@skyramp/mcp 0.3.1 → 0.3.2-rc.pom-2

package/build/prompts/test-recommendation/diffExecutionPlan.js

@@ -1,3 +1,4 @@
+import { roundRobinByType } from "../../recommendation/diversity.js";
 import { AUTH_MIDDLEWARE_PATTERNS_STR } from "../../utils/workspaceAuth.js";
 import { resolveServiceDetailsRef } from "../../utils/utils.js";
 import { logger } from "../../utils/logger.js";
@@ -21,7 +22,7 @@ The highest-severity \`<bug_found>\` block from this code review triggers a mand
 }
 function _execCoverageBody(ctx) {
     return `${ctx.externalTestFilesList}For every GENERATE item below, check its endpoint path and test type against the Existing Tests list (further down in the prompt).
-- **\`[external]\` tests**: If the endpoint is already covered by an \`[external]\` test of the same type → skip the resource entirely (do NOT create or update), **except for \`bug_caught\` and attack-surface \`security_boundary\` items**. A protected item may be skipped only if the external test directly asserts the same flaw/bypass and would fail/pass based on that same bug; same endpoint/resource coverage alone is not enough. Backfill from ADDITIONAL using the priority order below:
+- **\`[external]\` tests**: If the endpoint is already covered by an \`[external]\` test of the same type **that exercises the behavior this PR changes** → skip the resource entirely (do NOT create or update). Resource-level overlap alone is NOT coverage: when the PR tightens or adds a constraint (e.g. a max-items/max-length/enum bound), an external test that never crosses the new bound does not cover it — generate the boundary test. This matters most for single-resource APIs (e.g. one CRD served by the kube-apiserver), where resource-level dedup would permanently block all generation. \`bug_caught\` and attack-surface \`security_boundary\` items get the strictest reading: they may be skipped only if the external test directly asserts the same flaw/bypass and would fail/pass based on that same bug. Backfill from ADDITIONAL using the priority order below:
   1. **BUG-CATCHING TESTS FIRST (CRITICAL)**: If source code analysis revealed a bug, logic error, or incorrect formula (e.g. discount math adding instead of subtracting, off-by-one errors, missing validation), CREATE A TEST THAT EXPOSES IT. The test SHOULD FAIL — that's the point. Document the bug. Example: if discount formula is wrong, test with discount=20% and assert correct math. If no bug found, skip to #2.
   2. **PR-endpoint edge cases**: Look for integration test candidates covering error paths, boundary values, or alternative scenarios for the SAME endpoints changed in the PR diff. If no suitable candidate exists in ADDITIONAL, derive one from your source-code enrichment findings.
   3. **Same-resource other scenarios**: Other HTTP methods or flows on the same resource group touched by the PR.
@@ -94,6 +95,11 @@ For each pair of GENERATE items, ask: same HTTP method + path + step sequence +
 
