@skyramp/mcp 0.3.1 → 0.3.2-rc.pom-2

package/build/recommendation/diversity.d.ts

@@ -0,0 +1,47 @@
+import { DraftedScenario } from "../types/RepositoryAnalysis.js";
+import { PriorityTier } from "../types/TestRecommendation.js";
+/**
+ * Reorder a rank-ordered list so each attack-surface security_boundary scenario
+ * sits immediately before the first ordinary direct-auth boundary — keeping
+ * destructive sibling auth tests bundled ahead of their read counterparts.
+ */
+export declare function prioritizeAttackSurfaceBundles<T extends {
+    scenario: DraftedScenario;
+}>(items: T[]): T[];
+/** The test-type inference used everywhere GENERATE slots are distributed:
+ *  explicit testType, else single-step ⇒ contract, multi-step ⇒ integration
+ *  (the same inference used when rendering plan items). */
+export declare function inferScenarioType(s: DraftedScenario): string;
+/** Protected items always take a GENERATE slot before any round-robin:
+ *  CRITICAL-priority and attack-surface security_boundary scenarios. */
+export declare function isProtectedCandidate(priority: PriorityTier, scenario: DraftedScenario): boolean;
+/** Bucket items by type, preserving rank order within each bucket and
+ *  first-appearance order across buckets (so the highest-ranked type wins
+ *  round 1 of any subsequent round-robin). */
+export declare function bucketByType<T>(items: T[], typeOf: (item: T) => string): {
+    order: string[];
+    buckets: Map<string, T[]>;
+};
+/** Round-robin one item per non-empty bucket per round (skipping exhausted
+ *  buckets, so their freed slots spill over to the next type) until
+ *  `selected` reaches `count` or every bucket is empty. Mutates `selected`
+ *  and the buckets. */
+export declare function roundRobinFill<T>(selected: T[], order: string[], buckets: Map<string, T[]>, count: number): void;
+/**
+ * Select `count` items from a rank-ordered list, distributing GENERATE slots
+ * EVENLY across the test types present, with spillover.
+ *
+ * Policy (kept identical to the multi-repo prose in testbot-prompts.ts's
+ * "Cross-repo test generation" block — change both together):
+ *  - Protected items first (see isProtectedCandidate) — they must stay in GENERATE.
+ *  - Bucket the rest by inferred test type and round-robin (see bucketByType /
+ *    roundRobinFill), preserving rank order within each bucket.
+ *
+ * Degenerate cases match the previous pure rank-order slice exactly: a single type
+ * present, or `count >= items.length`, returns the same items in the same order —
+ * so backend-only / single-type runs are unchanged (no regression).
+ */
+export declare function roundRobinByType<T extends {
+    scenario: DraftedScenario;
+    priority: PriorityTier;
+}>(rankOrdered: T[], count: number): T[];

