@skyramp/mcp 0.3.1 → 0.3.2-rc.pom-2

package/build/services/TestExecutionService.test.js

@@ -1,5 +1,7 @@
 // @ts-nocheck - Jest ESM type inference issues
 import { jest } from "@jest/globals";
+import * as os from "os";
+import * as path from "path";
 import { buildContainerEnv, rewriteLocalhostForDocker } from "./containerEnv.js";
 // Mock dockerode before importing TestExecutionService
 const mockRun = jest.fn();
@@ -54,6 +56,32 @@ jest.unstable_mockModule("../utils/logger.js", () => ({
         warning: jest.fn(),
     },
 }));
+// Real temp directory trees for tests that need actual directory traversal
+// (findNestedNodeModules / findExcludedPaths walk the real fs, delegated to
+// via mockReaddirSync — see each describe block's beforeEach). Every root
+// created here is tracked and removed after its test so these don't leak
+// into the OS temp dir across runs.
+const makeTreeRoots = [];
+function makeTree(files) {
+    const root = actualFs.mkdtempSync(path.join(os.tmpdir(), "nnm-"));
+    makeTreeRoots.push(root);
+    for (const [rel, content] of Object.entries(files)) {
+        const abs = path.join(root, rel);
+        if (content === null)
+            actualFs.mkdirSync(abs, { recursive: true });
+        else {
+            actualFs.mkdirSync(path.dirname(abs), { recursive: true });
+            actualFs.writeFileSync(abs, content);
+        }
+    }
+    return root;
+}
+afterEach(() => {
+    while (makeTreeRoots.length > 0) {
+        const root = makeTreeRoots.pop();
+        actualFs.rmSync(root, { recursive: true, force: true });
+    }
+});
 describe("rewriteLocalhostForDocker", () => {
     it("rewrites http://localhost:port", () => {
         expect(rewriteLocalhostForDocker("http://localhost:8000")).toBe("http://host.docker.internal:8000");
@@ -633,3 +661,372 @@ describe("TestExecutionService.executeTest - Video capture for browser tests", (
         expect(result.videoPath).toBeUndefined();
     });
 });
+// SKYR-3819: tests delivered to a cross-repo test repository (testsRepoDir) live
+// outside workspacePath. The executor must mount the test repo under a reserved
+// /home/user subdir — inside the generated Playwright config's testDir — and
+// anchor the container test path there, or the runner reports "No tests found" /
+// "file or directory not found".
+describe("TestExecutionService.executeTest - cross-repo test repo mounts", () => {
+    let TestExecutionService;
+    let TEST_REPO_CONTAINER_SUBDIR;
+    let EXECUTOR_DOCKER_IMAGE;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        TestExecutionService = mod.TestExecutionService;
+        TEST_REPO_CONTAINER_SUBDIR = mod.TEST_REPO_CONTAINER_SUBDIR;
+        EXECUTOR_DOCKER_IMAGE = mod.EXECUTOR_DOCKER_IMAGE;
+    });
+    const dirent = (name, dir = false) => ({
+        name,
+        isFile: () => !dir,
+        isDirectory: () => dir,
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockListImages.mockResolvedValue([{ RepoTags: [EXECUTOR_DOCKER_IMAGE] }]);
+        const mockContainer = { remove: jest.fn().mockResolvedValue(undefined) };
+        mockRun.mockResolvedValue([{ StatusCode: 0 }, mockContainer]);
+        // Path-aware directory layout:
+        //   /workspace            → SUT repo (src/)
+        //   /test-repo            → cross-repo test repo (tests/, node_modules/, package.json)
+        mockReaddirSync.mockImplementation((dir, options) => {
+            const listing = {
+                "/workspace": [dirent("src", true)],
+                "/workspace/src": [],
+                "/test-repo": [dirent("tests", true), dirent("node_modules", true), dirent("package.json")],
+                "/test-repo/tests": [dirent("orders_test.py")],
+            };
+            const entries = listing[dir] ?? [];
+            return options?.withFileTypes ? entries : entries.map((e) => e.name);
+        });
+    });
+    it("mounts test repo entries under the reserved /home/user subdir with host mirrors", async () => {
