@skyramp/mcp 0.3.2-rc.pom-3 → 0.3.2

package/build/prompts/testbot/testbot-prompts.js

@@ -4,9 +4,9 @@ import { AnalyticsService } from "../../services/AnalyticsService.js";
 import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS, PATH_PARAM_UUID_GUIDANCE, AUTH_CONFLICT_ERROR_MSG, } from "../test-recommendation/recommendationSections.js";
 import { TASK_ANALYZE_MAINTAIN, TASK_GENERATE, TASK_SUBMIT, taskRef } from "../test-recommendation/recommendationShared.js";
 import { getTraceRecordingPromptText } from "../../playwright/traceRecordingPrompt.js";
-import { isContractConsumerModeEnabled } from "../../utils/featureFlags.js";
+import { isContractConsumerModeEnabled, isPomReuseEnabled } from "../../utils/featureFlags.js";
 import { resolveServiceDetailsRef } from "../../utils/utils.js";
-import { readWorkspaceConfigRaw } from "../../utils/workspaceAuth.js";
+import { buildServiceContext, readWorkspaceServices, } from "../prompt-utils.js";
 // Cached at module-load — flags are process-wide and cannot change per call.
 const CONSUMER_MODE_ENABLED = isContractConsumerModeEnabled();
 const SERVICE_REFS = resolveServiceDetailsRef();
@@ -18,6 +18,14 @@ const CONTRACT_MODE_GUIDANCE = CONSUMER_MODE_ENABLED
   For client-facing APIs consumed by frontend: add \`consumerMode: true\`.
   Both modes (\`providerMode: true, consumerMode: true\`): For diff that contains BOTH provider signals (such as new/modified endpoint handlers, route changes this service owns) AND consumer signals (outbound HTTP client calls to another service, no new endpoint handlers).`
     : `  Always add \`providerMode: true\` — the tool generates provider-side contract tests only.`;
+const POM_REUSE_ENABLED = isPomReuseEnabled();
+// Post-generation code-reuse step for UI tests. The POM catalog, the `verify: true`
+// loop and the `.raw.bak` restore only exist on the POM-aware path — when that path
+// is flagged off, `skyramp_reuse_code` returns the SkyrampUtils workflow instead, so
+// the agent must not be sent looking for artifacts nothing produces.
+const UI_CODE_REUSE_STEP = POM_REUSE_ENABLED
+    ? `3. **[MANDATORY] After \`skyramp_ui_test_generation\` with \`codeReuse: true\`**: the generation result directs you to call \`skyramp_reuse_code\` — do this BEFORE \`skyramp_enhance_assertions\`. Two outcomes: (1) a response starting "No reusable POM layer detected" — this is a normal outcome, continue immediately (do NOT retry); (2) a refactoring workflow — follow it to completion INCLUDING its verification loop (\`skyramp_reuse_code\` with \`verify: true\`), finish only when it reports PASSED. If a reused test later fails execution and the failure points at a substituted POM call, restore the saved \`<testFile>.raw.bak\` over the test file and re-run — do NOT hand-edit the customer's POM methods (this re-run counts toward the 2-attempt execution cap — prefer this restore over the generic timeout fix-up when the failing locator came from a POM substitution). **Cleanup before reporting:** \`.raw.bak\` files are internal scratch — after ALL test executions are complete (pass or fail) and before calling \`skyramp_submit_report\`, delete every \`*.raw.bak\` you created so they are not committed to the customer-facing branch. The \`skyramp-pom-catalog.md\` is NOT scratch — leave it in place (later runs reuse it).`
+    : `3. **[MANDATORY] After \`skyramp_ui_test_generation\` with \`codeReuse: true\`**: the generation result directs you to call \`skyramp_reuse_code\` — do this BEFORE \`skyramp_enhance_assertions\`. Follow the returned steps exactly. If it finds no existing helper functions to reuse, that is a normal outcome — leave the test file unchanged and continue immediately (do NOT retry).`;
 /**
  * Parse the JSON-encoded `relatedRepositories` argument passed via the testbot
  * prompt/resource. Returns undefined for missing/blank input or malformed JSON so the
@@ -84,7 +92,7 @@ prNumber, userPrompt, services, uiCredentials, testsRepoDir, relatedRepositories
         maintenanceBeforeExecStep = `   d. Plan-only run: skip the pre-edit baseline execution — the application is not running. Record every maintenance verdict from static drift analysis alone; execution statuses simply remain unrecorded.`;
     }
     else {
-        maintenanceBeforeExecStep = `   d. Call \`skyramp_execute_test\` with \`phase: "before"\` and \`stateFile\` for every UPDATE/REGENERATE/DELETE test. Exclude tests marked \`[external]\` — those are baselined in step (a) via \`skyramp_run_existing_tests\`. Run them sequentially, not in parallel. This captures the pre-edit baseline — do not skip even if you expect the test to fail.`;
+        maintenanceBeforeExecStep = `   d. Call \`skyramp_execute_test\` with \`phase: "before"\` and \`stateFile\` for every UPDATE/REGENERATE/DELETE test. Exclude tests marked \`[external]\` — those are baselined in step 2(a) via \`skyramp_run_existing_tests\`. Run them sequentially, not in parallel. This captures the pre-edit baseline — do not skip even if you expect the test to fail.`;
     }
     // For follow-up requests: emit the @skyramp-testbot header + guardrails + retrieve-recommendations step.
     // For first-run prompts: emit the full Task 1 analysis + maintenance section.
@@ -143,12 +151,12 @@ ${hasRelatedRepos ? `
    4. **Spillover:** when a type's candidates run out, its freed slots go to the next-highest-scored candidate of any remaining type.
    Within a type, higher score wins regardless of which repo it came from. Everything not selected becomes an ADDITIONAL recommendation. This guarantees a frontend-only primary repo cannot starve a related backend repo's contract/integration tests of GENERATE slots (and vice versa). When you generate a test for a related repo's endpoint:
    - **Execute it only if that repo's service is already running and reachable.** The workflow's setup may have started multiple services; before generating an API test for a related repo, confirm its \`base_url\` (from that repo's workspace/Execution Plan) responds. If the service is unreachable, still GENERATE the test but mark its \`testResults\` status as \`Skipped\` with details "service not running in this run" — do NOT count an unreachable service as a failure.
-   - **Write the test file into that service's own \`testDirectory\`** — the one declared for the service in the unified workspace.yml (the related repo's services were registered there in step (a), each with its \`repository\`). The \`testDirectory\` is interpreted relative to the **single delivery root** (the configured test repo if set, otherwise the primary repo), so all generated tests are delivered together by the existing single-target delivery. Do NOT invent a per-source-repo subdirectory, and do NOT write into the related repo's own checkout — it is read-only context. (If two repos happen to declare the same \`testDirectory\`, their files coexist there; the \`repository\` field on each report item — below — is what attributes ownership, not the path.)
+   - **Write the test file into that service's own \`testDirectory\`** — the one declared for the service in the unified workspace.yml (the related repo's services were registered there in step 1(a), each with its \`repository\`). The \`testDirectory\` is interpreted relative to the **single delivery root** (the configured test repo if set, otherwise the primary repo), so all generated tests are delivered together by the existing single-target delivery. Do NOT invent a per-source-repo subdirectory, and do NOT write into the related repo's own checkout — it is read-only context. (If two repos happen to declare the same \`testDirectory\`, their files coexist there; the \`repository\` field on each report item — below — is what attributes ownership, not the path.)
    - **Set the \`repository\` field** (\`owner/repo\`) on every such \`newTestsCreated\` / \`testResults\` item so the report attributes it to the originating repo (see Report Guidelines).` : ""}
 