package/build/recommendation/diversity.js

@@ -0,0 +1,101 @@
+import { PriorityTier } from "../types/TestRecommendation.js";
+import { isAttackSurfaceSecurityBoundary, isOrdinaryDirectAuthBoundary, } from "../prompts/test-recommendation/recommendationShared.js";
+/**
+ * Reorder a rank-ordered list so each attack-surface security_boundary scenario
+ * sits immediately before the first ordinary direct-auth boundary — keeping
+ * destructive sibling auth tests bundled ahead of their read counterparts.
+ */
+export function prioritizeAttackSurfaceBundles(items) {
+    const reordered = [];
+    for (const item of items) {
+        if (isAttackSurfaceSecurityBoundary(item.scenario)) {
+            const firstDirectAuthIndex = reordered.findIndex((candidate) => isOrdinaryDirectAuthBoundary(candidate.scenario));
+            if (firstDirectAuthIndex >= 0) {
+                reordered.splice(firstDirectAuthIndex, 0, item);
+                continue;
+            }
+        }
+        reordered.push(item);
+    }
+    return reordered;
+}
+/** The test-type inference used everywhere GENERATE slots are distributed:
+ *  explicit testType, else single-step ⇒ contract, multi-step ⇒ integration
+ *  (the same inference used when rendering plan items). */
+export function inferScenarioType(s) {
+    return s.testType ?? (s.steps.length === 1 ? "contract" : "integration");
+}
+/** Protected items always take a GENERATE slot before any round-robin:
+ *  CRITICAL-priority and attack-surface security_boundary scenarios. */
+export function isProtectedCandidate(priority, scenario) {
+    return (priority === PriorityTier.CRITICAL ||
+        isAttackSurfaceSecurityBoundary(scenario));
+}
+/** Bucket items by type, preserving rank order within each bucket and
+ *  first-appearance order across buckets (so the highest-ranked type wins
+ *  round 1 of any subsequent round-robin). */
+export function bucketByType(items, typeOf) {
+    const order = [];
+    const buckets = new Map();
+    for (const item of items) {
+        const t = typeOf(item);
+        if (!buckets.has(t)) {
+            buckets.set(t, []);
+            order.push(t);
+        }
+        buckets.get(t).push(item);
+    }
+    return { order, buckets };
+}
+/** Round-robin one item per non-empty bucket per round (skipping exhausted
+ *  buckets, so their freed slots spill over to the next type) until
+ *  `selected` reaches `count` or every bucket is empty. Mutates `selected`
+ *  and the buckets. */
+export function roundRobinFill(selected, order, buckets, count) {
+    while (selected.length < count &&
+        order.some((t) => (buckets.get(t)?.length ?? 0) > 0)) {
+        for (const t of order) {
+            if (selected.length >= count)
+                break;
+            const bucket = buckets.get(t);
+            if (bucket && bucket.length > 0)
+                selected.push(bucket.shift());
+        }
+    }
+}
+/**
+ * Select `count` items from a rank-ordered list, distributing GENERATE slots
+ * EVENLY across the test types present, with spillover.
+ *
+ * Policy (kept identical to the multi-repo prose in testbot-prompts.ts's
+ * "Cross-repo test generation" block — change both together):
+ *  - Protected items first (see isProtectedCandidate) — they must stay in GENERATE.
+ *  - Bucket the rest by inferred test type and round-robin (see bucketByType /
+ *    roundRobinFill), preserving rank order within each bucket.
+ *
+ * Degenerate cases match the previous pure rank-order slice exactly: a single type
+ * present, or `count >= items.length`, returns the same items in the same order —
+ * so backend-only / single-type runs are unchanged (no regression).
+ */
+export function roundRobinByType(rankOrdered, count) {
+    if (count <= 0)
+        return [];
+    // Everything fits → no need to bucket; identical to the old slice.
+    if (count >= rankOrdered.length)
+        return rankOrdered.slice(0, count);
+    // Protected items occupy GENERATE slots first, in rank order.
+    const selected = [];
+    const remaining = [];
+    for (const item of rankOrdered) {
+        if (selected.length < count &&
+            isProtectedCandidate(item.priority, item.scenario)) {
+            selected.push(item);
+        }
+        else {
+            remaining.push(item);
+        }
+    }
+    const { order, buckets } = bucketByType(remaining, (item) => inferScenarioType(item.scenario));
+    roundRobinFill(selected, order, buckets, count);
+    return selected;
+}

package/build/recommendation/diversity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/recommendation/diversity.test.js