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: "/test-repo/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/test-repo",
+            language: "python",
+            testType: "integration",
+        });
+        expect(mockRun).toHaveBeenCalledTimes(1);
+        const mounts = mockRun.mock.calls[0][3].HostConfig.Mounts;
+        expect(mounts).toContainEqual(expect.objectContaining({
+            Source: "/test-repo/tests",
+            Target: `/home/user/${TEST_REPO_CONTAINER_SUBDIR}/tests`,
+        }));
+        // Host-absolute mirror so absolute references embedded in tests resolve
+        expect(mounts).toContainEqual(expect.objectContaining({ Source: "/test-repo/tests", Target: "/test-repo/tests" }));
+    });
+    it("anchors the container test path inside the reserved subdir", async () => {
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: "/test-repo/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/test-repo",
+            language: "python",
+            testType: "integration",
+        });
+        const command = mockRun.mock.calls[0][1];
+        expect(command).toContain(`/home/user/${TEST_REPO_CONTAINER_SUBDIR}/tests/orders_test.py`);
+    });
+    it("applies mount exclusions and null shadows to the test repo", async () => {
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: "/test-repo/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/test-repo",
+            language: "python",
+            testType: "integration",
+        });
+        const mounts = mockRun.mock.calls[0][3].HostConfig.Mounts;
+        // node_modules is never mounted
+        expect(mounts.filter((m) => m.Source === "/test-repo/node_modules")).toHaveLength(0);
+        // package.json is shadowed with the empty-JSON file at both targets
+        const pkgShadows = mounts.filter((m) => m.Target === `/home/user/${TEST_REPO_CONTAINER_SUBDIR}/package.json` ||
+            m.Target === "/test-repo/package.json");
+        expect(pkgShadows).toHaveLength(2);
+        for (const m of pkgShadows) {
+            expect(m.Source).toMatch(/skyramp-empty\.json$/);
+        }
+    });
+    it("throws an actionable error when testFile is outside the workspace and no testRepoPath is known", async () => {
+        const service = new TestExecutionService();
+        await expect(service.executeTest({
+            testFile: "/test-repo/tests/orders_test.py",
+            workspacePath: "/workspace",
+            language: "python",
+            testType: "integration",
+        })).rejects.toThrow(/outside the workspace/);
+    });
+    it("does not add test repo mounts when testFile is inside the workspace", async () => {
+        mockReaddirSync.mockImplementation((dir, options) => {
+            const listing = {
+                "/workspace": [dirent("tests", true)],
+                "/workspace/tests": [dirent("orders_test.py")],
+            };
+            const entries = listing[dir] ?? [];
+            return options?.withFileTypes ? entries : entries.map((e) => e.name);
+        });
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: "/workspace/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/test-repo",
+            language: "python",
+            testType: "integration",
+        });
+        const command = mockRun.mock.calls[0][1];
+        expect(command).toContain("/home/user/tests/orders_test.py");
+        const mounts = mockRun.mock.calls[0][3].HostConfig.Mounts;
+        expect(mounts.filter((m) => m.Target.includes(TEST_REPO_CONTAINER_SUBDIR))).toHaveLength(0);
+    });
+});
+// Copilot review on PR #623: guard hazardous or stale cross-repo roots.
+describe("TestExecutionService.executeTest - cross-repo root guards", () => {
+    let TestExecutionService;
+    let EXECUTOR_DOCKER_IMAGE;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        TestExecutionService = mod.TestExecutionService;
+        EXECUTOR_DOCKER_IMAGE = mod.EXECUTOR_DOCKER_IMAGE;
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockListImages.mockResolvedValue([{ RepoTags: [EXECUTOR_DOCKER_IMAGE] }]);
