths) {
+    if (!hasTests)
+        return "";
+    const repoList = repoPaths && repoPaths.length > 1
+        ? repoPaths.map(p => `\`${p}\``).join(", ")
+        : repoPaths?.[0] ? `\`${repoPaths[0]}\`` : "the repository";
+    return `**Symbol discovery (before assessing):** Find additional test files that reference changed code:
+
+1. **Hunk context:** Extract function and class names from \`@@\` context lines and changed endpoint URL path segments. Grep ${repoList} for each.
+2. **Full file exports:** For each changed source file in the diff, read it and extract all exported symbols (component names, function names, hooks, class names). Grep ${repoList} for each (case-insensitive). This catches tests using aliased imports, indirect renders, or shared hooks not visible in the diff hunk.
+
+Add any matched test files not already in your assessment, and include them in \`recommendations[]\`.`;
+}
 /** One source of truth for the recommendations[] contract passed to skyramp_actions. */
 export const RECOMMENDATIONS_INSTRUCTION = `Pass VERIFY, UPDATE, REGENERATE, and DELETE entries to \`recommendations[]\`. Omit IGNORE.`;
 export function buildSharedExternalTestPolicy() {

package/build/prompts/test-maintenance/uiDriftAnalysisSections.d.ts

@@ -3,12 +3,6 @@
  * This is the main entry point for UI drift analysis.
  */
 export declare function buildUiActionDecisionTree(): string;
-/**
- * Pre-scan step: agent greps changed files' exported symbols across the test
- * directory to catch tests that server-side discovery missed — aliased imports,
- * indirect renders, or any test the blueprint diff doesn't directly reference.
- */
-export declare function buildUiCheckExportedSymbols(changedFrontendFiles?: string[]): string;
 /**
  * Check if routes targeted by the UI test still exist.
  */

package/build/prompts/test-maintenance/uiDriftAnalysisSections.js

@@ -57,22 +57,6 @@ Build a detection list first: for each matched diff line, write one line: \`{pat
 - Primary matching signal: read the test to check if it directly renders a changed component — if so, it is impacted.
 </ui_decision_rules>`;
 }
-/**
- * Pre-scan step: agent greps changed files' exported symbols across the test
- * directory to catch tests that server-side discovery missed — aliased imports,
- * indirect renders, or any test the blueprint diff doesn't directly reference.
- */
-export function buildUiCheckExportedSymbols(changedFrontendFiles) {
-    const files = (changedFrontendFiles ?? []).join(", ") || "the changed frontend files";
-    return `The server pre-discovered the tests listed above using exported symbols and UI signals (testids, aria-labels, i18n keys, CSS classes) from the diff. Before assessing, do a quick complementary grep to catch any tests the server may have missed — aliased imports, indirect renders, or tests using symbols not present in the diff:
-
-1. For each changed frontend file (${files}):
-   a. Read the file and extract exported symbols — component names, function names, hook names, class names.
-   b. Grep the test directory for each symbol name (case-insensitive).
-   c. For any matching test file not already in the \`<ui_analysis_context>\` list — read it and apply the decision tree.
-
-This catches tests that import a changed symbol under an alias, exercise a shared hook, or render the changed component indirectly via a parent.`;
-}
 /**
  * Check if routes targeted by the UI test still exist.
  */

package/build/prompts/test-recommendation/recommendationShared.js

@@ -76,7 +76,7 @@ export function buildExternalCoverageSet(testLocations) {
     }
     return coverage;
 }
-// Shared TestBot task and step labels used by prompt modules that cannot import
+// Shared Testbot task and step labels used by prompt modules that cannot import
 // testbot-prompts.ts directly without creating a circular dependency.
 export const TASK_UI_PRESCAN = "0";
 export const TASK_ANALYZE_MAINTAIN = "1";

package/build/prompts/testbot/testbot-prompts.js

@@ -86,7 +86,7 @@ Verify the prompt inside <USER_PROMPT> is related to adding or removing tests fr
 