 Same step sequence with only payload differences (e.g. 10% vs 5% discount both returning 200) = same code path = duplicate. Different scenario names do not make duplicate tests distinct.`;
 }
+function _execRegisterBody(_ctx) {
+    return `Register your complete candidate list — every test you would generate OR recommend — via \`skyramp_register_test_plan\` (\`stateFile\` required). Include a discriminator claim (\`discriminator\` field — valid kinds and anchor rules are in the tool schema) for candidates probing the changed logic identified in Step ${EXEC_STEP_CODE_REVIEW}/Step ${EXEC_STEP_ENRICH}.
+
+The returned GENERATE list is mandatory and final — generation tools reject unregistered scenarios. If the tool demotes a discriminator claim (returned in \`demotions\` with a reason), either strengthen the claim — a step that actually exercises the declared \`kind\`, or a verbatim anchor that occurs in the diff — or drop it; the candidate itself stays in the plan either way.`;
+}
 function _execExecuteBody(ctx) {
     return `Replace any scenario that pairs unrelated resources with one reflecting actual foreign-key relationships in the codebase.
 Use the field names and values from the \`<source_evidence>\` blocks you quoted in Step ${EXEC_STEP_ENRICH} to fill all tool call parameters. Prefer reusing Step ${EXEC_STEP_ENRICH} evidence when it already resolves a placeholder, but if a placeholder cannot be replaced with concrete values from files already read, you may read the specific schema, model, or handler file needed to resolve it. Assert response field values, not just status codes.
@@ -127,6 +133,7 @@ const _execPlan = new PromptPlan({ startFrom: 0 })
     .step("ENRICH", "Parameter Grounding & Priority Assignment", _execEnrichBody)
     .step("DIVERSITY", (ctx) => `Diversity check (using enriched knowledge from Step ${ctx.enrichStepLabel})`, _execDiversityBody)
     .step("EXECUTE", "Execute merged plan in rank order", _execExecuteBody)
+    .step("REGISTER", "Register your test plan", _execRegisterBody)
     .done();
 // ── Exported step label constants ─────────────────────────────────────────────
 /** "0" — Code Review: correctness analysis */
@@ -139,6 +146,8 @@ export const EXEC_STEP_ENRICH = _execPlan.labels.ENRICH; // "2"
 export const EXEC_STEP_DIVERSITY = _execPlan.labels.DIVERSITY; // "3"
 /** "4" — Execute merged plan */
 export const EXEC_STEP_EXECUTE = _execPlan.labels.EXECUTE; // "4"
+/** "5" — Register test plan (SKYR-3879 Path B checkpoint) */
+export const EXEC_STEP_REGISTER = _execPlan.labels.REGISTER; // "5"
 const SERVICE_REFS = resolveServiceDetailsRef();
 function prioritizeAttackSurfaceBundles(items) {
     const reordered = [];
@@ -154,69 +163,6 @@ function prioritizeAttackSurfaceBundles(items) {
     }
     return reordered;
 }
-/**
- * Select `count` items from a rank-ordered list, distributing GENERATE slots
- * EVENLY across the test types present, with spillover.
- *
- * Policy (kept identical to the multi-repo prose in testbot-prompts.ts's
- * "Cross-repo test generation" block — change both together):
- *  - Protected items first: CRITICAL-priority and attack-surface security_boundary
- *    scenarios always take a slot before round-robin (they must stay in GENERATE).
- *  - Bucket the rest by inferred test type (contract vs integration — the same
- *    inference used when rendering: `testType ?? (steps===1 ? contract : integration)`).
- *  - Round-robin one item per non-empty bucket per round, in the buckets' order of
- *    first appearance in the rank-ordered list (so the highest-ranked type wins
- *    round 1), preserving rank order within each bucket.
- *  - Spillover: an exhausted bucket is skipped on later rounds, so its freed slots
- *    go to the next type's next-highest item.
- *
- * Degenerate cases match the previous pure rank-order slice exactly: a single type
- * present, or `count >= items.length`, returns the same items in the same order —
- * so backend-only / single-type runs are unchanged (no regression).
- */
-function roundRobinByType(rankOrdered, count) {
-    if (count <= 0)
-        return [];
-    // Everything fits → no need to bucket; identical to the old slice.
-    if (count >= rankOrdered.length)
-        return rankOrdered.slice(0, count);
-    const inferType = (s) => s.testType ?? (s.steps.length === 1 ? "contract" : "integration");
-    // Protected items occupy GENERATE slots first, in rank order.
-    const selected = [];
-    const remaining = [];
-    for (const item of rankOrdered) {
-        if (selected.length < count &&
-            (item.priority === "CRITICAL" || isAttackSurfaceSecurityBoundary(item.scenario))) {
-            selected.push(item);
-        }
-        else {
-            remaining.push(item);
-        }
-    }
-    // Bucket the remainder by inferred type, preserving rank order and first-appearance
-    // bucket order.
-    const order = [];
-    const buckets = new Map();
-    for (const item of remaining) {
-        const t = inferType(item.scenario);
-        if (!buckets.has(t)) {
-            buckets.set(t, []);
-            order.push(t);
-        }
-        buckets.get(t).push(item);
-    }
-    // Round-robin one per non-empty bucket per round until full.
-    while (selected.length < count && order.some((t) => buckets.get(t).length > 0)) {
-        for (const t of order) {
-            if (selected.length >= count)
-                break;
-            const bucket = buckets.get(t);
-            if (bucket.length > 0)
-                selected.push(bucket.shift());
-        }
-    }
-    return selected;
-}
 export function buildExecutionPlan(scored, maxGen, topN, baseUrl, authHeaderValue, authSchemeSnippet, authTypeValue, seed, endpointCount, isUIOnlyPR, hasFrontendChanges = false, hasTraces = false, externalCoverage = new Set(), relevantExternalTestPaths = [], 
 /**
  * Whether the diff classified at least one new/modified/removed endpoint.
@@ -473,7 +419,7 @@ ${buildScopeAssessmentSection(topN, maxGen, isUIOnlyPR, isUIOnlyPR ? 100 : hasFr
 
 ${_execPlan.render(_ctx)}
 
-### GENERATE (after completing Steps ${EXEC_STEP_CODE_REVIEW}–${EXEC_STEP_EXECUTE} above) — generate exactly these items in order; add variations to ADDITIONAL instead. If Step ${EXEC_STEP_COVERAGE} converts an item to UPDATE, backfill from ADDITIONAL (priority order in Step ${EXEC_STEP_COVERAGE})
+### GENERATE (after completing Steps ${EXEC_STEP_CODE_REVIEW}–${EXEC_STEP_EXECUTE} above and registering via Step ${EXEC_STEP_REGISTER}) — the list below is a starting point; \`skyramp_register_test_plan\`'s returned GENERATE list is the final, mandatory one. Generate exactly those items in order; add variations to ADDITIONAL instead. If Step ${EXEC_STEP_COVERAGE} converts an item to UPDATE, backfill from ADDITIONAL (priority order in Step ${EXEC_STEP_COVERAGE})
 