 2. **Maintain existing tests:**
 
-   a. Confirm external-test breakage before assessment. If any service in \`${repositoryPath}/.skyramp/workspace.yml\` declares test-env config (\`runtimeDetails.test*\`), call \`skyramp_run_existing_tests\` (\`mode: "confirm"\`, \`stateFile\`) on the tests \`skyramp_analyze_changes\` marked \`[external]\` — the repo's OWN suite, not the Skyramp-generated tests — before \`skyramp_analyze_test_health\`, so the run-confirmed failures fold into its assessment. Do NOT read the \`[external]\` test files to *guess* the change's impact — RUN them with \`skyramp_run_existing_tests\` to get real pass/fail; reading them is not a substitute for running them. These \`[external]\` suites also do not run through \`skyramp_execute_test\`, so skipping this leaves their status \`Unknown\`. Selector, health-gate, and self-skip behavior are in the tool description. (Skyramp-generated tests are baselined in step (d), not here.)
+   a. Confirm external-test breakage before assessment. If any service in \`${repositoryPath}/.skyramp/workspace.yml\` declares test-env config (\`runtimeDetails.test*\`), call \`skyramp_run_existing_tests\` (\`mode: "confirm"\`, \`stateFile\`) on the tests \`skyramp_analyze_changes\` marked \`[external]\` — the repo's OWN suite, not the Skyramp-generated tests — before \`skyramp_analyze_test_health\`, so the run-confirmed failures fold into its assessment. Do NOT read the \`[external]\` test files to *guess* the change's impact — RUN them with \`skyramp_run_existing_tests\` to get real pass/fail; reading them is not a substitute for running them. These \`[external]\` suites also do not run through \`skyramp_execute_test\`, so skipping this leaves their status \`Unknown\`. Selector, health-gate, and self-skip behavior are in the tool description. (Skyramp-generated tests are handled in step 2(d), not here.)
 
    b. Call \`skyramp_analyze_test_health\` with \`stateFile\` (from \`skyramp_analyze_changes\` output). Pass \`blueprintCaptured: true\` when \`browser_blueprint\` was called successfully earlier in this session — see the parameter description for when this applies. **Do NOT read application source files** (routes, models, controllers) — all change information you need is in the \`skyramp_analyze_changes\` output and the diff. Exception: the UI drift pre-scan (\`UI_SYMBOL_PRESCAN\`) may instruct you to read changed frontend files to extract exported symbols — follow those instructions when present.
 
@@ -158,7 +166,7 @@ ${maintenanceBeforeExecStep}
 
    e. Call \`skyramp_actions\` with \`stateFile\` (from \`skyramp_analyze_changes\` output) and apply the edits it returns.
 
-   f. Verify external-test fixes. If step (a) ran, after applying edits in step (e) re-run the affected \`[external]\` files with \`skyramp_run_existing_tests\` (\`mode: "verify"\`, \`stateFile\`) and record each file's result as its \`afterStatus\`. A still-failing verify is surfaced in the report — do not loop.
+   f. Verify external-test fixes. **This step is not optional and it is the easiest one to forget — you have just edited files in step 2(e), so come back here before you move on to anything else.** It applies whenever step 2(a) reported a real pass/fail result for a file you then edited. It does NOT apply when step 2(a) returned \`skipped: true\` or \`ran: 0\` for every suite — there is no baseline to compare against, so say so in your report instead of re-running. When it applies: re-run those \`[external]\` files with \`skyramp_run_existing_tests\` (\`mode: "verify"\`, \`stateFile\`) and record each file's result as its \`afterStatus\`. Editing an \`[external]\` file that step 2(a) confirmed failing and NOT re-running it leaves your own fix unverified — you would be reporting a repair you never saw work. A still-failing verify is surfaced in the report — do not loop.
 
 3. **Code review:** From the \`skyramp_analyze_changes\` output and the existing test files you read for maintenance, note any logic bugs. Do NOT read additional source files just for code review — use what is already available from the analysis and test file reads. Common patterns to flag:
    - Computed fields not recalculated after mutation (e.g. \`total_amount\` unchanged after items are added/removed)
@@ -400,7 +408,7 @@ This is a plan-only evaluation run: the application under test is NOT running, a
 ${userPrompt ? "Generate only the tests that the user requested from the Additional Recommendations. The rules below still apply." : "Drift-based maintenance (Task 1) is complete. This step only processes the GENERATE list. Exception: if a GENERATE item targets a resource with an existing `[skyramp]` contract test, UPDATE that test file (see covered-resource handling below) — a new test case added to an existing file counts toward the budget and is reported in `newTestsCreated`."}
 