@@ -0,0 +1,77 @@
+import { roundRobinByType, prioritizeAttackSurfaceBundles } from "./diversity.js";
+import { PriorityTier } from "../types/TestRecommendation.js";
+// Minimal DraftedScenario factory — only the fields the diversity helpers read
+// (category, description, steps.length, testType) matter here.
+function scen(name, opts = {}) {
+    return {
+        scenarioName: name,
+        description: opts.description ?? name,
+        category: opts.category ?? "workflow",
+        priority: "high",
+        steps: Array.from({ length: opts.steps ?? 2 }, () => ({})),
+        chainingKeys: [],
+        requiresAuth: false,
+        estimatedComplexity: "moderate",
+        testType: opts.testType,
+    };
+}
+function cand(name, priority, opts = {}) {
+    return { scenario: scen(name, opts), priority };
+}
+const names = (items) => items.map((i) => i.scenario.scenarioName);
+describe("roundRobinByType", () => {
+    it("returns [] when count <= 0", () => {
+        const items = [cand("a", PriorityTier.HIGH), cand("b", PriorityTier.HIGH)];
+        expect(roundRobinByType(items, 0)).toEqual([]);
+        expect(roundRobinByType(items, -1)).toEqual([]);
+    });
+    it("returns the full list in rank order when count >= length (degenerate == slice)", () => {
+        const items = [cand("a", PriorityTier.HIGH), cand("b", PriorityTier.HIGH), cand("c", PriorityTier.HIGH)];
+        expect(names(roundRobinByType(items, 3))).toEqual(["a", "b", "c"]);
+        expect(names(roundRobinByType(items, 5))).toEqual(["a", "b", "c"]);
+    });
+    it("with a single test type present, returns the first `count` by rank", () => {
+        const items = [
+            cand("i1", PriorityTier.HIGH, { testType: "integration" }),
+            cand("i2", PriorityTier.HIGH, { testType: "integration" }),
+            cand("i3", PriorityTier.HIGH, { testType: "integration" }),
+        ];
+        expect(names(roundRobinByType(items, 2))).toEqual(["i1", "i2"]);
+    });
+    it("distributes one slot per present test type before a second of any type", () => {
+        const items = [
+            cand("i1", PriorityTier.HIGH, { testType: "integration" }),
+            cand("i2", PriorityTier.HIGH, { testType: "integration" }),
+            cand("c1", PriorityTier.HIGH, { testType: "contract" }),
+            cand("i3", PriorityTier.HIGH, { testType: "integration" }),
+        ];
+        // First-appearance bucket order is [integration, contract]; round 1 picks one of each.
+        expect(names(roundRobinByType(items, 2))).toEqual(["i1", "c1"]);
+    });
+    it("selects protected (CRITICAL) items first, regardless of type or rank position", () => {
+        const items = [
+            cand("i1", PriorityTier.HIGH, { testType: "integration" }),
+            cand("i2", PriorityTier.HIGH, { testType: "integration" }),
+            cand("c1", PriorityTier.CRITICAL, { testType: "contract" }),
+        ];
+        const result = names(roundRobinByType(items, 2));
+        expect(result[0]).toBe("c1");
+        expect(result).toContain("i1");
+    });
+});
+describe("prioritizeAttackSurfaceBundles", () => {
+    it("moves an attack-surface security_boundary item ahead of the first ordinary direct-auth boundary", () => {
+        const items = [
+            cand("ordinary", PriorityTier.HIGH, { category: "security_boundary", description: "Auth boundary: GET /x" }),
+            cand("attack", PriorityTier.HIGH, {