 ${isUIOnlyPR
         ? uiGenerateBlocks ||

package/build/prompts/test-recommendation/fullRepoCatalog.d.ts

@@ -1,7 +1,7 @@
 import { DraftedScenario } from "../../types/RepositoryAnalysis.js";
-import { PriorityTier } from "../../types/TestRecommendation.js";
+import { Novelty, PriorityTier } from "../../types/TestRecommendation.js";
 export declare function buildFullRepoRecommendations(scored: Array<{
     scenario: DraftedScenario;
     priority: PriorityTier;
-    novelty: string;
+    novelty: Novelty;
 }>, topN: number, baseUrl: string, authHeaderValue: string, authSchemeSnippet: string, authTypeValue: string, isFrontendProject?: boolean, isFrontendOnlyProject?: boolean, externalCoverage?: Set<string>): string;

package/build/prompts/test-recommendation/recommendationSections.js

@@ -51,7 +51,7 @@ Before each GENERATE tool call, confirm WHERE each key value comes from:
 - **endpointURL** → workspace \`baseUrl\` + endpoint path (both required — never path alone)
 - **authHeader / authScheme** → workspace config or OpenAPI \`securitySchemes\`
 - **Foreign-key path params** → chained from a prior step's response — never invented or hardcoded. Common field names: \`id\`, \`uuid\`, \`_id\`, \`*_id\`; use whatever identifier field the server returns for this resource. The chaining source can be a response body (POST or GET), a response header (e.g. \`Location\`), or a cookie.
-- **Names / string values** → realistic; append timestamp suffix to avoid re-run conflicts
+- **Names / string values** → realistic. Do NOT hardcode a timestamp/uuid suffix. Instead, for create fields that carry a UNIQUE constraint (e.g. \`name\`, \`slug\`, \`email\` — confirm from the source schema: \`unique=True\`, SQL \`UNIQUE\`, DTO), list their field paths in the step's \`uniqueFields\` (gjson notation) — the generator injects a run-unique value so re-runs don't 409.
 
 ## Ranking Rule
 For each GENERATE item, include one sentence in your output (before the tool calls) stating the specific bug or failure it targets — derived from \`bugCatchingTarget\` or your source-code reading. Example: "Targets: order total miscalculation — total_amount = sum(item.price × item.quantity) should recompute when items array changes."
@@ -332,7 +332,10 @@ ${authGuidance}
    collection array (e.g. \`"items": [{"product_id": <chained from prior POST>, "quantity": 2}]\`).
    Never send a PATCH that only modifies metadata (discount, status) without also including the
    items/products collection — such a test will not catch collection-level or total-recalculation bugs.
-   Use unique names with timestamp suffix to avoid conflicts on re-runs.
+   For UNIQUE-constrained create fields, set the step's \`uniqueFields\` (gjson paths) rather than
+   hardcoding timestamp suffixes — the generator makes them run-unique so re-runs don't 409.
+   For every resource-creating step (POST/PUT), also add a matching DELETE step for the created
+   resource (path ID chained from the create response) so the scenario cleans up after itself.
    For GET/PUT/DELETE with path IDs, use a placeholder — chaining resolves the real ID.
 2. Produces a \`scenario_<name>.json\` in the same \`outputDir\` as the test files (not \`.skyramp/\`).
 3. Call \`skyramp_integration_test_generation\` with \`scenarioFile\`: ${integrationAuthNote}

package/build/prompts/test-recommendation/scopeAssessment.js

@@ -200,7 +200,7 @@ Budget Plan: 0 total — no new, modified, or removed endpoints were classified
 
 With a 0-total Budget Plan: generate zero tests, recommend zero tests, and follow the zero-test report path. Do NOT draft baseline or generic tests for unchanged endpoints to fill a budget — an empty diff surface is a valid, expected outcome.
 
-**Exception — claim the ceiling only with evidence:** if your code review of the changed files shows an observable API behavior change the classifier missed (e.g. a DTO/serializer/service change that alters a response shape, or a deployment/config change that newly exposes or removes endpoints), raise your Budget Plan to cover exactly those affected endpoints, up to ${maxTotal} total (${effectiveGenerate} generate + ${additional} additional), 0% UI/E2E. Every test must name the changed file that justifies it. State your raised plan now in the canonical format — \`Budget Plan: <total> total (<generate> generate + <additional> additional), 0% UI/E2E\` — and use those exact numbers throughout the rest of the prompt; the raised generate count is your committed generate count.`;
+**Exception — claim the ceiling only with evidence:** if your code review of the changed files shows an observable API behavior change the classifier missed (e.g. a DTO/serializer/service change that alters a response shape, a deployment/config change that newly exposes or removes endpoints, or a schema-defined API contract change — a CRD type/kubebuilder validation marker, GraphQL schema, or gRPC proto edit that adds, removes, or re-validates what the server accepts or returns), raise your Budget Plan to cover exactly those affected endpoints, up to ${maxTotal} total (${effectiveGenerate} generate + ${additional} additional), 0% UI/E2E. Note: repositories whose entire API surface is schema-defined (e.g. a Kubernetes operator serving CRDs through the kube-apiserver) ALWAYS classify zero endpoints — for these, a schema change in the diff IS the endpoint change; evaluate this exception against the schema files instead of concluding there is nothing to test. Every test must name the changed file that justifies it. State your raised plan now in the canonical format — \`Budget Plan: <total> total (<generate> generate + <additional> additional), 0% UI/E2E\` — and use those exact numbers throughout the rest of the prompt; the raised generate count is your committed generate count.`;
     }
     // Unambiguous backend-only or UI-only: emit a single Budget Plan line — no LLM counting needed.
     if (precomputedUIPct !== undefined) {