+        const mockContainer = { remove: jest.fn().mockResolvedValue(undefined) };
+        mockRun.mockResolvedValue([{ StatusCode: 0 }, mockContainer]);
+    });
+    afterEach(() => {
+        mockAccessSync.mockReset();
+    });
+    it("rejects a filesystem-root testRepoPath instead of mounting the host root", async () => {
+        const service = new TestExecutionService();
+        await expect(service.executeTest({
+            testFile: "/outside/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/",
+            language: "python",
+            testType: "integration",
+        })).rejects.toThrow(/filesystem root/);
+        expect(mockRun).not.toHaveBeenCalled();
+    });
+    it("throws an actionable error when the cross-repo test repository is missing or unreadable", async () => {
+        mockAccessSync.mockImplementation((p) => {
+            if (String(p).startsWith("/test-repo")) {
+                throw new Error("EACCES");
+            }
+        });
+        const service = new TestExecutionService();
+        await expect(service.executeTest({
+            testFile: "/test-repo/tests/orders_test.py",
+            workspacePath: "/workspace",
+            testRepoPath: "/test-repo",
+            language: "python",
+            testType: "integration",
+        })).rejects.toThrow(/test repository path does not exist or is not readable/);
+        expect(mockRun).not.toHaveBeenCalled();
+    });
+});
+describe("findNestedNodeModules", () => {
+    let findNestedNodeModules;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        findNestedNodeModules = mod.findNestedNodeModules;
+    });
+    beforeEach(() => {
+        // These tests need real directory traversal — delegate the readdirSync
+        // mock (used by TestExecutionService.ts's `fs` binding) back to the real
+        // fs so it reflects the on-disk tree built by makeTree() below.
+        mockReaddirSync.mockImplementation((...args) => actualFs.readdirSync(...args));
+    });
+    const relSorted = (root, abs) => abs.map((p) => path.relative(root, p).replace(/\\/g, "/")).sort();
+    it("returns nested node_modules but not the top-level one", () => {
+        const root = makeTree({
+            "node_modules/playwright/index.js": "x",
+            "tests/ui-testing/node_modules/@playwright/test/index.js": "x",
+            "tests/ui-testing/pages/dashboard-list.js": "x",
+            "packages/web/node_modules/react/index.js": "x",
+        });
+        expect(relSorted(root, findNestedNodeModules(root))).toEqual([
+            "packages/web/node_modules",
+            "tests/ui-testing/node_modules",
+        ]);
+    });
+    it("never descends into a node_modules (no nested-inside-node_modules hits)", () => {
+        const root = makeTree({
+            "tests/node_modules/foo/node_modules/bar/index.js": "x",
+        });
+        expect(relSorted(root, findNestedNodeModules(root))).toEqual([
+            "tests/node_modules",
+        ]);
+    });
+    it("returns empty when there are no nested node_modules", () => {
+        const root = makeTree({ "node_modules/a/index.js": "x", "src/app.js": "x" });
+        expect(findNestedNodeModules(root)).toEqual([]);
+    });
+});
+describe("TestExecutionService.executeTest - nested node_modules shadow + NODE_PATH wrap", () => {
+    let TestExecutionService;
+    let EXECUTOR_DOCKER_IMAGE;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        TestExecutionService = mod.TestExecutionService;
+        EXECUTOR_DOCKER_IMAGE = mod.EXECUTOR_DOCKER_IMAGE;
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockListImages.mockResolvedValue([{ RepoTags: [EXECUTOR_DOCKER_IMAGE] }]);
+        const mockContainer = { remove: jest.fn().mockResolvedValue(undefined) };
+        mockRun.mockResolvedValue([{ StatusCode: 0 }, mockContainer]);
+        // Real directory traversal so findNestedNodeModules / the workspace-mount
+        // scan see the on-disk tree built by makeTree() below (same delegation as
+        // the findNestedNodeModules describe block above).