 ### Task 1: Retrieve Previous Recommendations
 Call \`skyramp_analyze_changes\` with \`repositoryPath\`: "${repositoryPath}", \`scope\`: "branch_diff"${baseBranch ? `, \`baseBranch\`: "${baseBranch}"` : ""}${prNumber ? `, \`prNumber\`: ${prNumber}` : ""}${testsRepoDir ? `, \`testsRepoDir\`: "${testsRepoDir}"` : ""}.
-This will fetch the previous TestBot report from the PR comments and return deduplicated recommendations.
+This will fetch the previous Testbot report from the PR comments and return deduplicated recommendations.
 Use those recommendations as your baseline. Only add or remove tests that the user requested AND that appear in the Additional Recommendations. Then proceed straight to Task 2: Generate New Tests.
 `
         : `
@@ -102,7 +102,7 @@ Use those recommendations as your baseline. Only add or remove tests that the us
    **Feature context check:** After capturing a blueprint per the UI Blueprint Capture instructions, cross-check whether it actually shows the changed feature. Look at the diff — what component, field, or UI element was changed? If that component only renders in a specific context (a particular collection type, a non-empty list, a specific user role, a form that only appears after a prior action), and the blueprint you captured doesn't contain it, navigate to the right context before using this blueprint for recommendations. A blueprint that doesn't show the changed feature produces recommendations that test the wrong thing — for example, recommending tests against a system collection when the PR changed behavior on custom collections. If you can't determine the right context from the diff and workspace config, note it in \`issuesFound\` and fall back to source-grounded recommendations for that URL.
 
    **If \`skyramp_analyze_changes\` returns an error:** retry once only if the error is transient (timeout, network blip, temporary unavailability) — do NOT retry for permanent errors (invalid repository path, missing required parameter, authentication failure). If it fails again, call \`skyramp_submit_report\` with a minimal valid payload: leave all test arrays empty and add the error to \`issuesFound\`. Refer to the \`skyramp_submit_report\` schema for required fields. Do NOT attempt Task 2 without a valid stateFile.
-   **If all changed files are non-application** (CI/CD, docs, lock files, config) → skip to Task 3 (Submit Report) with empty arrays and a single \`issuesFound\` entry explaining why (same format as the zero-test path below).
+   **If all changed files are non-application** (CI/CD, docs, lock files, config) → skip to Task 3 (Submit Report) with empty arrays. Put the one-paragraph summary in \`businessCaseAnalysis\` (always populated; that's where end-state narration belongs); leave \`issuesFound\` empty — a non-application diff is not an issue. Example narration for a Testbot onboarding PR (\`.github/workflows/skyramp-testbot.yml\` and/or files under \`.skyramp/\`): "This PR adds Skyramp Testbot GitHub Actions workflow configuration to enable automated test generation on every pull request. It also adds System Under Test (SUT) setup files under \`.skyramp/sut/\` required for the testbot workflow, to bring up services for testing. It contains no application code changes and has no testable behavioral surface."
 ${hasRelatedRepos ? `
    **MULTI-REPO CONTEXT (MANDATORY).** This run includes ${relatedRepositories.length} related ${relatedRepositories.length === 1 ? "repository" : "repositories"} listed in the \`<related_repositories>\` block below, each with an explicit \`repository\` (\`owner/repo\`), \`path\`, and \`base_branch\`. Use the \`repository\` value verbatim — do NOT infer it from git remotes or paths. You MUST analyze EACH related repository — exactly one \`skyramp_analyze_changes\` call per listed repo (${relatedRepositories.length} ${relatedRepositories.length === 1 ? "call" : "calls"}), in addition to the primary call in step 2.
 
@@ -130,7 +130,7 @@ ${hasRelatedRepos ? `
 
    b. Write \`updateInstructions\` for each UPDATE or REGENERATE test before calling \`skyramp_actions\` — articulating the change first prevents file content from overriding diff-based reasoning.
 