 - **MANDATORY — use the plan returned by \`skyramp_register_test_plan\` as-is**: Before generating anything, call \`skyramp_register_test_plan\` (\`stateFile\` required) with your complete candidate list — every test you would generate OR recommend, including the Execution Plan's own pre-ranked GENERATE/ADDITIONAL items and any candidate you drafted yourself, with a \`discriminator\` claim \`{kind, changedCodeAnchor}\` for candidates probing changed logic. Its returned GENERATE list — not the Execution Plan's raw pre-ranked GENERATE section — governs ADD actions from this point on. You MUST generate exactly those scenarios in the exact order listed, keeping each item's \`scenarioName\` exactly as registered — the generation tools match on it and reject renamed or substituted scenarios. If parameter grounding uncovers a distinct bug-catching scenario not already registered, generate it after all planned GENERATE items are complete and report it in \`newTestsCreated\` — this is an additional test driven by source-code analysis and does not count against the GENERATE budget.${hasRelatedRepos ? `\n  - **Multi-repo exception:** this run has related repositories, so the per-repo GENERATE lists are NOT final — they are candidates re-selected by the cross-repo round-robin described in Task 1's "Cross-repo test generation". Register the pooled, type-distributed selection instead of any single repo's GENERATE list. (In single-repo runs, register the GENERATE list exactly as-is.)` : ""}
-- **Do not fabricate tests outside the GENERATE list.** New test files cover NEW observable surface only — a new endpoint, or a newly-integrated component/route not already covered by an existing test. Changes that only modify, delete, or add fields to an EXISTING covered endpoint or component are maintenance: handle them in ${taskRef(TASK_ANALYZE_MAINTAIN)} by UPDATE/DELETE of the existing test, never by creating a new spec. If the GENERATE list is empty (deletion-only, cosmetic, or modification-of-existing PRs with no new surface), create zero new tests and proceed to ${taskRef(TASK_SUBMIT)} — do not invent a new spec to have something to report.
+- **Do not fabricate tests outside the GENERATE list provided by \`skyramp_analyze_changes\`.** Changes that only modify, delete, or add fields to an EXISTING covered endpoint or component are maintenance: handle them in ${taskRef(TASK_ANALYZE_MAINTAIN)} by UPDATE/DELETE of the existing test, never by creating a new spec. If the GENERATE list is empty, create zero new tests and proceed to ${taskRef(TASK_SUBMIT)}.
 - Scenario JSON files are always new files — always generate them for new methods. Every generated scenario JSON must have a corresponding new integration test generated from it via \`skyramp_integration_test_generation\`.
 - Covered-resource handling (aligns with Execution Plan Step 0): When a GENERATE item targets a resource that already has an existing test file covering the same endpoint:
   - If the existing test source is \`[external]\`, skip the resource entirely — the external test already provides coverage. Do NOT UPDATE, REGENERATE, or DELETE external tests.
@@ -410,11 +418,11 @@ ${userPrompt ? "Generate only the tests that the user requested from the Additio
     - UI tests: Always generate as a new file. Report in \`newTestsCreated\`.
   Keep advancing until you have created exactly as many new test files as your committed Budget Plan's generate count (at most ${maxGenerate}) OR exhausted all candidates. If your Budget Plan is 0 total, ${taskRef(TASK_GENERATE)} produces zero tests.
 - Example: If enrichment reveals that sending \`discount_value\` without \`discount_type\` silently orphans the value (a concrete bug), complete all planned GENERATE items first, then generate this discovered scenario as an extra test and report it in \`newTestsCreated\`.
-- Total generated: your committed Budget Plan's generate count (from the Execution Plan's Scope Assessment, at most ${maxGenerate}) is the single source of truth for how many tests to create. Process every GENERATE-tagged item in order, then backfill from ADDITIONAL candidates (highest-ranked first) until \`newTestsCreated\` reaches that generate count or all candidates are exhausted. If your Budget Plan is 0 total (the Execution Plan's zero-classified default or cosmetic-only override applies), skip generation and backfilling entirely and proceed to ${taskRef(TASK_SUBMIT)}'s zero-test report path.
-- **UI test priority**: If the PR scope assessment shows any UI/E2E budget OR \`uiContext.changedFrontendFiles\` is non-empty (the deterministic server signal — populated for all supported frontend file types including \`.tsx\`/\`.jsx\`/\`.vue\`/\`.svelte\`/\`.dart\`), you MUST attempt to generate at least one UI test. Use \`browser_navigate\` to the app's base URL — if the app responds, record a trace and generate the test.
+- Total generated: your committed Budget Plan's generate count (from the Execution Plan's Scope Assessment, at most ${maxGenerate}) is the single source of truth for how many tests to create. Process every GENERATE-tagged item in order, then backfill from ADDITIONAL candidates (highest-ranked first) until \`newTestsCreated\` reaches that generate count or all candidates are exhausted. If your Budget Plan is 0 total, skip generation and backfilling entirely and proceed to ${taskRef(TASK_SUBMIT)}'s zero-test report path.
+- **UI test priority**: \`skyramp_register_test_plan\` ends its output with a **Generation directive** that states whether this run generates UI/E2E tests and how many. Follow it as given — do not re-derive the decision from the diff or from \`uiContext\`. When it says UI/E2E generation is REQUIRED, use \`browser_navigate\` to the app's base URL, record a trace, and generate the test. (\`uiContext.changedFrontendFiles\` — the deterministic server signal, populated for all supported frontend file types including \`.tsx\`/\`.jsx\`/\`.vue\`/\`.svelte\`/\`.dart\` — tells you the PR touched the frontend, so a UI candidate belongs in the list you *register*. It never obliges you to generate.)
   **Flutter web apps:** Skyramp's Playwright tools automatically enable Flutter's accessibility semantics tree on every \`browser_navigate\` call — you do NOT need to manually click \`flt-semantics-placeholder\` or add any activation step to the trace. Do NOT log an \`issuesFound\` entry about Flutter canvas rendering or accessibility activation — this is handled transparently. **Do NOT skip test generation or abstain from recording based on what you see in the Flutter source code** (e.g. \`SemanticsBinding.ensureSemantics()\` commented out, \`IS_TESTING\` flag absent, or similar) — Skyramp enables accessibility from the browser side regardless of the app's Dart code. Proceed with \`browser_navigate\` and test recording as normal. **Start at the app's root URL** (e.g. \`{baseUrl}/\`) — do NOT \`browser_navigate\` straight to a deep sub-route (e.g. \`/authors\`, \`/orders/13\`). Flutter \`go_router\` SPAs route from the root: deep-linking on a cold page load often fails to render the expected screen (the route's widgets never mount, so the trace captures the wrong page). Load the root, let the app's own routing/auth-redirect render, then reach target screens by interaction. **After the initial login, navigate using in-app controls only** (tab buttons, links, back buttons) — do NOT call \`browser_navigate\` to a different URL after login. Flutter web apps are SPAs: a \`browser_navigate\` to a new URL after login triggers a full page reload which clears the auth session, causing redundant re-login cycles in the generated test. Use button clicks to reach target screens instead.
-  **Skip only if one of these conditions is met:**
-  - **(a) App is unreachable** — \`browser_navigate\` fails or connection is refused.
+  **When the directive requires UI/E2E generation, skip only if one of these runtime conditions is met** (the directive already settles allocation; these are the two things the server cannot know ahead of time):
+  - **(a) App is unreachable** — \`browser_navigate\` fails or connection is refused. This is an environment failure, NOT a decision: you were required to generate and could not. Record it in \`issuesFound\`, move the intended UI test to \`additionalRecommendations\` with the failure reason, and say plainly in the report that the test could not be recorded because the app was down, so the empty \`newTestsCreated\` is not mistaken for a deliberate no-test verdict.
   - **(b) Unintegrated non-route component** — the changed file is a leaf component (not a framework route/entrypoint) that has no integration point in the running app. **The server already computes this** — check \`uiContext.frontendFileIntegration\` in the \`skyramp_analyze_changes\` output: if it marks the changed file \`integrated: false\`, treat the component as unintegrated WITHOUT re-running the grep below (the tool output's accompanying instruction block already tells you what to do — do not substitute another page or trace). Only fall back to the manual grep procedure when \`frontendFileIntegration\` is absent (older MCP versions) or doesn't cover the changed file:
     1. Grep for the component's exported name AND its module path/filename across all production source files (excluding \`*.test.*\`, \`*.spec.*\`, \`*.stories.*\`, \`__tests__/\` directories — only production code imports count).
     2. If no production file imports, re-exports, or renders it, the component has no DOM node in the running app → unintegrated.
@@ -464,18 +472,20 @@ ${CONTRACT_MODE_GUIDANCE}
   If NO relevant trace exists, **you MUST write out your full trace plan as text BEFORE calling \`browser_navigate\`**. Do not touch the browser until the plan is written.
 