+                category: "security_boundary",
+                description: "Attack-surface auth boundary: DELETE /x",
+            }),
+        ];
+        expect(names(prioritizeAttackSurfaceBundles(items))).toEqual(["attack", "ordinary"]);
+    });
+    it("leaves ordering unchanged when there is no attack-surface item", () => {
+        const items = [cand("a", PriorityTier.HIGH), cand("b", PriorityTier.HIGH)];
+        expect(names(prioritizeAttackSurfaceBundles(items))).toEqual(["a", "b"]);
+    });
+});

package/build/recommendation/planRanker.d.ts

@@ -0,0 +1,50 @@
+import { Candidate, BudgetContext, Demotion, SelectionResult } from "../types/Recommendation.js";
+import { ScenarioCategory } from "../types/TestRecommendation.js";
+/** Options for {@link rankCandidates}. Reserved for phase-2 tuning. */
+export interface RankOptions {
+    /**
+     * Categories that take the top carve-out tier ahead of everything else.
+     * Defaults to the `CATEGORY_PRIORITY === "CRITICAL"` categories (new_endpoint,
+     * bug_caught). Exposed so phase 2 can tune the carve-out WITHOUT reintroducing
+     * the agent's priority tag as a ranking input.
+     */
+    carveOutCategories?: ScenarioCategory[];
+}
+/** Context for {@link selectPlan}: the budget context plus the demotion channel
+ *  the register-plan tool fills from discriminator verification. */
+export interface SelectPlanContext extends BudgetContext {
+    /** Demoted claims (failed discriminator verification) to surface on the result. */
+    demotions?: Demotion[];
+}
+/**
+ * Rank test candidates for the register-plan checkpoint. Pure and fully
+ * deterministic: the same set of candidates always yields the same order,
+ * independent of input order (the final tiebreak is the stable `candidateId`).
+ *
+ * Ordering (highest first):
+ *   1. Carve-out — bug_caught / CRITICAL-category scenarios (new_endpoint,
+ *      bug_caught), preserving the protected-first convention of
+ *      `roundRobinByType` / `prioritizeAttackSurfaceBundles`.
+ *   2. Verified discriminators — candidates whose declared discriminator survived
+ *      `validateDiscriminator` (marked via `verifiedDiscriminator`) float ahead of
+ *      unverified peers in the same tier.
+ *   3. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
+ *      MEDIUM > LOW).
+ *   4. Stable tiebreak on `candidateId` for determinism.
+ *
+ * IMPORTANT: the agent-supplied `priority` field (`scenario.priority`) is
+ * DELIBERATELY IGNORED here. Round-1 experiments found it systematically
+ * miscalibrated — the agent labels genuinely discriminating tests "low" and
+ * generic happy-path tests "high" — so ranking on it inverts the intended order.
+ * Priority in this pipeline is derived from the scenario's category and from the
+ * verified discriminator, never from the agent's self-assessment.
+ */
+export declare function rankCandidates(candidates: Candidate[], opts?: RankOptions): Candidate[];
+/**
+ * Convenience composition: rank the candidates, split GENERATE vs ADDITIONAL via
+ * the diversity-balanced budgeter, and surface the caller-supplied demotions on
+ * the result. The caller (the register-plan tool) runs `validateDiscriminator`
+ * first — setting `verifiedDiscriminator` on the candidates that passed and
+ * passing the failed claims through `ctx.demotions`.
+ */
+export declare function selectPlan(candidates: Candidate[], ctx: SelectPlanContext, opts?: RankOptions): SelectionResult;