package/build/prompts/test-recommendation/test-recommendation-prompt.d.ts

@@ -1,6 +1,31 @@
-import { RepositoryAnalysis, AnalysisScope } from "../../types/RepositoryAnalysis.js";
+import { RepositoryAnalysis, AnalysisScope, DraftedScenario } from "../../types/RepositoryAnalysis.js";
 import { WorkspaceAuthType } from "../../utils/workspaceAuth.js";
 import { PRTestContext } from "../../utils/pr-comment-parser.js";
+import { Novelty, PriorityTier } from "../../types/TestRecommendation.js";
 import { buildExternalCoverageSet, externalDedupKey } from "./recommendationShared.js";
 export { buildExternalCoverageSet, externalDedupKey };
+/** Result of {@link computeScoredCandidates} — the scoring/classification
+ *  inputs shared between prompt rendering and the SKYR-3879 register-plan
+ *  pre-seed (analyzeChangesTool.ts), so both derive the exact same numbers. */
+export interface ScoredCandidatesResult {
+    scored: Array<{
+        scenario: DraftedScenario;
+        priority: PriorityTier;
+        novelty: Novelty;
+    }>;
+    filteredChangedFiles: string[];
+    isUIOnlyPR: boolean;
+    hasFrontendChanges: boolean;
+    hasApiChanges: boolean;
+    maxGen: number;
+    seed: string;
+}
+/**
+ * Compute the pre-ranked scenario scoring, the UI/API classification flags,
+ * and the effective GENERATE cap — extracted from buildRecommendationPrompt
+ * so skyramp_analyze_changes (SKYR-3879 Path B pre-seed) can derive the exact
+ * same candidate set the Execution Plan prompt is built from, without
+ * duplicating (and risking drift from) this scoring logic.
+ */
+export declare function computeScoredCandidates(analysis: RepositoryAnalysis, analysisScope?: AnalysisScope, topN?: number, maxGenerateOverride?: number): ScoredCandidatesResult;
 export declare function buildRecommendationPrompt(analysis: RepositoryAnalysis, analysisScope?: AnalysisScope, topN?: number, prContext?: PRTestContext, workspaceAuthHeader?: string, workspaceAuthType?: WorkspaceAuthType, workspaceAuthScheme?: string, maxGenerateOverride?: number, sessionId?: string): string;