   **Browser authentication (check BEFORE navigating)**: If \`<ui-credentials>\` appears in your context above, the app requires login. Parse the credentials — one per line, two supported formats:
-  - New format: \`username=<value>;password=<value>\` or \`username=<value>;password=<value>;role=<value>\` — fields are \`;\`-delimited key=value pairs. The \`=\` and \`;\` characters are reserved delimiters and must not appear in the values themselves.
+  - New format: \`;\`-delimited \`key=value\` pairs, e.g. \`username=<value>;password=<value>\` or \`username=<value>;password=<value>;tenantId=<value>\`. \`username\` and \`password\` are the standard keys; \`role=<value>\` (optional) selects among multiple credentials; **any other key is the value for an additional login-form field** (e.g. \`tenantId\`, \`companyCode\`, \`domain\`), matched to the form field by its name/label/placeholder.
+  - JSON format: a line may instead be a JSON object, e.g. \`{"username":"u","password":"p;=x","tenantId":"1"}\` — preferred when a value itself contains \`=\` or \`;\`.
   - Legacy format: \`username:password\` — the first \`:\` splits username from password.
+  These are format hints, not a strict grammar — apply judgment on ambiguous input (e.g. a \`=\` or \`;\` inside a value of the key=value form: split on the \`;\` that precedes a plausible login-field key).
 
   **Credential selection**: Use the first credential by default. When the scenario requires a specific role, find the credential whose \`role\` field matches (e.g. \`role=admin\`). If no credential matches the required role, use the first credential and add a note to \`issuesFound\` that no matching role was found.
 
   Type all values verbatim. Before navigating to ANY feature URL:
   1. \`browser_navigate\` to the login URL (e.g. \`{baseUrl}/login\`, \`/user/login\`, \`/signin\` — infer from the app's base URL and framework)
-  2. \`browser_snapshot\` to find the username/email and password fields
+  2. \`browser_snapshot\` and enumerate every **visible, user-editable** input field in the login form — not just username/password. Match each field to a credential key by its name/label/placeholder (e.g. a tenant-ID field ↔ \`tenantId=<value>\`) BEFORE clicking anything.
   3. \`browser_type\` the username into the email/username field
   4. \`browser_type\` the password into the password field
-  5. If a role selector is present and a \`role\` was specified in the credential, select it before submitting
-  6. \`browser_click\` the submit button, then \`browser_wait_for\` redirect away from the login page
+  5. \`browser_type\` each remaining form field's value from its matching credential key. If a role selector is present and a \`role\` was specified in the credential, select it before submitting.
+  6. Only once **every visible required field is filled**: \`browser_click\` the submit button, then \`browser_wait_for\` redirect away from the login page. NEVER click submit with a required field still empty to "see what happens" — the recorder is a faithful capture, so a failed submit attempt gets baked into the trace and replayed by the generated test. If a visible **required** field has no matching credential key, do NOT submit: skip recording this flow and add an \`issuesFound\` entry naming the form field and the \`key=value\` pair the customer must add to the \`uiCredentials\` input in their workflow file. Optional fields with no matching key are simply left empty — they are never a reason to abort.
   7. Now navigate directly to the feature URL and begin recording
   The login steps ARE part of the trace — the generated test will authenticate automatically.
 
@@ -508,7 +518,7 @@ ${CONTRACT_MODE_GUIDANCE}
   - **\`browser_assert\` — MANDATORY**: at least one per page navigated. Call multiple assertions in the same tool call batch when checking independent elements. If you navigate to 2 pages, assert on both. Each assertion should verify a business outcome (state change, computed value, error condition) — not just that an element is visible.
   - **\`browser_visual_snapshot\` — for visual/appearance checks**: when the instruction asks to take a screenshot, capture a baseline, or verify how a page/element/region *looks* (not its text or value), call \`browser_visual_snapshot\` — it records a \`toHaveScreenshot()\` assertion so the generated test pixel-compares against a baseline on every run. Do NOT use \`browser_take_screenshot\` for this: it captures a throwaway image that is dropped at export and never appears in the generated test (use it only to view the page yourself).
   - **Wait for stable state before the second capture**: After performing an action that affects computed fields (filling a discount, submitting a form, adding an item), check the current page state before calling the second \`browser_blueprint\` (the capture after the action). If a computed field — total, price, count, derived text — still shows its initial empty or zero value (e.g. \`$0.00\`, \`0\`, \`Loading...\`, empty string), that means async data hasn't finished loading yet. Use \`browser_wait_for\` to wait up to 10 seconds for the field to update to a real value (for example, wait for the total to show a non-zero amount like \`$799.99\` instead of \`$0.00\`). Once the field shows a real value, THEN call the second \`browser_blueprint\` to capture stable state. If after 10 seconds the field still hasn't updated, skip the assertion on that field — don't capture and assert a value that hasn't loaded.
-  If \`browser_navigate\` fails (app not running / connection refused), move to \`additionalRecommendations\` with the failure reason.
+  If \`browser_navigate\` fails (app not running / connection refused), apply skip condition (a) above: move the intended test to \`additionalRecommendations\` with the failure reason AND record the outage in \`issuesFound\`.
   Record at most 2-3 UI traces per run to stay within tool call budget. Quality over quantity: 1 great test is better than 3 mediocre ones — do not pad to reach the count.
   **Strategic assertions** — key checkpoints only, 3 to 5 per test:
     - **After the main action completes**: verify the outcome is visible (new item appears, form saves, confirmation shows)
@@ -522,7 +532,7 @@ ${CONTRACT_MODE_GUIDANCE}
 
   **Skip this entire section if \`uiContext\` was absent or \`changedFrontendFiles\` was empty in the \`skyramp_analyze_changes\` response** (backend-only PR). The capture-act-capture pattern is for UI trace recording only — there's no UI trace to record on a backend-only PR. Continue to the non-UI test-type instructions below.
 
-  **Reminder — the UI test priority rule above still applies.** If the diff contains frontend/UI changes, you still MUST attempt to generate at least one UI test. Capture-act-capture is **how** you record that test, not **whether** you record one — do not substitute UI recommendations for actually recording a trace. UI recommendation reasoning was already grounded in the blueprints you captured from the UI Blueprint Capture section of \`skyramp_analyze_changes\`; Task 2's capture-act-capture is for the trace's own assertions, not for retroactively rewriting recommendation reasoning.
+  **Reminder — the UI test priority rule above still applies.** If the plan's Generation directive requires UI/E2E generation, you still MUST attempt to record a trace. Capture-act-capture is **how** you record that test, not **whether** you record one — do not substitute UI recommendations for actually recording a trace. (If the directive allocates no UI/E2E generation, there is nothing to record here — that is the plan's decision, not a shortcut.) UI recommendation reasoning was already grounded in the blueprints you captured from the UI Blueprint Capture section of \`skyramp_analyze_changes\`; Task 2's capture-act-capture is for the trace's own assertions, not for retroactively rewriting recommendation reasoning.
 
   This pattern produces delta-derived assertions from blueprint diffs. Diff-derived assertions catch state changes more reliably than author-inference — the diff tells you what actually changed on the page so the assertion is grounded in observable state, not in guessing what "success" looks like.
 