package/build/recommendation/planRanker.js

@@ -0,0 +1,67 @@
+import { CATEGORY_PRIORITY, PriorityTier } from "../types/TestRecommendation.js";
+import { diversityBalancedBudgeter } from "./budgeters/diversityBalancedBudgeter.js";
+const PRIORITY_RANK = {
+    CRITICAL: 0,
+    HIGH: 1,
+    MEDIUM: 2,
+    LOW: 3,
+};
+const DEFAULT_CARVE_OUT_CATEGORIES = Object.keys(CATEGORY_PRIORITY).filter((category) => CATEGORY_PRIORITY[category] === PriorityTier.CRITICAL);
+/**
+ * Rank test candidates for the register-plan checkpoint. Pure and fully
+ * deterministic: the same set of candidates always yields the same order,
+ * independent of input order (the final tiebreak is the stable `candidateId`).
+ *
+ * Ordering (highest first):
+ *   1. Carve-out — bug_caught / CRITICAL-category scenarios (new_endpoint,
+ *      bug_caught), preserving the protected-first convention of
+ *      `roundRobinByType` / `prioritizeAttackSurfaceBundles`.
+ *   2. Verified discriminators — candidates whose declared discriminator survived
+ *      `validateDiscriminator` (marked via `verifiedDiscriminator`) float ahead of
+ *      unverified peers in the same tier.
+ *   3. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
+ *      MEDIUM > LOW).
+ *   4. Stable tiebreak on `candidateId` for determinism.
+ *
+ * IMPORTANT: the agent-supplied `priority` field (`scenario.priority`) is
+ * DELIBERATELY IGNORED here. Round-1 experiments found it systematically
+ * miscalibrated — the agent labels genuinely discriminating tests "low" and
+ * generic happy-path tests "high" — so ranking on it inverts the intended order.
+ * Priority in this pipeline is derived from the scenario's category and from the
+ * verified discriminator, never from the agent's self-assessment.
+ */
+export function rankCandidates(candidates, opts = {}) {
+    const carveOutSet = new Set(opts.carveOutCategories ?? DEFAULT_CARVE_OUT_CATEGORIES);
+    return [...candidates].sort((a, b) => compareRank(a, b, carveOutSet));
+}
+/**
+ * Convenience composition: rank the candidates, split GENERATE vs ADDITIONAL via
+ * the diversity-balanced budgeter, and surface the caller-supplied demotions on
+ * the result. The caller (the register-plan tool) runs `validateDiscriminator`
+ * first — setting `verifiedDiscriminator` on the candidates that passed and
+ * passing the failed claims through `ctx.demotions`.
+ */
+export function selectPlan(candidates, ctx, opts = {}) {
+    const ranked = rankCandidates(candidates, opts);
+    const result = diversityBalancedBudgeter.select(ranked, ctx);
+    return { ...result, demotions: ctx.demotions ?? [] };
+}
+function compareRank(a, b, carveOutSet) {
+    const carveA = carveOutSet.has(a.scenario?.category) ? 0 : 1;
+    const carveB = carveOutSet.has(b.scenario?.category) ? 0 : 1;
+    if (carveA !== carveB)
+        return carveA - carveB;
+    const verifiedA = a.verifiedDiscriminator ? 0 : 1;
+    const verifiedB = b.verifiedDiscriminator ? 0 : 1;
+    if (verifiedA !== verifiedB)
+        return verifiedA - verifiedB;
+    const catRankA = categoryRank(a);
+    const catRankB = categoryRank(b);
+    if (catRankA !== catRankB)
+        return catRankA - catRankB;
+    return (a.candidateId ?? "").localeCompare(b.candidateId ?? "");
+}
+function categoryRank(candidate) {
+    const tier = CATEGORY_PRIORITY[candidate.scenario?.category] ?? PriorityTier.LOW;
+    return PRIORITY_RANK[tier];
+}