package/build/prompts/test-recommendation/test-recommendation-prompt.js

@@ -3,7 +3,7 @@ import { AnalysisScope, isDiff, } from "../../types/RepositoryAnalysis.js";
 import { WorkspaceAuthType, getDefaultAuthHeader } from "../../utils/workspaceAuth.js";
 import { logger } from "../../utils/logger.js";
 import { buildArchitectPreamble, buildContextFetchingGuidance, buildReasoningProtocol, buildToolWorkflows, buildFewShotExamples, buildVerificationChecklist, getAuthSnippets, MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, } from "./recommendationSections.js";
-import { CATEGORY_PRIORITY } from "../../types/TestRecommendation.js";
+import { CATEGORY_PRIORITY, Novelty, PriorityTier } from "../../types/TestRecommendation.js";
 import { buildScopeAssessmentSection, isFrontendFile } from "./scopeAssessment.js";
 import { buildExecutionPlan, EXEC_STEP_CODE_REVIEW } from "./diffExecutionPlan.js";
 import { buildFullRepoRecommendations } from "./fullRepoCatalog.js";
@@ -36,21 +36,21 @@ const PRIORITY_ORDER = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
 const NOVELTY_ORDER = { new: 3, modified: 2, existing: 1 };
 function classifyNovelty(scenario, diffContext) {
     if (!diffContext)
-        return "existing";
+        return Novelty.EXISTING;
     const paths = scenario.steps.map(s => s.path);
     const newPaths = new Set((diffContext.newEndpoints || []).map(ep => ep.path));
     const modPaths = new Set((diffContext.modifiedEndpoints || []).map(ep => ep.path));
     const removedPaths = new Set((diffContext.removedEndpoints || []).map(ep => ep.path));
     if (paths.some(p => newPaths.has(p)))
-        return "new";
+        return Novelty.NEW;
     if (paths.some(p => modPaths.has(p) || removedPaths.has(p)))
-        return "modified";
-    return "existing";
+        return Novelty.MODIFIED;
+    return Novelty.EXISTING;
 }
 function prioritiseCandidate(scenario, diffContext) {
     const priority = isAttackSurfaceSecurityBoundary(scenario)
-        ? "CRITICAL"
-        : CATEGORY_PRIORITY[scenario.category] ?? "LOW";
+        ? PriorityTier.CRITICAL
+        : CATEGORY_PRIORITY[scenario.category] ?? PriorityTier.LOW;
     const novelty = classifyNovelty(scenario, diffContext);
     return { priority, novelty };
 }
@@ -58,15 +58,20 @@ function computeTiebreakerSeed(endpoints, diffFiles) {
     const canonical = [...endpoints].sort().join("|") + "::" + [...diffFiles].sort().join("|");
     return crypto.createHash("sha256").update(canonical).digest("hex").slice(0, 8);
 }
-// ── Execution Plan (replaces pre-ranked + scenarios + heuristic sections) ──
-export function buildRecommendationPrompt(analysis, analysisScope = AnalysisScope.FullRepo, topN = MAX_RECOMMENDATIONS, prContext, workspaceAuthHeader, workspaceAuthType, workspaceAuthScheme, maxGenerateOverride, sessionId) {
+// Prevents bot-committed test files from being treated as application changes
+// on subsequent testbot runs on the same PR.
+const SKYRAMP_TEST_FILE_PATTERN = /(?:_test|_smoke|_contract|_fuzz|_integration|_load|_e2e|_ui)\.[^/]+$|scenario_[^/]+\.json$/;
+/**
+ * Compute the pre-ranked scenario scoring, the UI/API classification flags,
+ * and the effective GENERATE cap — extracted from buildRecommendationPrompt
+ * so skyramp_analyze_changes (SKYR-3879 Path B pre-seed) can derive the exact
+ * same candidate set the Execution Plan prompt is built from, without
+ * duplicating (and risking drift from) this scoring logic.
+ */
+export function computeScoredCandidates(analysis, analysisScope = AnalysisScope.FullRepo, topN = MAX_RECOMMENDATIONS, maxGenerateOverride) {
     const isDiffScope = isDiff(analysisScope);
     const diffContext = analysis.branchDiffContext;
-    const openApiSpec = analysis.artifacts?.openApiSpecs?.[0];
     // ── Filter out bot-generated test files from changedFiles ──
-    // Prevents bot-committed test files from being treated as application changes
-    // on subsequent testbot runs on the same PR.
-    const SKYRAMP_TEST_FILE_PATTERN = /(?:_test|_smoke|_contract|_fuzz|_integration|_load|_e2e|_ui)\.[^/]+$|scenario_[^/]+\.json$/;
     const filteredChangedFiles = diffContext
         ? diffContext.changedFiles.filter(f => !SKYRAMP_TEST_FILE_PATTERN.test(f))
         : [];
@@ -81,6 +86,56 @@ export function buildRecommendationPrompt(analysis, analysisScope = AnalysisScop
         ? (diffContext.newEndpoints.length > 0 || diffContext.modifiedEndpoints.length > 0 || (diffContext.removedEndpoints?.length ?? 0) > 0)
         : false;
     const isUIOnlyPR = hasFrontendChanges && !hasApiChanges;
+    // ── Scoring ──
+    const baseMaxGen = Math.min(Math.max(maxGenerateOverride ?? (isDiffScope ? MAX_TESTS_TO_GENERATE : topN), 0), topN);
+    const maxGen = isUIOnlyPR ? Math.max(baseMaxGen, 1) : baseMaxGen;
+    const scenarios = analysis.businessContext.draftedScenarios;
+    let scored = [];
+    let seed = "";
+    if (!isUIOnlyPR && scenarios.length > 0) {
+        const diffFiles = filteredChangedFiles; // use filtered list so bot-committed test files don't shift the seed
+        const endpointPaths = analysis.apiEndpoints.endpoints.map(ep => ep.path);
+        seed = computeTiebreakerSeed(endpointPaths, diffFiles);
+        scored = scenarios.map(s => {
+            const result = prioritiseCandidate(s, diffContext ?? undefined);
+            return { scenario: s, ...result };