+        mockReaddirSync.mockImplementation((...args) => actualFs.readdirSync(...args));
+        // Real existsSync too, so the production `if (!fs.existsSync(pkgPath))
+        // continue` package-existence gate is genuinely exercised against the
+        // on-disk tree instead of the file-level always-true default.
+        mockExistsSync.mockImplementation((...args) => actualFs.existsSync(...args));
+    });
+    afterEach(() => {
+        // Restore the file-level always-true default for describes that follow.
+        mockExistsSync.mockReturnValue(true);
+    });
+    it("shadows a leaked nested @playwright/test and wraps the run command with NODE_PATH", async () => {
+        const root = makeTree({
+            "tests/node_modules/@playwright/test/index.js": "module.exports = {};",
+            "tests/sample.spec.ts": "test('noop', () => {});",
+        });
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: path.join(root, "tests/sample.spec.ts"),
+            workspacePath: root,
+            language: "typescript",
+            testType: "smoke",
+        });
+        expect(mockRun).toHaveBeenCalledTimes(1);
+        const dockerOptions = mockRun.mock.calls[0][3];
+        const mounts = dockerOptions.HostConfig.Mounts;
+        const shadowMount = mounts.find((m) => m.ReadOnly && m.Target.endsWith("tests/node_modules/@playwright/test"));
+        expect(shadowMount).toBeDefined();
+        // The fixture only creates a nested @playwright/test — no
+        // @skyramp/skyramp package exists on disk, so the existence gate
+        // (`if (!fs.existsSync(pkgPath)) continue`) must skip it. Asserting its
+        // absence here only proves the gate is live because existsSync is now
+        // delegated to the real fs above (it would false-pass against the
+        // always-true mock default).
+        const nonexistentPkgShadow = mounts.find((m) => m.Target.endsWith("tests/node_modules/@skyramp/skyramp"));
+        expect(nonexistentPkgShadow).toBeUndefined();
+        const command = mockRun.mock.calls[0][1];
+        expect(command.slice(0, 2)).toEqual(["bash", "-c"]);
+        expect(command[2]).toContain("NODE_PATH");
+        expect(command[2]).toContain("/root/runner.sh");
+    });
+});
+describe("TestExecutionService.executeTest - cross-repo context nested node_modules shadow", () => {
+    let TestExecutionService;
+    let TEST_REPO_CONTAINER_SUBDIR;
+    let EXECUTOR_DOCKER_IMAGE;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        TestExecutionService = mod.TestExecutionService;
+        TEST_REPO_CONTAINER_SUBDIR = mod.TEST_REPO_CONTAINER_SUBDIR;
+        EXECUTOR_DOCKER_IMAGE = mod.EXECUTOR_DOCKER_IMAGE;
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockListImages.mockResolvedValue([{ RepoTags: [EXECUTOR_DOCKER_IMAGE] }]);
+        const mockContainer = { remove: jest.fn().mockResolvedValue(undefined) };
+        mockRun.mockResolvedValue([{ StatusCode: 0 }, mockContainer]);
+        // Real directory traversal so findNestedNodeModules sees the on-disk tree
+        // built by makeTree() below (same delegation as the sibling
+        // workspace-context describe block above).
+        mockReaddirSync.mockImplementation((...args) => actualFs.readdirSync(...args));
+        // Real existsSync too, so the production `if (!fs.existsSync(pkgPath))
+        // continue` package-existence gate is genuinely exercised against the
+        // on-disk tree instead of the file-level always-true default.
+        mockExistsSync.mockImplementation((...args) => actualFs.existsSync(...args));
+    });
+    afterEach(() => {
+        // Restore the file-level always-true default for describes that follow.
+        mockExistsSync.mockReturnValue(true);
+    });
+    it("shadows a leaked nested @playwright/test in the cross-repo test root, mirroring at the host path unconditionally", async () => {
+        const workspaceRoot = makeTree({});
+        const testRepoRoot = makeTree({
+            "e2e/node_modules/@playwright/test/index.js": "module.exports = {};",