package/build/recommendation/planRanker.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/recommendation/planRanker.test.js

@@ -0,0 +1,110 @@
+import { rankCandidates, selectPlan } from "./planRanker.js";
+import { Novelty, PriorityTier } from "../types/TestRecommendation.js";
+import { CandidateSource, DiscriminatorKind, computeCandidateId } from "../types/Recommendation.js";
+function cand(name, opts = {}) {
+    const steps = [
+        { order: 0, method: "GET", path: `/${name}`, description: "", interactionType: "success", expectedStatusCode: 200 },
+        { order: 1, method: "POST", path: `/${name}`, description: "", interactionType: "success", expectedStatusCode: 201 },
+    ];
+    const scenario = {
+        scenarioName: name,
+        description: name,
+        category: opts.category ?? "workflow",
+        priority: opts.agentPriority ?? "high",
+        steps,
+        chainingKeys: [],
+        requiresAuth: false,
+        estimatedComplexity: "moderate",
+        testType: opts.testType ?? "integration",
+    };
+    return {
+        scenario,
+        priority: PriorityTier.HIGH,
+        novelty: Novelty.EXISTING,
+        source: CandidateSource.AGENT,
+        candidateId: computeCandidateId(scenario),
+        verifiedDiscriminator: opts.verified,
+    };
+}
+const names = (cs) => cs.map((c) => c.scenario.scenarioName);
+const ids = (cs) => cs.map((c) => c.candidateId);
+describe("rankCandidates", () => {
+    it("floats a verified discriminator (agent priority 'low') above an unverified security_boundary (agent priority 'high') — the round-1 miscalibration regression", () => {
+        const verifiedLow = cand("verified-boundary", {
+            category: "business_rule",
+            agentPriority: "low",
+            verified: DiscriminatorKind.BOUNDARY_EQUALITY,
+        });
+        const unverifiedHigh = cand("generic-authz", {
+            category: "security_boundary",
+            agentPriority: "high",
+        });
+        const ranked = rankCandidates([unverifiedHigh, verifiedLow]);
+        expect(names(ranked)).toEqual(["verified-boundary", "generic-authz"]);
+    });
+    it("keeps bug_caught / CRITICAL carve-out first, even ahead of a verified discriminator", () => {
+        const bug = cand("bug-catcher", { category: "bug_caught" });
+        const verified = cand("verified-agg", { category: "business_rule", verified: DiscriminatorKind.MULTI_RECORD_AGGREGATE });
+        const ranked = rankCandidates([verified, bug]);
+        expect(names(ranked)[0]).toBe("bug-catcher");
+    });
+    it("orders by category priority when carve-out and verification are equal", () => {
+        const high = cand("high-cat", { category: "security_boundary" }); // HIGH
+        const low = cand("low-cat", { category: "crud" }); // LOW
+        const medium = cand("medium-cat", { category: "workflow" }); // MEDIUM
+        expect(names(rankCandidates([low, medium, high]))).toEqual(["high-cat", "medium-cat", "low-cat"]);
+    });
+    it("is deterministic: identical input and any shuffle yield the same order", () => {
+        const a = cand("alpha", { category: "business_rule", verified: DiscriminatorKind.BOUNDARY_EQUALITY });
+        const b = cand("bravo", { category: "security_boundary" });
+        const c = cand("charlie", { category: "bug_caught" });
+        const d = cand("delta", { category: "crud", agentPriority: "high" });
+        const e = cand("echo", { category: "workflow", verified: DiscriminatorKind.STATE_TRANSITION });
+        const order1 = ids(rankCandidates([a, b, c, d, e]));
+        const order2 = ids(rankCandidates([a, b, c, d, e]));
+        const shuffled = ids(rankCandidates([e, c, a, d, b]));
+        expect(order1).toEqual(order2);
+        expect(shuffled).toEqual(order1);
+    });
+    it("does not let the agent priority tag break a tie (candidateId is the stable tiebreak)", () => {
+        // Same category, same verification → agent priority is irrelevant; order is by candidateId.
+        const hi = cand("zeta", { category: "workflow", agentPriority: "high" });
+        const lo = cand("alfa", { category: "workflow", agentPriority: "low" });
+        const forward = ids(rankCandidates([hi, lo]));
+        const backward = ids(rankCandidates([lo, hi]));
+        expect(forward).toEqual(backward);
+    });
+    it("does not mutate the input array", () => {
+        const input = [cand("b", { category: "crud" }), cand("a", { category: "bug_caught" })];
+        const before = names(input);
+        rankCandidates(input);
+        expect(names(input)).toEqual(before);
+    });
+});
+describe("selectPlan", () => {
+    const ctx = (over = {}) => ({
+        maxGenerate: 3,
+        maxTotal: 20,
+        isUIOnlyPR: false,
+        hasFrontendChanges: false,
+        externalCoverage: new Set(),
+        ...over,
+    });
+    it("ranks then budgets, surfacing the supplied demotions on the result", () => {
+        const candidates = [
+            cand("gen-a", { category: "business_rule", verified: DiscriminatorKind.BOUNDARY_EQUALITY }),
+            cand("gen-b", { category: "security_boundary" }),
+            cand("gen-c", { category: "crud" }),
+        ];
+        const demotions = [{ candidateId: "faked-claim-abc12345", reason: "boundary_equality unverified" }];
+        const res = selectPlan(candidates, ctx({ demotions }));
+        expect(res.generate.length).toBeGreaterThan(0);
+        expect(res.demotions).toEqual(demotions);
+        // The verified discriminator is ranked first and lands in GENERATE.
+        expect(res.generate[0].scenario.scenarioName).toBe("gen-a");
+    });
+    it("defaults demotions to an empty array when none are supplied", () => {
+        const res = selectPlan([cand("solo", { category: "workflow" })], ctx());
+        expect(res.demotions).toEqual([]);
+    });
+});