-   c. Call \`skyramp_execute_test\` with \`phase: "before"\` and \`stateFile\` for every test whose action is UPDATE or REGENERATE. Run them in parallel. This captures the pre-edit baseline — do not skip even if you expect the test to fail.
+   c. Call \`skyramp_execute_test\` with \`phase: "before"\` and \`stateFile\` for every test whose action is UPDATE, REGENERATE, or DELETE. Run them sequentially, not in parallel. This captures the pre-edit baseline — do not skip even if you expect the test to fail.
 
    d. Call \`skyramp_actions\` with \`stateFile\` (from \`skyramp_analyze_changes\` output) and apply the edits it returns.
 
@@ -370,7 +370,7 @@ ${userPrompt ? "Generate only the tests that the user requested from the Additio
   **Flutter web apps:** Skyramp's Playwright tools automatically enable Flutter's accessibility semantics tree on every \`browser_navigate\` call — you do NOT need to manually click \`flt-semantics-placeholder\` or add any activation step to the trace. Do NOT log an \`issuesFound\` entry about Flutter canvas rendering or accessibility activation — this is handled transparently. **Do NOT skip test generation or abstain from recording based on what you see in the Flutter source code** (e.g. \`SemanticsBinding.ensureSemantics()\` commented out, \`IS_TESTING\` flag absent, or similar) — Skyramp enables accessibility from the browser side regardless of the app's Dart code. Proceed with \`browser_navigate\` and test recording as normal. **Start at the app's root URL** (e.g. \`{baseUrl}/\`) — do NOT \`browser_navigate\` straight to a deep sub-route (e.g. \`/authors\`, \`/orders/13\`). Flutter \`go_router\` SPAs route from the root: deep-linking on a cold page load often fails to render the expected screen (the route's widgets never mount, so the trace captures the wrong page). Load the root, let the app's own routing/auth-redirect render, then reach target screens by interaction. **After the initial login, navigate using in-app controls only** (tab buttons, links, back buttons) — do NOT call \`browser_navigate\` to a different URL after login. Flutter web apps are SPAs: a \`browser_navigate\` to a new URL after login triggers a full page reload which clears the auth session, causing redundant re-login cycles in the generated test. Use button clicks to reach target screens instead.
   **Skip only if one of these conditions is met:**
   - **(a) App is unreachable** — \`browser_navigate\` fails or connection is refused.
-  - **(b) Unintegrated non-route component** — the changed file is a leaf component (not a framework route/entrypoint) that has no integration point in the running app. To confirm:
+  - **(b) Unintegrated non-route component** — the changed file is a leaf component (not a framework route/entrypoint) that has no integration point in the running app. **The server already computes this** — check \`uiContext.frontendFileIntegration\` in the \`skyramp_analyze_changes\` output: if it marks the changed file \`integrated: false\`, treat the component as unintegrated WITHOUT re-running the grep below (the tool output's accompanying instruction block already tells you what to do — do not substitute another page or trace). Only fall back to the manual grep procedure when \`frontendFileIntegration\` is absent (older MCP versions) or doesn't cover the changed file:
     1. Grep for the component's exported name AND its module path/filename across all production source files (excluding \`*.test.*\`, \`*.spec.*\`, \`*.stories.*\`, \`__tests__/\` directories — only production code imports count).
     2. If no production file imports, re-exports, or renders it, the component has no DOM node in the running app → unintegrated.
     3. **Exception**: if the same PR also adds a route/page file (e.g. under Next.js \`pages/\` or \`app/\`) that imports the component, the route IS the integration point — test through it.
@@ -547,7 +547,7 @@ Do NOT use \`page.waitForTimeout()\` with fixed delays. Do NOT retry more than o
 4. **Wait**: Do NOT proceed to test execution until steps 1–3 are complete and the verification checklist in the \`skyramp_enhance_assertions\` tool result has been validated for EVERY generated test file.
 Do not make any changes other than the assertion enhancements described above. For example: do not modify auth headers, cookies, tokens, env vars, or imports that the generation tool already set correctly — those are correct by construction and changing them breaks auth or execution.
 