@@ -589,12 +599,14 @@ Do NOT use \`page.waitForTimeout()\` with fixed delays. Do NOT retry more than o
 **After generation, you MUST do exactly these steps — nothing more, nothing less:**
 1. **[MANDATORY] After \`skyramp_integration_test_generation\`**: Call \`skyramp_enhance_assertions\` with \`testFile\` set to the absolute path of the generated integration test file, \`testType: "integration"\`, and \`enhanceType: "generation"\`. Apply every instruction returned to that file.
 2. **[MANDATORY] After \`skyramp_contract_test_generation\` with \`providerMode\`**: Call \`skyramp_enhance_assertions\` with \`testFile\` set to the absolute path of the generated provider contract test file, \`testType: "contract"\`, and \`enhanceType: "generation"\`. Apply every instruction returned to that file.
-3. **[MANDATORY] After \`skyramp_ui_test_generation\` with \`codeReuse: true\`**: the generation result directs you to call \`skyramp_reuse_code\` — do this BEFORE \`skyramp_enhance_assertions\`. Two outcomes: (1) a response starting "No reusable POM layer detected" — this is a normal outcome, continue immediately (do NOT retry), and note "no POM layer — reuse skipped" in that test's \`testResults\` entry \`details\`; (2) a refactoring workflow — follow it to completion INCLUDING its verification loop (\`skyramp_reuse_code\` with \`verify: true\`), finish only when it reports PASSED, and include \`verification: passed\` in that test's \`testResults\` entry \`details\` in your final report. If a reused test later fails execution and the failure points at a substituted POM call, restore the saved \`<testFile>.raw.bak\` over the test file and re-run — do NOT hand-edit the customer's POM methods (this re-run counts toward the 2-attempt execution cap — prefer this restore over the generic timeout fix-up when the failing locator came from a POM substitution).
+${UI_CODE_REUSE_STEP}
 4. **[MANDATORY] After \`skyramp_ui_test_generation\`**: Call \`skyramp_enhance_assertions\` with \`testFile\` set to the absolute path of the generated UI test file, \`testType: "ui"\`, and \`enhanceType: "generation"\`. Apply every instruction returned to that file. The HIGH-tier \`possibleAssertions\` from your second \`browser_blueprint\` captures (after each action) during trace recording are in your context — when the enhance instructions ask you to add assertions for state-changing actions, use those grounded candidates first (they contain exact computed values from the DOM delta, e.g. \`toHaveText('Total: $899.98')\`). Only fall back to deriving values from the test file or source code when no HIGH-tier candidate covers the action.
 5. **Wait**: Do NOT proceed to test execution until steps 1–4 are complete and the verification checklist in the \`skyramp_enhance_assertions\` tool result has been validated for EVERY generated test file.
 Do not make any changes other than the code-reuse refactoring (step 3) and the assertion enhancements described above. For example: do not modify auth headers, cookies, tokens, env vars, or imports that the generation tool already set correctly — those are correct by construction and changing them breaks auth or execution.
 
-**Final execution (mandatory):** Do NOT call \`skyramp_execute_test\` until ALL maintenance edits AND ALL new test generation/enhancement are complete. Run these calls sequentially, not in parallel. Exclude tests marked \`[external]\`.
+**Execution timing:**
+- **beforeStatus** (maintained tests only): execute each maintained test file **once at the start** (before any edits) to capture \`beforeStatus\`. This is the only execution allowed before edits.
+- **Final execution**: Do NOT call \`skyramp_execute_test\` again until ALL maintenance edits AND ALL new test generation/enhancement are complete. Then execute every test file once — maintained files (for \`afterStatus\`) and new files together. **Execute tests SEQUENTIALLY (one at a time)** — do NOT send multiple \`skyramp_execute_test\` calls in the same tool call batch, as concurrent execution overwhelms the stdio transport and causes MCP disconnection. Exclude tests marked \`[external]\`.
 - Only report test results for files you actually ran.
 **Auth**: If \`skyramp_analyze_changes\` reports an auth token or \`SKYRAMP_TEST_TOKEN\` is set, pass it in **every** \`skyramp_execute_test\` call from the first attempt — do NOT wait for a 401/403 to discover auth is needed.`;
     }
@@ -647,38 +659,6 @@ ${getTraceRecordingPromptText({ outputDir: `${repositoryPath}/.skyramp`, modular
     // removing stateOutputFile from the prompt schema. Remove the RUNNER_TEMP branch in
     // AnalysisStateManager.ts when this is done.
 }
-function escapeXml(value) {
-    return value
-        .replaceAll('&', '&amp;')
-        .replaceAll('<', '&lt;')
-        .replaceAll('>', '&gt;')
-        .replaceAll('"', '&quot;')
-        .replaceAll("'", '&apos;');
-}
-function buildServiceContext(services) {
-    const blocks = services.map(svc => {
-        const parts = [`<service name="${escapeXml(svc.serviceName)}">`];
-        if (svc.language)
-            parts.push(`  <language>${escapeXml(svc.language)}</language>`);
-        if (svc.framework)
-            parts.push(`  <framework>${escapeXml(svc.framework)}</framework>`);
-        if (svc.api?.baseUrl)
-            parts.push(`  <base_url>${escapeXml(svc.api.baseUrl)}</base_url>`);
-        if (svc.testDirectory)
-            parts.push(`  <test_directory>${escapeXml(svc.testDirectory)}</test_directory>`);
-        parts.push('</service>');
-        return parts.join('\n');
-    });
-    return `<services>\n${blocks.join('\n')}\n</services>`;
-}
-/**
- * Read services from .skyramp/workspace.yml. Returns empty array if
- * the workspace file doesn't exist or can't be parsed.
- */
-export async function readWorkspaceServices(repositoryPath) {
-    const rawConfig = await readWorkspaceConfigRaw(repositoryPath);
-    return (rawConfig?.services ?? []);
-}
 export function buildWorkspaceRecoveryPrefix(repositoryPath) {
     return `IMPORTANT: The existing .skyramp/workspace.yml failed to parse or validate. Before proceeding with any tasks below, you MUST call skyramp_init_scan with workspacePath "${repositoryPath}" and force: true, then call skyramp_init_workspace with workspacePath "${repositoryPath}", the discovered services, scanToken, and force: true to regenerate the workspace file.\n\n`;
 }
@@ -723,7 +703,7 @@ export function registerTestbotPrompt(server) {
             uiCredentials: z
                 .string()
                 .optional()
-                .describe("Browser login credentials for UI test recording. One credential per line. Supported formats: 'username=<val>;password=<val>' or 'username=<val>;password=<val>;role=<val>' (role optional), or legacy 'username:password'. Note: = and ; are reserved delimiters in the new format and must not appear in values. Injected into the prompt as a <ui-credentials> block so the agent logs in before recording traces."),
+                .describe("Browser login credentials for UI test recording. One credential per line. Supported formats: ';'-delimited key=value pairs — 'username=<val>;password=<val>' plus any additional login-form fields the app needs (e.g. ';tenantId=<val>') and optional ';role=<val>' for credential selection — a JSON object per line (preferred when a value contains = or ;), or legacy 'username:password'. The string is passed to the agent opaquely; formats are hints the agent interprets, not a parsed grammar. Injected into the prompt as a <ui-credentials> block so the agent fills every login-form field and logs in before recording traces."),
             workspaceValidationFailed: z
                 .boolean()
                 .default(false)