+            "e2e/sample.spec.ts": "test('noop', () => {});",
+        });
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: path.join(testRepoRoot, "e2e/sample.spec.ts"),
+            workspacePath: workspaceRoot,
+            testRepoPath: testRepoRoot,
+            language: "typescript",
+            testType: "smoke",
+        });
+        expect(mockRun).toHaveBeenCalledTimes(1);
+        const mounts = mockRun.mock.calls[0][3].HostConfig.Mounts;
+        // Container-side shadow lives under the reserved test-repo subdir.
+        const containerShadow = mounts.find((m) => m.ReadOnly &&
+            m.Target.includes(TEST_REPO_CONTAINER_SUBDIR) &&
+            m.Target.endsWith("e2e/node_modules/@playwright/test"));
+        expect(containerShadow).toBeDefined();
+        // Cross-repo mounts always mirror at the host-absolute path too (unlike
+        // the workspace context, where mirroring is conditional on
+        // workspacePath !== containerMountPath) — assert that unconditional
+        // mirror explicitly, since it's what distinguishes this context.
+        const hostPkgPath = path.join(testRepoRoot, "e2e/node_modules/@playwright/test");
+        const hostMirrorShadow = mounts.find((m) => m.ReadOnly && m.Target === hostPkgPath);
+        expect(hostMirrorShadow).toBeDefined();
+        expect(hostMirrorShadow.Source).toBe(containerShadow.Source);
+    });
+});
+describe("TestExecutionService.executeTest - root-level Playwright config shadow", () => {
+    let TestExecutionService;
+    let EXECUTOR_DOCKER_IMAGE;
+    beforeAll(async () => {
+        const mod = await import("./TestExecutionService.js");
+        TestExecutionService = mod.TestExecutionService;
+        EXECUTOR_DOCKER_IMAGE = mod.EXECUTOR_DOCKER_IMAGE;
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockListImages.mockResolvedValue([{ RepoTags: [EXECUTOR_DOCKER_IMAGE] }]);
+        const mockContainer = { remove: jest.fn().mockResolvedValue(undefined) };
+        mockRun.mockResolvedValue([{ StatusCode: 0 }, mockContainer]);
+        // Real directory traversal so the entry-mount filter and the
+        // PLAYWRIGHT_CONFIG_FILES shadow scan see the on-disk tree built by
+        // makeTree() below (same delegation as the sibling shadow describes above).
+        mockReaddirSync.mockImplementation((...args) => actualFs.readdirSync(...args));
+        mockExistsSync.mockImplementation((...args) => actualFs.existsSync(...args));
+    });
+    afterEach(() => {
+        // Restore the file-level always-true default for describes that follow.
+        mockExistsSync.mockReturnValue(true);
+    });
+    // Regression test: a root-level playwright.config.js used to win the
+    // pushMount target-dedup race over its minimal-config shadow, because the
+    // entry-mount filter excluded EXCLUDED_MOUNT_ITEMS/MOUNT_NULL_ITEMS but not
+    // PLAYWRIGHT_CONFIG_FILES — so the repo's own root config (which may import
+    // dotenv, or simply isn't the video-enabled config the executor expects)
+    // leaked into the container instead of being shadowed.
+    it("shadows a root-level playwright.config.js with the minimal/generated config instead of the workspace's own file", async () => {
+        const root = makeTree({
+            "playwright.config.js": "module.exports = { testDir: './tests' };",
+            "tests/sample.spec.ts": "test('noop', () => {});",
+        });
+        const service = new TestExecutionService();
+        await service.executeTest({
+            testFile: path.join(root, "tests/sample.spec.ts"),
+            workspacePath: root,
+            language: "typescript",
+            testType: "smoke",
+        });
+        expect(mockRun).toHaveBeenCalledTimes(1);
+        const mounts = mockRun.mock.calls[0][3].HostConfig.Mounts;
+        const configMount = mounts.find((m) => m.Target === path.join("/home/user", "playwright.config.js"));
+        expect(configMount).toBeDefined();
+        expect(configMount.Source).not.toBe(path.join(root, "playwright.config.js"));
+    });
+});