-**Final execution (mandatory):** Do NOT call \`skyramp_execute_test\` until ALL maintenance edits AND ALL new test generation/enhancement are complete.
+**Final execution (mandatory):** Do NOT call \`skyramp_execute_test\` until ALL maintenance edits AND ALL new test generation/enhancement are complete. Run these calls sequentially, not in parallel.
 - Only report test results for files you actually ran.
 **Auth**: If \`skyramp_analyze_changes\` reports an auth token or \`SKYRAMP_TEST_TOKEN\` is set, pass it in **every** \`skyramp_execute_test\` call from the first attempt — do NOT wait for a 401/403 to discover auth is needed.
 
@@ -579,7 +579,7 @@ ${hasRelatedRepos ? `
 - **additionalRecommendations**: AT MOST ${maxRecommendations - maxGenerate} items.
   - For \`testType: "contract"\` entries: **\`primaryEndpoint\` is required** (e.g. \`"GET /api/v1/users/{user_id}"\`). The tool will reject the submission without it — do not omit it or you will be forced to resubmit.
   - For \`testType: "integration"\` or \`"e2e"\` entries: omit \`primaryEndpoint\` — use \`description\` to list the endpoints involved instead.
-- **\`testMaintenance\`**: include one entry per test that received UPDATE, REGENERATE, DELETE, or VERIFY. Do NOT include IGNORE — a test assessed and confirmed clean is not a maintenance action and adds noise to the report.
+- **\`testMaintenanceDetails\`**: include one entry per test that received UPDATE, REGENERATE, DELETE, or VERIFY. Do NOT include IGNORE — a test assessed and confirmed clean is not a maintenance action and adds noise to the report.
 - **testResults**: For UI/E2E test entries, include the \`videoPath\` field if \`skyramp_execute_test\` returned one.
 
 ---
@@ -631,7 +631,7 @@ export function buildWorkspaceRecoveryPrefix(repositoryPath) {
 export function registerTestbotPrompt(server) {
     logger.info("Registering testbot prompt");
     server.registerPrompt("skyramp_testbot", {
-        description: "Run Skyramp TestBot to generate test recommendations and perform test maintenance for a pull request.",
+        description: "Run Skyramp Testbot to generate test recommendations and perform test maintenance for a pull request.",
         argsSchema: {
             prTitle: z.string().describe("Pull request title"),
             prDescription: z.string().describe("Pull request description/body"),
@@ -661,7 +661,7 @@ export function registerTestbotPrompt(server) {
             prNumber: z
                 .number()
                 .optional()
-                .describe("GitHub PR number. Passed to skyramp_analyze_changes to fetch previous TestBot comments for recommendation consistency across commits."),
+                .describe("GitHub PR number. Passed to skyramp_analyze_changes to fetch previous Testbot comments for recommendation consistency across commits."),
             userPrompt: z
                 .string()
                 .optional()

package/build/resources/testbotResource.js

@@ -14,7 +14,7 @@ export function registerTestbotResource(server) {
         list: undefined,
     });
     server.registerResource("skyramp_testbot", template, {
-        title: "Skyramp TestBot Prompt",
+        title: "Skyramp Testbot Prompt",
         description: "Returns task instructions for PR test analysis, generation, and maintenance.",
         mimeType: "text/plain",
     }, async (uri) => {

package/build/services/TestDiscoveryService.d.ts

@@ -121,7 +121,6 @@ export declare class TestDiscoveryService {
      * Extract API schema path from test content
      * Looks for Skyramp command line first, then fallback to other patterns
      */
-    private extractApiSchema;
     /**
      * Extract Framework from test content
      * Looks for Skyramp command line first, then fallback to other patterns