+        });
+        scored.sort((a, b) => {
+            const pa = PRIORITY_ORDER[a.priority], pb = PRIORITY_ORDER[b.priority];
+            if (pb !== pa)
+                return pb - pa;
+            const na = NOVELTY_ORDER[a.novelty], nb = NOVELTY_ORDER[b.novelty];
+            if (nb !== na)
+                return nb - na;
+            const crossA = a.scenario.steps.length > 2 ? 1 : 0;
+            const crossB = b.scenario.steps.length > 2 ? 1 : 0;
+            if (crossB !== crossA)
+                return crossB - crossA;
+            if (b.scenario.steps.length !== a.scenario.steps.length)
+                return b.scenario.steps.length - a.scenario.steps.length;
+            const errorA = a.scenario.steps.some(s => s.interactionType === "error" || s.interactionType === "edge-case") ? 1 : 0;
+            const errorB = b.scenario.steps.some(s => s.interactionType === "error" || s.interactionType === "edge-case") ? 1 : 0;
+            if (errorB !== errorA)
+                return errorB - errorA;
+            // Use locale-independent comparison to avoid runtime-locale non-determinism
+            const nameA = a.scenario.scenarioName;
+            const nameB = b.scenario.scenarioName;
+            if (nameA < nameB)
+                return -1;
+            if (nameA > nameB)
+                return 1;
+            const hashA = parseInt(crypto.createHash("sha256").update(seed + a.scenario.scenarioName).digest("hex").slice(0, 8), 16);
+            const hashB = parseInt(crypto.createHash("sha256").update(seed + b.scenario.scenarioName).digest("hex").slice(0, 8), 16);
+            return hashA - hashB;
+        });
+    }
+    return { scored, filteredChangedFiles, isUIOnlyPR, hasFrontendChanges, hasApiChanges, maxGen, seed };
+}
+export function buildRecommendationPrompt(analysis, analysisScope = AnalysisScope.FullRepo, topN = MAX_RECOMMENDATIONS, prContext, workspaceAuthHeader, workspaceAuthType, workspaceAuthScheme, maxGenerateOverride, sessionId) {
+    const isDiffScope = isDiff(analysisScope);
+    const diffContext = analysis.branchDiffContext;
+    const openApiSpec = analysis.artifacts?.openApiSpecs?.[0];
+    const { scored, filteredChangedFiles, isUIOnlyPR, hasFrontendChanges, hasApiChanges, maxGen, seed, } = computeScoredCandidates(analysis, analysisScope, topN, maxGenerateOverride);
     const hasTraces = (analysis.artifacts?.traceFiles?.length ?? 0) > 0 ||
         (analysis.artifacts?.playwrightRecordings?.length ?? 0) > 0;
     // ── Mode preamble ──
@@ -277,50 +332,7 @@ ${isDiffScope ? "Changed endpoints only. " : ""}Use source code schemas (Zod/Pyd
 ${detailBlocks}
 `;
     }
-    // ── Scoring ──
     const endpointCount = allEndpoints.reduce((acc, ep) => acc + (ep.methods ?? []).length, 0);
-    const baseMaxGen = Math.min(Math.max(maxGenerateOverride ?? (isDiffScope ? MAX_TESTS_TO_GENERATE : topN), 0), topN);
-    const maxGen = isUIOnlyPR ? Math.max(baseMaxGen, 1) : baseMaxGen;
-    const scenarios = analysis.businessContext.draftedScenarios;
-    let scored = [];
-    let seed = "";
-    if (!isUIOnlyPR && scenarios.length > 0) {
-        const diffFiles = filteredChangedFiles; // use filtered list so bot-committed test files don't shift the seed
-        const endpointPaths = allEndpoints.map(ep => ep.path);
-        seed = computeTiebreakerSeed(endpointPaths, diffFiles);
-        scored = scenarios.map(s => {
-            const result = prioritiseCandidate(s, diffContext ?? undefined);
-            return { scenario: s, ...result };
-        });
-        scored.sort((a, b) => {
-            const pa = PRIORITY_ORDER[a.priority], pb = PRIORITY_ORDER[b.priority];
-            if (pb !== pa)
-                return pb - pa;
-            const na = NOVELTY_ORDER[a.novelty], nb = NOVELTY_ORDER[b.novelty];
-            if (nb !== na)
-                return nb - na;
-            const crossA = a.scenario.steps.length > 2 ? 1 : 0;
-            const crossB = b.scenario.steps.length > 2 ? 1 : 0;
-            if (crossB !== crossA)
-                return crossB - crossA;
-            if (b.scenario.steps.length !== a.scenario.steps.length)
-                return b.scenario.steps.length - a.scenario.steps.length;
-            const errorA = a.scenario.steps.some(s => s.interactionType === "error" || s.interactionType === "edge-case") ? 1 : 0;
-            const errorB = b.scenario.steps.some(s => s.interactionType === "error" || s.interactionType === "edge-case") ? 1 : 0;
-            if (errorB !== errorA)
-                return errorB - errorA;
-            // Use locale-independent comparison to avoid runtime-locale non-determinism
-            const nameA = a.scenario.scenarioName;
-            const nameB = b.scenario.scenarioName;
-            if (nameA < nameB)
-                return -1;
-            if (nameA > nameB)
-                return 1;
-            const hashA = parseInt(crypto.createHash("sha256").update(seed + a.scenario.scenarioName).digest("hex").slice(0, 8), 16);
-            const hashB = parseInt(crypto.createHash("sha256").update(seed + b.scenario.scenarioName).digest("hex").slice(0, 8), 16);
-            return hashA - hashB;
-        });
-    }
     // ── Main section: execution plan, UI-only guidance, or draft-your-own ──
     let mainSection;
     if (!isDiffScope && scored.length > 0) {