package/build/recommendation/planRanker.d.ts

@@ -9,12 +9,22 @@ export interface RankOptions {
      * the agent's priority tag as a ranking input.
      */
     carveOutCategories?: ScenarioCategory[];
+    /**
+     * Raw PR diff text. When supplied, a candidate whose scenario references a
+     * method+path that appears on an actual changed diff line (`+`/`-`) floats
+     * ahead of a same-tier candidate that doesn't — e.g. the one endpoint really
+     * removed by a PR outranks other same-category "verify-removed-*" candidates
+     * for endpoints merely adjacent in the same file (SKYR-4026).
+     */
+    diffText?: string;
 }
 /** Context for {@link selectPlan}: the budget context plus the demotion channel
  *  the register-plan tool fills from discriminator verification. */
 export interface SelectPlanContext extends BudgetContext {
     /** Demoted claims (failed discriminator verification) to surface on the result. */
     demotions?: Demotion[];
+    /** Threaded into {@link rankCandidates} as `RankOptions.diffText`. */
+    diffText?: string;
 }
 /**
  * Rank test candidates for the register-plan checkpoint. Pure and fully
@@ -28,9 +38,12 @@ export interface SelectPlanContext extends BudgetContext {
  *   2. Verified discriminators — candidates whose declared discriminator survived
  *      `validateDiscriminator` (marked via `verifiedDiscriminator`) float ahead of
  *      unverified peers in the same tier.
- *   3. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
+ *   3. Diff-hunk proximity — candidates referencing a method+path that appears
+ *      on an actual changed diff line float ahead of same-tier candidates that
+ *      don't (SKYR-4026). Only applied when `opts.diffText` is supplied.
+ *   4. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
  *      MEDIUM > LOW).
- *   4. Stable tiebreak on `candidateId` for determinism.
+ *   5. Stable tiebreak on `candidateId` for determinism.
  *
  * IMPORTANT: the agent-supplied `priority` field (`scenario.priority`) is
  * DELIBERATELY IGNORED here. Round-1 experiments found it systematically

package/build/recommendation/planRanker.js

@@ -1,5 +1,6 @@
 import { CATEGORY_PRIORITY, PriorityTier } from "../types/TestRecommendation.js";
 import { diversityBalancedBudgeter } from "./budgeters/diversityBalancedBudgeter.js";
+import { parseRouteLine, normalizeDiffPath } from "../utils/routeParsers.js";
 const PRIORITY_RANK = {
     CRITICAL: 0,
     HIGH: 1,
@@ -19,9 +20,12 @@ const DEFAULT_CARVE_OUT_CATEGORIES = Object.keys(CATEGORY_PRIORITY).filter((cate
  *   2. Verified discriminators — candidates whose declared discriminator survived
  *      `validateDiscriminator` (marked via `verifiedDiscriminator`) float ahead of
  *      unverified peers in the same tier.
- *   3. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
+ *   3. Diff-hunk proximity — candidates referencing a method+path that appears
+ *      on an actual changed diff line float ahead of same-tier candidates that
+ *      don't (SKYR-4026). Only applied when `opts.diffText` is supplied.
+ *   4. `CATEGORY_PRIORITY` mapped over `scenario.category` (CRITICAL > HIGH >
  *      MEDIUM > LOW).
- *   4. Stable tiebreak on `candidateId` for determinism.
+ *   5. Stable tiebreak on `candidateId` for determinism.
  *
  * IMPORTANT: the agent-supplied `priority` field (`scenario.priority`) is
  * DELIBERATELY IGNORED here. Round-1 experiments found it systematically
@@ -32,7 +36,11 @@ const DEFAULT_CARVE_OUT_CATEGORIES = Object.keys(CATEGORY_PRIORITY).filter((cate
  */
 export function rankCandidates(candidates, opts = {}) {
     const carveOutSet = new Set(opts.carveOutCategories ?? DEFAULT_CARVE_OUT_CATEGORIES);
-    return [...candidates].sort((a, b) => compareRank(a, b, carveOutSet));
+    const changedRoutes = opts.diffText ? collectChangedRouteLines(opts.diffText) : [];
+    const onHunk = new Set(candidates
+        .filter((c) => scenarioOnChangedHunk(c.scenario, changedRoutes))
+        .map((c) => c.candidateId));
+    return [...candidates].sort((a, b) => compareRank(a, b, carveOutSet, onHunk));
 }
 /**
  * Convenience composition: rank the candidates, split GENERATE vs ADDITIONAL via
@@ -42,11 +50,11 @@ export function rankCandidates(candidates, opts = {}) {
  * passing the failed claims through `ctx.demotions`.
  */
 export function selectPlan(candidates, ctx, opts = {}) {
-    const ranked = rankCandidates(candidates, opts);
+    const ranked = rankCandidates(candidates, { ...opts, diffText: opts.diffText ?? ctx.diffText });
     const result = diversityBalancedBudgeter.select(ranked, ctx);
     return { ...result, demotions: ctx.demotions ?? [] };
 }
-function compareRank(a, b, carveOutSet) {
+function compareRank(a, b, carveOutSet, onHunk) {
     const carveA = carveOutSet.has(a.scenario?.category) ? 0 : 1;
     const carveB = carveOutSet.has(b.scenario?.category) ? 0 : 1;
     if (carveA !== carveB)
@@ -55,6 +63,10 @@ function compareRank(a, b, carveOutSet) {
     const verifiedB = b.verifiedDiscriminator ? 0 : 1;
     if (verifiedA !== verifiedB)
         return verifiedA - verifiedB;
+    const hunkA = onHunk.has(a.candidateId) ? 0 : 1;
+    const hunkB = onHunk.has(b.candidateId) ? 0 : 1;
+    if (hunkA !== hunkB)
+        return hunkA - hunkB;
     const catRankA = categoryRank(a);
     const catRankB = categoryRank(b);
     if (catRankA !== catRankB)
@@ -65,3 +77,62 @@ function categoryRank(candidate) {
     const tier = CATEGORY_PRIORITY[candidate.scenario?.category] ?? PriorityTier.LOW;
     return PRIORITY_RANK[tier];
 }
+/**
+ * Extract method+path from every changed (`+`/`-`, non-header) line of a raw
+ * unified diff. Reuses `parseRouteLine`, which already strips the leading
+ * `+`/`-` marker and matches the same route-decorator patterns the endpoint
+ * scanner does.
+ */
+function collectChangedRouteLines(diffText) {
+    const routes = [];
+    let currentFile = "";
+    for (const line of diffText.split("\n")) {
+        // Track the current file from the unified-diff header so parseRouteLine
+        // gets the real path — its UI-component guard (UI_COMPONENT_EXT) depends
+        // on it, or a route-shaped line inside a .tsx/.jsx file (e.g. a client
+        // router registration) gets misparsed as a changed backend route.
+        if (line.startsWith("+++ ")) {
+            const spec = line.slice(4).trim().split("\t")[0];
+            currentFile = spec === "/dev/null" ? "" : normalizeDiffPath(spec);
+            continue;
+        }
+        if (line.startsWith("--- ") || line.startsWith("diff --git") || line.startsWith("index "))
+            continue;
+        if (!(line.startsWith("+") || line.startsWith("-")))
+            continue;
+        const parsed = parseRouteLine(line, currentFile);
+        if (parsed)
+            routes.push({ method: parsed.method, path: parsed.path });
+    }
+    return routes;
+}
+/**
+ * Whether any step of `scenario` targets a method+path on the changed hunk.
+ * Diff-extracted paths are local to the file's own router declaration (e.g.
+ * "/suggestions"); scenario step paths are fully mounted (e.g.
+ * "/api/recipes/suggestions") once drafted from a scanned/recovered endpoint.
+ * A local path matches when the step path ends with it, so the cross-file
+ * mount prefix difference (see recoverRemovedEndpointsFromBase, SKYR-4026)
+ * doesn't prevent the match.
+ */
+function scenarioOnChangedHunk(scenario, changedRoutes) {
+    if (changedRoutes.length === 0)
+        return false;
+    for (const step of scenario.steps ?? []) {
+        const stepMethod = (step.method ?? "").toUpperCase();
+        const stepPath = (step.path ?? "").replace(/\/+$/, "");
+        for (const route of changedRoutes) {
+            if (route.method.toUpperCase() !== stepMethod)
+                continue;
+            const routePath = route.path.replace(/\/+$/, "");
+            if (routePath === "") {
+                if (stepPath === "" || stepPath === "/")
+                    return true;
+                continue;
+            }
+            if (stepPath === routePath || stepPath.endsWith(routePath))
+                return true;
+        }
+    }
+    return false;
+}