package/build/recommendation/testFixtures.d.ts

@@ -0,0 +1,25 @@
+import { ScenarioStep } from "../types/RepositoryAnalysis.js";
+import { Novelty, PriorityTier, ScenarioCategory } from "../types/TestRecommendation.js";
+import { Candidate } from "../types/Recommendation.js";
+/** Build a minimal ScenarioStep. */
+export declare function mkStep(method?: string, path?: string): ScenarioStep;
+interface CandidateOpts {
+    priority?: PriorityTier;
+    testType?: string;
+    steps?: number;
+    category?: ScenarioCategory;
+    description?: string;
+    novelty?: Novelty;
+}
+/**
+ * Build a ranked Candidate for budgeter/ranker tests. Steps default to a
+ * distinct path per candidate (so coverage keys don't collide) with the final
+ * step as a mutation (so resolvePrimaryStep picks a stable primary step).
+ *
+ * Note the two distinct priority fields: `scenario.priority` is the agent's
+ * own drafted label (lowercase — untrusted, ranking never reads it), while
+ * `Candidate.priority` is the server-computed PriorityTier the rankers
+ * actually order by.
+ */
+export declare function mkCandidate(name: string, opts?: CandidateOpts): Candidate;
+export {};

package/build/recommendation/testFixtures.js

@@ -0,0 +1,45 @@
+import { Novelty, PriorityTier, } from "../types/TestRecommendation.js";
+import { CandidateSource, computeCandidateId, } from "../types/Recommendation.js";
+/** Build a minimal ScenarioStep. */
+export function mkStep(method = "GET", path = "/r") {
+    return {
+        order: 0,
+        method,
+        path,
+        description: "",
+        interactionType: "success",
+        expectedStatusCode: 200,
+    };
+}
+/**
+ * Build a ranked Candidate for budgeter/ranker tests. Steps default to a
+ * distinct path per candidate (so coverage keys don't collide) with the final
+ * step as a mutation (so resolvePrimaryStep picks a stable primary step).
+ *
+ * Note the two distinct priority fields: `scenario.priority` is the agent's
+ * own drafted label (lowercase — untrusted, ranking never reads it), while
+ * `Candidate.priority` is the server-computed PriorityTier the rankers
+ * actually order by.
+ */
+export function mkCandidate(name, opts = {}) {
+    const stepCount = opts.steps ?? (opts.testType === "contract" ? 1 : 2);
+    const steps = Array.from({ length: stepCount }, (_, i) => mkStep(i === stepCount - 1 ? "POST" : "GET", `/${name}`));
+    const scenario = {
+        scenarioName: name,
+        description: opts.description ?? name,
+        category: opts.category ?? "workflow",
+        priority: "high",
+        steps,
+        chainingKeys: [],
+        requiresAuth: false,
+        estimatedComplexity: "moderate",
+        ...(opts.testType ? { testType: opts.testType } : {}),
+    };
+    return {
+        scenario,
+        priority: opts.priority ?? PriorityTier.HIGH,
+        novelty: opts.novelty ?? Novelty.EXISTING,
+        source: CandidateSource.AGENT,
+        candidateId: computeCandidateId(scenario),
+    };
+}

package/build/resources/testbotResource.js

@@ -25,7 +25,10 @@ export function registerTestbotResource(server) {
         const maxCrit = parseInt(uri.searchParams.get("maxCritical") || "", 10);
         const repositoryPath = param("repositoryPath", ".");
         const services = await readWorkspaceServices(repositoryPath);
-        const prompt = getTestbotPrompt(param("prTitle", ""), param("prDescription", ""), param("summaryOutputFile", ""), repositoryPath, uri.searchParams.get("baseBranch") || undefined, isNaN(maxRec) ? MAX_RECOMMENDATIONS : maxRec, isNaN(maxGen) ? MAX_TESTS_TO_GENERATE : maxGen, isNaN(maxCrit) ? MAX_CRITICAL_TESTS : maxCrit, isNaN(prNum) ? undefined : prNum, uri.searchParams.get("userPrompt") || undefined, services.length ? services : undefined, uri.searchParams.get("uiCredentials") || undefined, uri.searchParams.get("testsRepoDir") || undefined, parseRelatedRepositories(uri.searchParams.get("relatedRepositories") || undefined), uri.searchParams.get("primaryRepo") || undefined);
+        const prompt = getTestbotPrompt(param("prTitle", ""), param("prDescription", ""), param("summaryOutputFile", ""), repositoryPath, uri.searchParams.get("baseBranch") || undefined, isNaN(maxRec) ? MAX_RECOMMENDATIONS : maxRec, isNaN(maxGen) ? MAX_TESTS_TO_GENERATE : maxGen, isNaN(maxCrit) ? MAX_CRITICAL_TESTS : maxCrit, isNaN(prNum) ? undefined : prNum, uri.searchParams.get("userPrompt") || undefined, services.length ? services : undefined, uri.searchParams.get("uiCredentials") || undefined, uri.searchParams.get("testsRepoDir") || undefined, parseRelatedRepositories(uri.searchParams.get("relatedRepositories") || undefined), uri.searchParams.get("primaryRepo") || undefined, 
+        // Plan-only eval lane (SKYR-3879): recommendation phase only, nothing
+        // generated or executed. Same accepted spellings as the prompt schema.
+        ["true", "1"].includes(uri.searchParams.get("planOnly") ?? ""));
         AnalyticsService.pushMCPToolEvent("skyramp_testbot_prompt", undefined, {}).catch(() => { });
         // Return the original URI — clients may use it to re-fetch the resource,
         // and the caller already has these params. Credentials never appear in

package/build/services/ScenarioGenerationService.d.ts

@@ -12,6 +12,8 @@ export interface TraceRequest {
     Port: number;
     Timestamp: string;
     Scheme: string;
+    UniqueFields?: string[];
+    scenarioName?: string;
 }
 export interface ScenarioParams {
     scenarioName: string;
@@ -29,7 +31,10 @@ export interface ScenarioParams {
     authScheme?: string;
     authToken?: string;
     responseHeaders?: Record<string, string[]>;
+    uniqueFields?: string[];
 }
 export declare class ScenarioGenerationService {
+    private lastTimestampMs;
+    private nextTimestamp;
     generateTraceRequestFromInput(params: ScenarioParams): TraceRequest | null;
 }