package/build/prompts/test-recommendation/test-recommendation-prompt.test.js

@@ -1,10 +1,11 @@
 import { jest } from "@jest/globals";
+import { Novelty, PriorityTier } from "../../types/TestRecommendation.js";
 import { TestType } from "../../types/TestTypes.js";
 jest.unstable_mockModule("@skyramp/skyramp", () => ({
     WorkspaceConfigManager: { create: jest.fn() },
 }));
 const { buildRecommendationPrompt, buildExternalCoverageSet, externalDedupKey } = await import("./test-recommendation-prompt.js");
-const { buildExecutionPlan } = await import("./diffExecutionPlan.js");
+const { buildExecutionPlan, EXEC_STEP_REGISTER } = await import("./diffExecutionPlan.js");
 const { PATH_PARAM_UUID_GUIDANCE, MAX_TESTS_TO_GENERATE, buildTestQualityCriteria, buildArchitectPreamble, buildContextFetchingGuidance, buildReasoningProtocol, buildFewShotExamples, buildVerificationChecklist, } = await import("./recommendationSections.js");
 import { AnalysisScope } from "../../types/RepositoryAnalysis.js";
 // ---------------------------------------------------------------------------
@@ -746,6 +747,42 @@ describe("buildRecommendationPrompt — zero-classified diff (SKYR-3820)", () =>
     });
 });
 // ---------------------------------------------------------------------------
+// Tests — REGISTER step (SKYR-3879 Path B checkpoint)
+// ---------------------------------------------------------------------------
+describe("buildRecommendationPrompt — REGISTER step (SKYR-3879 Path B)", () => {
+    it("diff-scope execution plan includes the REGISTER step and its skyramp_register_test_plan instruction", () => {
+        const prompt = buildRecommendationPrompt(minimalAnalysis(), AnalysisScope.CurrentBranchDiff, 5);
+        expect(prompt).toContain(`Step ${EXEC_STEP_REGISTER} — Register your test plan`);
+        expect(prompt).toContain("skyramp_register_test_plan");
+    });
+    it("diff-scope execution plan's GENERATE header references the REGISTER step", () => {
+        const prompt = buildRecommendationPrompt(minimalAnalysis(), AnalysisScope.CurrentBranchDiff, 5);
+        expect(prompt).toContain(`registering via Step ${EXEC_STEP_REGISTER}`);
+    });
+    it("full-repo mode (no execution plan) never mentions skyramp_register_test_plan", () => {
+        const scenariosForFullRepo = [
+            minimalScenario({
+                scenarioName: "scenario-0",
+                category: "crud",
+                priority: "low",
+                testType: TestType.CONTRACT,
+                steps: [{ order: 1, method: "GET", path: "/api/items", description: "Get items", interactionType: "success", expectedStatusCode: 200 }],
+            }),
+        ];
+        const analysis = minimalAnalysis({
+            businessContext: { mainPurpose: "Test API", userFlows: [], dataFlows: [], integrationPatterns: [], draftedScenarios: scenariosForFullRepo },
+        });
+        const prompt = buildRecommendationPrompt(analysis, AnalysisScope.FullRepo, 6);
+        expect(prompt).not.toContain("skyramp_register_test_plan");
+    });
+    it("diff-scope 'draft your own' fallback (no pre-drafted scenarios) still includes the REGISTER step — the execution plan is always used in diff scope", () => {
+        const prompt = buildRecommendationPrompt(minimalAnalysis(), AnalysisScope.CurrentBranchDiff, 5);
+        // minimalAnalysis() has no draftedScenarios and no branchDiffContext, so scored=[]
+        // but buildExecutionPlan still renders (see buildRecommendationPrompt's isDiffScope branch).
+        expect(prompt).toContain("skyramp_register_test_plan");
+    });
+});
+// ---------------------------------------------------------------------------
 // Tests — GENERATE slot allocation (UI vs backend slots)
 // ---------------------------------------------------------------------------
 describe("buildRecommendationPrompt — GENERATE slot allocation", () => {
@@ -920,13 +957,13 @@ describe("buildRecommendationPrompt — GENERATE slot allocation", () => {
         });
         const prompt = buildExecutionPlan([attackSurface, bugCaught, ordinary].map((scenario) => ({
             scenario,
-            priority: scenario.category === "crud" ? "LOW" : "CRITICAL",
-            novelty: "modified",
+            priority: scenario.category === "crud" ? PriorityTier.LOW : PriorityTier.CRITICAL,
+            novelty: Novelty.MODIFIED,
         })), 3, 3, "http://localhost:3000", "Authorization", ", authScheme: \"Bearer\"", "", "seed", 3, false, false, false, new Set(["POST::flows::contract", "POST::orders::contract", "POST::customers::contract"]));
         expect(prompt).toContain("POST /api/flows/bulk_delete → 401");