package/build/resources/testbotResource.js

@@ -2,7 +2,8 @@ import { ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { logger } from "../utils/logger.js";
 import { AnalyticsService } from "../services/AnalyticsService.js";
 import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS, } from "../prompts/test-recommendation/recommendationSections.js";
-import { getTestbotPrompt, readWorkspaceServices, parseRelatedRepositories, } from "../prompts/testbot/testbot-prompts.js";
+import { getTestbotPrompt, parseRelatedRepositories, } from "../prompts/testbot/testbot-prompts.js";
+import { readWorkspaceServices } from "../prompts/prompt-utils.js";
 export function registerTestbotResource(server) {
     logger.info("Registering testbot resource");
     // RFC 6570 {+rest} (reserved expansion) captures the entire query string

package/build/services/AnalyticsService.d.ts

@@ -1,7 +1,7 @@
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 export declare class AnalyticsService {
     static pushTestGenerationToolEvent(toolName: string, result: CallToolResult, params: Record<string, any>): Promise<void>;
-    static pushMCPToolEvent(toolName: string, result: CallToolResult | undefined, params: Record<string, string>): Promise<void>;
+    static pushMCPToolEvent(toolName: string, result: CallToolResult | undefined, params: Record<string, any>): Promise<void>;
     /**
      * Track server crash events
      */

package/build/services/TestExecutionService.d.ts

@@ -1,5 +1,6 @@
 import { TestExecutionResult, BatchExecutionResult, TestExecutionOptions, ProgressCallback } from "../types/TestExecution.js";
-export declare const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.36";
+import { EXECUTOR_DOCKER_IMAGE } from "../utils/versions.js";
+export { EXECUTOR_DOCKER_IMAGE };
 export declare const PLAYWRIGHT_CONFIG_FILES: string[];
 export declare const EXCLUDED_MOUNT_ITEMS: string[];
 export declare const TEST_REPO_CONTAINER_SUBDIR = ".skyramp-test-repo";

package/build/services/TestExecutionService.js

@@ -9,11 +9,11 @@ import { logger } from "../utils/logger.js";
 import { TestExecutionStatus, } from "../types/TestExecution.js";
 import { TestType } from "../types/TestTypes.js";
 import { buildContainerEnv } from "./containerEnv.js";
-import { SKYRAMP_IMAGE_VERSION } from "../utils/versions.js";
+import { EXECUTOR_DOCKER_IMAGE } from "../utils/versions.js";
 import { walkDir } from "../utils/fileWalk.js";
+export { EXECUTOR_DOCKER_IMAGE };
 const DEFAULT_TIMEOUT = 300000; // 5 minutes
 const MAX_CONCURRENT_EXECUTIONS = 5;
-export const EXECUTOR_DOCKER_IMAGE = `skyramp/executor:${SKYRAMP_IMAGE_VERSION}`;
 const DOCKER_PLATFORM = "linux/amd64";
 const EXECUTION_PROGRESS_INTERVAL = 10000; // 10 seconds between progress updates during execution
 // Temp file with valid empty JSON — used instead of /dev/null for .json config files
@@ -565,10 +565,15 @@ export class TestExecutionService {
             testFilePath,
             options.testType,
         ];
+        const networkMode = options.dockerNetwork?.trim()
+            ? options.dockerNetwork.trim()
+            : options.useHostNetwork && process.platform === "linux"
+                ? "host"
+                : undefined;
         // Prepare host config with mounts
         const hostConfig = {
             ExtraHosts: ["host.docker.internal:host-gateway"],
-            ...(options.useHostNetwork && process.platform === "linux" ? { NetworkMode: "host" } : {}),
+            ...(networkMode ? { NetworkMode: networkMode } : {}),
             Mounts: [
                 {
                     Type: "bind",

package/build/services/TestGenerationService.d.ts

@@ -1,6 +1,6 @@
 import { SkyrampClient } from "@skyramp/skyramp";
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { TestType } from "../types/TestTypes.js";
+import { TestType, MOCK_TYPE } from "../types/TestTypes.js";
 export interface BaseTestParams {
     endpointURL?: string;
     method?: string;
@@ -50,7 +50,7 @@ export declare abstract class TestGenerationService {
     generateTest(params: BaseTestParams & Record<string, any>): Promise<CallToolResult>;
     protected validateInputs(params: BaseTestParams): CallToolResult;
     protected abstract buildGenerationOptions(params: BaseTestParams & Record<string, any>): any;
-    protected abstract getTestType(): TestType;
+    protected abstract getTestType(): TestType | typeof MOCK_TYPE;
     protected handleApiAnalysis(params: BaseTestParams): Promise<CallToolResult | null>;
     private static readonly STANDARD_HEADERS;
     private static simpleWildcardMatch;