package/build/services/ScenarioGenerationService.js

@@ -7,6 +7,17 @@ import { logger } from "../utils/logger.js";
 // LLM-controlled or user-controlled JSON input.
 const PROTO_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 export class ScenarioGenerationService {
+    // Trace timestamps must strictly increase in generation order: the Go
+    // codegen treats "earlier timestamp" as "prior step" when chaining
+    // FKs/path params from create responses, and all steps of a batch are
+    // generated within the same millisecond (SKYR-3884). The service owns the
+    // invariant — each trace from this instance is stamped at least one second
+    // after the previous one — so no caller can forget to thread an index.
+    lastTimestampMs = 0;
+    nextTimestamp() {
+        this.lastTimestampMs = Math.max(Date.now(), this.lastTimestampMs + 1000);
+        return new Date(this.lastTimestampMs).toISOString();
+    }
     generateTraceRequestFromInput(params) {
         let destination = params.destination;
         let scheme = "https";
@@ -30,7 +41,7 @@ export class ScenarioGenerationService {
                 });
             }
         }
-        const timestamp = new Date().toISOString();
+        const timestamp = this.nextTimestamp();
         const method = params.method;
         const statusCode = params.statusCode ?? inferExpectedStatus(method);
         const requestBody = params.requestBody ||
@@ -118,6 +129,10 @@ export class ScenarioGenerationService {
             Port: port,
             Timestamp: timestamp,
             Scheme: scheme,
+            scenarioName: params.scenarioName,
+            ...(params.uniqueFields && params.uniqueFields.length > 0
+                ? { UniqueFields: params.uniqueFields }
+                : {}),
         };
     }
 }

package/build/services/ScenarioGenerationService.test.js

@@ -368,3 +368,47 @@ describe("ScenarioGenerationService — baseURL parsing", () => {
         expect(trace.Port).toBe(80);
     });
 });
+describe("ScenarioGenerationService — unique fields (SKYR-3882)", () => {
+    it("carries uniqueFields onto the trace request", () => {
+        const trace = generateTrace({ uniqueFields: ["name", "slug"] });
+        expect(trace).not.toBeNull();
+        expect(trace.UniqueFields).toEqual(["name", "slug"]);
+    });
+    it("omits UniqueFields when none are provided", () => {
+        const trace = generateTrace({});
+        expect(trace).not.toBeNull();
+        expect(trace.UniqueFields).toBeUndefined();
+    });
+});
+describe("ScenarioGenerationService — step timestamps (SKYR-3884)", () => {
+    it("stamps consecutive traces from one instance with strictly increasing timestamps", () => {
+        // All steps of a batch are generated within the same millisecond, so a bare
+        // new Date().toISOString() gives every step the identical timestamp. The Go
+        // codegen treats "earlier timestamp" as "prior step" when chaining FKs and
+        // path params from create responses — equal stamps break every chain. The
+        // service owns the invariant, so callers cannot forget to thread an index.
+        const service = new ScenarioGenerationService();
+        const traces = [0, 1, 2].map(() => service.generateTraceRequestFromInput(BASE_PARAMS));
+        for (let i = 1; i < traces.length; i++) {
+            expect(new Date(traces[i].Timestamp).getTime()).toBeGreaterThan(new Date(traces[i - 1].Timestamp).getTime());
+        }
+    });
+    it("stamps the first trace of a fresh instance at the current time", () => {
+        const before = Date.now();
+        const trace = generateTrace({});
+        const after = Date.now();
+        const ts = new Date(trace.Timestamp).getTime();
+        expect(ts).toBeGreaterThanOrEqual(before);
+        expect(ts).toBeLessThanOrEqual(after);
+    });
+});
+describe("ScenarioGenerationService — scenarioName embedding (SKYR-3884)", () => {
+    it("writes scenarioName into each trace request so the plan guard can identify the file", () => {
+        // readScenarioNameFromFile (generateIntegrationRestTool) reads
+        // parsed[0].scenarioName to match the file against the approved plan.
+        // Without this field every scenarioFile-mode generation is rejected
+        // fail-closed whenever a plan is active.
+        const trace = generateTrace({});
+        expect(trace.scenarioName).toBe("test-scenario");
+    });
+});