package/build/services/TestGenerationService.js

@@ -2,7 +2,7 @@ import path from "path";
 import fs from "fs";
 import { SkyrampClient } from "@skyramp/skyramp";
 import { analyzeOpenAPIWithGivenEndpoint } from "../utils/analyze-openapi.js";
-import { isAuthorizationHeaderName, KNOWN_AUTH_HEADERS, getWorkspaceAuthConfig, getDefaultAuthHeader, getAuthScheme, WorkspaceAuthType, } from "../utils/workspaceAuth.js";
+import { isAuthorizationHeaderName, KNOWN_AUTH_HEADERS, getWorkspaceAuthConfig, getDefaultAuthHeader, getAuthScheme, WorkspaceAuthType, getWorkspaceSkipTLSVerify, } from "../utils/workspaceAuth.js";
 import { getPathParameterValidationError, OUTPUT_DIR_FIELD_NAME, PATH_PARAMS_FIELD_NAME, QUERY_PARAMS_FIELD_NAME, FORM_PARAMS_FIELD_NAME, validateParams, validatePath, validateRequestData, } from "../utils/utils.js";
 import { getEntryPoint } from "../utils/telemetry.js";
 import { getLanguageSteps } from "../utils/language-helper.js";
@@ -346,6 +346,24 @@ The generated test file remains unchanged and ready to use as-is.
                     logger.warning("Could not resolve auth from workspace config");
                 }
             }
+            // Workspace-declared self-signed TLS (SKYR-3961): api.skipTLSVerify maps
+            // onto the generation pipeline's generateInsecure option (the tool param
+            // `insecure` is renamed by buildBaseGenerationOptions; SkyrampClient reads
+            // generateInsecure). The tool schema defaults insecure to false, so
+            // "false" is indistinguishable from "unspecified" — a workspace
+            // declaration only ever turns it ON, never off.
+            if (generateOptions.generateInsecure !== true) {
+                try {
+                    const repoPath = generateOptions.outputDir || process.cwd();
+                    if (await getWorkspaceSkipTLSVerify(repoPath)) {
+                        logger.info("generateInsecure enabled from workspace skipTLSVerify (self-signed TLS SUT)");
+                        generateOptions.generateInsecure = true;
+                    }
+                }
+                catch {
+                    logger.warning("Could not resolve skipTLSVerify from workspace config");
+                }
+            }
             if (generateOptions.traceFilePath) {
                 const traceAuth = this.extractAuthFromTrace(generateOptions.traceFilePath, generateOptions.generateInclude, generateOptions.generateExclude);
                 if (traceAuth) {

package/build/services/TestGenerationService.test.js

@@ -518,3 +518,61 @@ describe("TestGenerationService — trace-based auth in executeGeneration", () =
         expect(callArgs.authScheme).toBeUndefined();
     });
 });
+describe("TestGenerationService — workspace skipTLSVerify auto-resolve (SKYR-3961)", () => {
+    let mockGenerateRestTest;
+    let wsDir;
+    beforeEach(() => {
+        mockGenerateRestTest = jest.fn().mockResolvedValue("Test generation success");
+        SkyrampClient.mockImplementation(() => ({
+            generateRestTest: mockGenerateRestTest,
+        }));
+        wsDir = fs.mkdtempSync(path.join(os.tmpdir(), "skyramp-ws-"));
+    });
+    afterEach(() => {
+        fs.rmSync(wsDir, { recursive: true, force: true });
+    });
+    function writeWorkspace(api) {
+        const dir = path.join(wsDir, ".skyramp");
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, "workspace.yml"), [
+            "workspace:",
+            "  repoName: org/sut",
+            "services:",
+            "  - serviceName: sut",
+            "    api:",
+            ...Object.entries(api).map(([k, v]) => `      ${k}: ${v}`),
+        ].join("\n"), "utf8");
+    }
+    it("sets insecure from workspace when the caller did not request it", async () => {
+        writeWorkspace({ baseUrl: "https://127.0.0.1:45643", skipTLSVerify: true });
+        const svc = new StubService();
+        svc.buildGenerationOptions = () => ({
+            authHeader: "",
+            authScheme: "",
+            outputDir: wsDir,
+            language: "python",
+            framework: "pytest",
+        });
+        svc.handleApiAnalysis = async () => null;
+        await svc.generateTest({ ...BASE });
+        const callArgs = mockGenerateRestTest.mock.calls[0][0];
+        // generateInsecure is the key SkyrampClient reads (buildBaseGenerationOptions
+        // maps the tool param `insecure` onto it).
+        expect(callArgs.generateInsecure).toBe(true);
+    });
+    it("leaves insecure unset when the workspace does not declare it", async () => {
+        writeWorkspace({ baseUrl: "https://127.0.0.1:45643" });
+        const svc = new StubService();
+        svc.buildGenerationOptions = () => ({
+            authHeader: "",
+            authScheme: "",
+            outputDir: wsDir,
+            language: "python",
+            framework: "pytest",
+        });
+        svc.handleApiAnalysis = async () => null;
+        await svc.generateTest({ ...BASE });
+        const callArgs = mockGenerateRestTest.mock.calls[0][0];
+        expect(callArgs.generateInsecure).not.toBe(true);
+    });
+});