         expect(prompt).toContain("POST /api/orders → 201");
         expect(prompt).not.toContain("POST /api/customers → 201");
-        expect(prompt).toContain("except for `bug_caught` and attack-surface `security_boundary` items");
+        expect(prompt).toContain("`bug_caught` and attack-surface `security_boundary` items get the strictest reading");
     });
     it("keeps symmetric attack-surface siblings together before ordinary auth boundaries", () => {
         const directWidgets = minimalScenario({
@@ -959,8 +996,8 @@ describe("buildRecommendationPrompt — GENERATE slot allocation", () => {
         });
         const prompt = buildExecutionPlan([directWidgets, directGadgets, widgetsBulk, gadgetsBulk].map((scenario) => ({
             scenario,
-            priority: "CRITICAL",
-            novelty: "modified",
+            priority: PriorityTier.CRITICAL,
+            novelty: Novelty.MODIFIED,
         })), 3, 4, "http://localhost:3000", "Authorization", ", authScheme: \"Bearer\"", "", "seed", 4, false);
         const generatedBlock = prompt.slice(0, prompt.indexOf("#4 [ADDITIONAL]"));
         const additionalBlock = prompt.slice(prompt.indexOf("#4 [ADDITIONAL]"));
@@ -975,7 +1012,7 @@ describe("buildExecutionPlan — even-with-spillover test-type distribution", ()
     // Backend-only PR (hasFrontendChanges=false) so every GENERATE slot is a backend
     // scenario drawn from `scored` — this is where contract-vs-integration distribution
     // applies. baseUrl/auth args mirror the existing buildExecutionPlan tests above.
-    const contract = (name, path, priority = "HIGH") => ({
+    const contract = (name, path, priority = PriorityTier.HIGH) => ({
         scenario: minimalScenario({
             scenarioName: name,
             category: "crud",
@@ -983,9 +1020,9 @@ describe("buildExecutionPlan — even-with-spillover test-type distribution", ()
             steps: [{ order: 1, method: "POST", path, description: `POST ${path}`, interactionType: "success", expectedStatusCode: 201 }],
         }),
         priority: priority,
-        novelty: "new",
+        novelty: Novelty.NEW,
     });
-    const integration = (name, p1, p2, priority = "HIGH") => ({
+    const integration = (name, p1, p2, priority = PriorityTier.HIGH) => ({
         scenario: minimalScenario({
             scenarioName: name,
             category: "data_integrity",
@@ -996,7 +1033,7 @@ describe("buildExecutionPlan — even-with-spillover test-type distribution", ()
             ],
         }),
         priority: priority,
-        novelty: "new",
+        novelty: Novelty.NEW,
     });
     const plan = (items, maxGen, topN) => buildExecutionPlan(items, maxGen, topN, "http://localhost:3000", "Authorization", ", authScheme: \"Bearer\"", "", "seed", items.length, false);
     it("distributes GENERATE slots across contract AND integration when budget < candidates", () => {
@@ -1025,7 +1062,7 @@ describe("buildExecutionPlan — even-with-spillover test-type distribution", ()
         // A CRITICAL integration sits after several HIGH contracts in rank order.
         const items = [
             contract("c1", "/api/a"), contract("c2", "/api/b"), contract("c3", "/api/c"),
-            integration("crit", "/api/orders", "/api/orders/{id}", "CRITICAL"),
+            integration("crit", "/api/orders", "/api/orders/{id}", PriorityTier.CRITICAL),
         ];
         const prompt = plan(items, 3, 6);
         const generated = prompt.slice(0, prompt.indexOf("[ADDITIONAL]") >= 0 ? prompt.indexOf("[ADDITIONAL]") : prompt.length);

package/build/prompts/testbot/testbot-prompts.d.ts

@@ -16,7 +16,7 @@ export interface RelatedRepository {
  */
 export declare function parseRelatedRepositories(raw: string | undefined): RelatedRepository[] | undefined;
 export declare function getTestbotPrompt(prTitle: string, prDescription: string, summaryOutputFile: string, repositoryPath: string, baseBranch?: string, maxRecommendations?: number, maxGenerate?: number, _maxCritical?: number, // Reserved — accepted for API compat but not yet wired into prompt
-prNumber?: number, userPrompt?: string, services?: Service[], uiCredentials?: string, testsRepoDir?: string, relatedRepositories?: RelatedRepository[], primaryRepo?: string): string;
+prNumber?: number, userPrompt?: string, services?: Service[], uiCredentials?: string, testsRepoDir?: string, relatedRepositories?: RelatedRepository[], primaryRepo?: string, planOnly?: boolean): string;
 /**
  * Read services from .skyramp/workspace.yml. Returns empty array if
  * the workspace file doesn't exist or can't be parsed.