package/build/services/TestDiscoveryService.js

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { logger } from "../utils/logger.js";
 import { TestSource } from "../types/TestAnalysis.js";
+import { TestType } from "../types/TestTypes.js";
 import fg from "fast-glob";
 export class TestDiscoveryService {
     EXCLUDED_DIRS = [
@@ -329,7 +330,6 @@ export class TestDiscoveryService {
         }
         const language = this.detectLanguage(testFile);
         const testType = this.detectTestType(content);
-        const apiSchema = this.extractApiSchema(content);
         const framework = this.extractFramework(content);
         const apiEndpoint = this.extractCoveredEndpoints(content);
         return {
@@ -337,8 +337,8 @@ export class TestDiscoveryService {
             testType,
             language,
             framework,
-            apiSchema,
             apiEndpoint,
+            source: TestSource.Skyramp,
         };
     }
     /**
@@ -498,24 +498,24 @@ export class TestDiscoveryService {
     detectExternalTestType(filePath, content) {
         const lowerPath = filePath.toLowerCase();
         if (/integration|_integration/.test(lowerPath))
-            return "integration";
+            return TestType.INTEGRATION;
         if (/e2e|end[_-]to[_-]end/.test(lowerPath))
-            return "e2e";
+            return TestType.E2E;
         // Playwright/Cypress directory paths → e2e even without "e2e" in the filename.
         // Ensures correct testType for tests where content wasn't read (framework stays "").
         if (/[\\/]playwright[\\/]|[\\/]cypress[\\/]/.test(lowerPath))
-            return "e2e";
+            return TestType.E2E;
         if (/contract/.test(lowerPath))
-            return "contract";
+            return TestType.CONTRACT;
         if (/smoke/.test(lowerPath))
-            return "smoke";
+            return TestType.SMOKE;
         if (/load|performance/.test(lowerPath))
-            return "load";
+            return TestType.LOAD;
         if (/[\\/]unit[\\/]|_unit/.test(lowerPath))
-            return "unit";
+            return TestType.UNIT;
         if (/(?:requests|fetch|axios|supertest|RestAssured)/i.test(content))
-            return "integration";
-        return "unknown";
+            return TestType.INTEGRATION;
+        return TestType.UNKNOWN;
     }
     detectExternalFramework(content) {
         if (/from selenium\b|import selenium\b|from appium\b|import appium\b/.test(content))
@@ -637,39 +637,19 @@ export class TestDiscoveryService {
      * Checks Skyramp command line, filename, and content patterns
      */
     detectTestType(content) {
-        const testTypes = [
-            "smoke",
-            "integration",
-            "load",
-            "contract",
-            "fuzz",
-            "e2e",
-            "ui",
-        ];
-        // First, try to extract from Skyramp command line
-        // Pattern: skyramp generate smoke rest ...
         const commandMatch = content.match(/skyramp generate (\w+)/i);
         if (commandMatch && commandMatch[1]) {
             const type = commandMatch[1].toLowerCase();
-            if (testTypes.includes(type)) {
+            if (Object.values(TestType).includes(type)) {
                 return type;
             }
         }
-        return "";
+        return TestType.UNKNOWN;
     }
     /**
      * Extract API schema path from test content
      * Looks for Skyramp command line first, then fallback to other patterns
      */
-    extractApiSchema(content) {
-        // First, try to extract from Skyramp command line
-        // Pattern: --api-schema http://localhost:8000/openapi.json
-        const apiSchemaMatch = content.match(/--api-schema\s+([^\s\\]+)/);
-        if (apiSchemaMatch && apiSchemaMatch[1]) {
-            return apiSchemaMatch[1];
-        }
-        return "";
-    }
     /**
      * Extract Framework from test content
      * Looks for Skyramp command line first, then fallback to other patterns