package/build/services/TestGenerationService.js

@@ -2,10 +2,11 @@ import path from "path";
 import fs from "fs";
 import { SkyrampClient } from "@skyramp/skyramp";
 import { analyzeOpenAPIWithGivenEndpoint } from "../utils/analyze-openapi.js";
-import { isAuthorizationHeaderName, KNOWN_AUTH_HEADERS, getWorkspaceAuthConfig, getDefaultAuthHeader, getAuthScheme, WorkspaceAuthType, getWorkspaceSkipTLSVerify, } from "../utils/workspaceAuth.js";
+import { isAuthorizationHeaderName, KNOWN_AUTH_HEADERS, resolveAuthFromWorkspace, getWorkspaceSkipTLSVerify, getWorkspaceDefaultQueryParams, mergeQueryParamsString, } from "../utils/workspaceAuth.js";
 import { getPathParameterValidationError, OUTPUT_DIR_FIELD_NAME, PATH_PARAMS_FIELD_NAME, QUERY_PARAMS_FIELD_NAME, FORM_PARAMS_FIELD_NAME, validateParams, validatePath, validateRequestData, } from "../utils/utils.js";
 import { getEntryPoint } from "../utils/telemetry.js";
 import { getLanguageSteps } from "../utils/language-helper.js";
+import { TestType } from "../types/TestTypes.js";
 import { logger } from "../utils/logger.js";
 import { normalizeLanguageParams } from "../utils/normalizeParams.js";
 import { stageGeneratedPaths, resolveOutputDir } from "../utils/gitStaging.js";
@@ -24,6 +25,19 @@ export function deriveEffectiveFramework(language, framework) {
     const lang = (language ?? "").trim().toLowerCase();
     return lang === "typescript" || lang === "javascript" ? "playwright" : "";
 }
+/**
+ * Test types whose generation is driven by a recorded Playwright trace, not a
+ * live query-string request the same way contract/fuzz/smoke/load/integration
+ * are. Their schemas (uiTestSchema, e2eTestSchema) don't expose a queryParams
+ * field at all, so there's no way for a caller to override or even know this
+ * field exists — injecting an unrequested, uneditable workspace
+ * defaultQueryParams value into that path is not what the design intends
+ * (SKYR-4050).
+ */
+const SKIP_DEFAULT_QUERY_PARAMS_TEST_TYPES = new Set([
+    TestType.UI,
+    TestType.E2E,
+]);
 export class TestGenerationService {
     client;
     constructor() {
@@ -316,29 +330,15 @@ The generated test file remains unchanged and ready to use as-is.
     async executeGeneration(generateOptions) {
         try {
             // Auto-resolve auth from workspace config when authHeader was not explicitly provided.
-            // undefined = omit (auto-resolve); "" = explicit skip-auth for unauthenticated endpoints.
+            // undefined = auto-resolve; "" = caller explicitly said skip-auth.
             if (generateOptions.authHeader === undefined) {
                 try {
                     const repoPath = generateOptions.outputDir || process.cwd();
-                    const wsAuth = await getWorkspaceAuthConfig(repoPath);
-                    let resolvedHeader = wsAuth.authHeader ?? getDefaultAuthHeader(wsAuth.authType);
-                    if (!resolvedHeader && wsAuth.authScheme !== undefined) {
-                        resolvedHeader = "Authorization";
-                    }
-                    if (wsAuth.authType === WorkspaceAuthType.ApiKey && !resolvedHeader) {
-                        logger.warning("workspace.yml has authType: apiKey but no authHeader is set — " +
-                            "requests will be sent without an auth header and will likely receive 401/403. " +
-                            "Add authHeader: <X-Your-Key-Header> to .skyramp/workspace.yml.");
-                    }
-                    if (resolvedHeader && wsAuth.authType !== WorkspaceAuthType.None) {
-                        logger.info("authHeader not provided — resolved from workspace config", {
-                            authHeader: resolvedHeader,
-                            authType: wsAuth.authType,
-                        });
-                        generateOptions.authHeader = resolvedHeader;
-                        if (isAuthorizationHeaderName(resolvedHeader)) {
-                            generateOptions.authScheme =
-                                generateOptions.authScheme ?? wsAuth.authScheme ?? getAuthScheme(wsAuth.authType);
+                    const resolved = await resolveAuthFromWorkspace(repoPath, generateOptions.authHeader, generateOptions.authScheme);
+                    if (resolved) {
+                        generateOptions.authHeader = resolved.authHeader;
+                        if (resolved.authScheme !== undefined) {
+                            generateOptions.authScheme = resolved.authScheme;
                         }
                     }
                 }
@@ -364,6 +364,24 @@ The generated test file remains unchanged and ready to use as-is.
                     logger.warning("Could not resolve skipTLSVerify from workspace config");
                 }
             }
+            // Workspace-declared default query params (SKYR-4050): api.defaultQueryParams
+            // are attached to every generated request for the service. Existing
+            // queryParams entries (explicit caller values) always win on a key collision.
+            if (!SKIP_DEFAULT_QUERY_PARAMS_TEST_TYPES.has(this.getTestType())) {
+                try {
+                    const repoPath = generateOptions.outputDir || process.cwd();
+                    const defaults = await getWorkspaceDefaultQueryParams(repoPath);
+                    if (defaults) {
+                        generateOptions.queryParams = mergeQueryParamsString(generateOptions.queryParams, defaults);
+                        logger.info("Merged workspace defaultQueryParams into queryParams", {
+                            keys: Object.keys(defaults),
+                        });
+                    }
+                }
+                catch {
+                    logger.warning("Could not resolve default query params from workspace config");
+                }
+            }
             if (generateOptions.traceFilePath) {
                 const traceAuth = this.extractAuthFromTrace(generateOptions.traceFilePath, generateOptions.generateInclude, generateOptions.generateExclude);
                 if (traceAuth) {

package/build/services/containerEnv.js

@@ -14,7 +14,9 @@ export function rewriteLocalhostForDocker(url) {
  */
 export function buildContainerEnv(options, saveStoragePath, hostEnv = process.env) {
     const env = [
-        `SKYRAMP_TEST_TOKEN=${options.token || ""}`,
+        // Omit entirely when empty so os.getenv() returns None in the test —
+        // unauthenticated endpoints won't send an empty auth header (E7).
+        ...(options.token ? [`SKYRAMP_TEST_TOKEN=${options.token}`] : []),
         "SKYRAMP_IN_DOCKER=true",
     ];
     // Skyramp-generated tests are standalone HTTP tests that never need host repo

package/build/tool-phases.js

@@ -11,6 +11,9 @@ export const TOOL_PHASE_MAP = {
     skyramp_ui_test_generation: "generating",
     skyramp_batch_scenario_test_generation: "generating",
     skyramp_mock_generation: "generating",
+    skyramp_batch_mock_generation: "generating",
+    skyramp_generate_enriched_integration_test: "generating",
+    skyramp_enrich_test_with_mocks: "generating",
     skyramp_execute_test: { before: "maintaining", after: "executing" },
     skyramp_run_existing_tests: { before: "maintaining", after: "executing" },
     skyramp_analyze_test_health: "maintaining",
@@ -31,6 +34,7 @@ export const TOOLS_WITHOUT_PHASE = new Set([
     "skyramp_init_scan",
     "skyramp_init_workspace",
     "skyramp_one_click_tool",
+    "skyramp_setup_local_dev_worker",
     "skyramp_actions",
     "skyramp_start_trace_collection",
     "skyramp_stop_trace_collection",
@@ -38,4 +42,6 @@ export const TOOLS_WITHOUT_PHASE = new Set([
     "skyramp_modularization",
     "skyramp_reuse_code",
     "skyramp_enhance_assertions",
+    "skyramp_preflight_mock_check",
+    "skyramp_query_proxy_mocks",
 ]);