package/build/tool-phases.js

@@ -1,6 +1,7 @@
 export const TOOL_PHASE_MAP = {
     skyramp_recommend_tests: "analyzing",
     skyramp_analyze_changes: "analyzing",
+    skyramp_register_test_plan: "analyzing",
     skyramp_smoke_test_generation: "generating",
     skyramp_fuzz_test_generation: "generating",
     skyramp_contract_test_generation: "generating",

package/build/toolNames.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Canonical MCP tool-name constants for tools that are referenced OUTSIDE
+ * their own module — e.g. the register-plan checkpoint names the generation
+ * tools in its returned plan text, and the plan guard's rejection messages
+ * reference the register tool.
+ *
+ * Lives in a leaf module (no imports) so any tool can reference another
+ * tool's name without pulling in that tool's module graph — the generation
+ * tools import planGuard, so planGuard importing a generation tool's local
+ * TOOL_NAME back would be an import cycle.
+ *
+ * Keep in sync with TOOL_PHASE_MAP (src/tool-phases.ts) when renaming.
+ */
+export declare const TOOL_CONTRACT_TEST_GENERATION = "skyramp_contract_test_generation";
+export declare const TOOL_BATCH_SCENARIO_TEST_GENERATION = "skyramp_batch_scenario_test_generation";
+export declare const TOOL_INTEGRATION_TEST_GENERATION = "skyramp_integration_test_generation";
+export declare const TOOL_E2E_TEST_GENERATION = "skyramp_e2e_test_generation";
+export declare const TOOL_UI_TEST_GENERATION = "skyramp_ui_test_generation";
+export declare const TOOL_REGISTER_TEST_PLAN = "skyramp_register_test_plan";

package/build/toolNames.js

@@ -0,0 +1,19 @@
+/**
+ * Canonical MCP tool-name constants for tools that are referenced OUTSIDE
+ * their own module — e.g. the register-plan checkpoint names the generation
+ * tools in its returned plan text, and the plan guard's rejection messages
+ * reference the register tool.
+ *
+ * Lives in a leaf module (no imports) so any tool can reference another
+ * tool's name without pulling in that tool's module graph — the generation
+ * tools import planGuard, so planGuard importing a generation tool's local
+ * TOOL_NAME back would be an import cycle.
+ *
+ * Keep in sync with TOOL_PHASE_MAP (src/tool-phases.ts) when renaming.
+ */
+export const TOOL_CONTRACT_TEST_GENERATION = "skyramp_contract_test_generation";
+export const TOOL_BATCH_SCENARIO_TEST_GENERATION = "skyramp_batch_scenario_test_generation";
+export const TOOL_INTEGRATION_TEST_GENERATION = "skyramp_integration_test_generation";
+export const TOOL_E2E_TEST_GENERATION = "skyramp_e2e_test_generation";
+export const TOOL_UI_TEST_GENERATION = "skyramp_ui_test_generation";
+export const TOOL_REGISTER_TEST_PLAN = "skyramp_register_test_plan";

package/build/tools/code-refactor/codeReuseTool.d.ts

@@ -1,2 +1,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ScopedPom } from "../../utils/pom-scope/index.js";
+import { type VerifyResult } from "../../utils/pom-verify/index.js";
+/** Renders a `VerifyResult` (from `verifyReuse`) as the text report returned to the agent. */
+export declare function formatVerifyReport(r: VerifyResult): string;
+/** Renders the zero-reuse compliance-gate failure: a spec with 0 verified POM calls whose raw
+ * selectors nonetheless overlap tier-1 POM candidates — i.e. reuse was skipped, not unavailable. */
+export declare function formatZeroReuseGateFailure(tier1: ScopedPom[]): string;
 export declare function registerCodeReuseTool(server: McpServer): void;