@skyramp/mcp 0.3.2-rc.pom-4 → 0.3.2

package/build/prompts/test-maintenance/drift-analysis-prompt.js

@@ -2,6 +2,53 @@ import { buildActionDecisionTree, buildCheckAdditiveFields, buildCheckEndpointEx
 import { buildUiActionDecisionTree, buildUiCheckRouteExistence, buildUiCheckSelectors, buildUiCheckPageObjects, buildUiCheckBehavioralChanges, buildUiCheckAssignAction, buildUiDriftOutputChecklist, } from "./uiDriftAnalysisSections.js";
 import { RECOMMENDATIONS_INSTRUCTION, buildSymbolDiscoveryStep } from "./driftAnalysisShared.js";
 import { PromptPlan } from "../test-recommendation/promptPlan.js";
+/**
+ * Render CONFIRMED failing tests from prior external-exec runs, plus the §4.5
+ * intent rules that gate whether a confirmed failure becomes an edit. Only
+ * environment-healthy CONFIRM runs count — a wall of red from a broken env is
+ * NOT PR signal. Returns "" when there is nothing confirmed (so the drift
+ * prompt is unchanged when external execution didn't run or found no failures).
+ */
+export function buildConfirmedFailuresSection(externalTestResults) {
+    if (!externalTestResults?.length)
+        return "";
+    const confirmed = externalTestResults
+        .filter((r) => r.mode === "confirm" && r.environmentHealthy && !r.skipped)
+        .flatMap((r) => r.results.filter((t) => t.status === "fail" || t.status === "error"));
+    if (confirmed.length === 0)
+        return "";
+    const seen = new Set();
+    const unique = confirmed.filter((t) => {
+        if (seen.has(t.testId))
+            return false;
+        seen.add(t.testId);
+        return true;
+    });
+    // Escape angle brackets / ampersands so run output (message/file/testId) can't
+    // break out of the <confirmed_failures> section or inject pseudo-tags.
+    const esc = (s) => s.replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c]);
+    const rows = unique
+        .map((t) => {
+        const msg = t.message
+            ? `: ${esc(t.message.slice(0, 200).replace(/\s+/g, " ").trim())}`
+            : "";
+        return `- \`${esc(t.file)}\` — ${esc(t.testId)} [${t.status}]${msg}`;
+    })
+        .join("\n");
+    return `<confirmed_failures>
+These tests were RUN and CONFIRMED failing under this change (facts, not diff guesses) — treat them as ground truth for WHICH tests broke. \`error\` = failed at fixture/collection (never reached its assertions); \`fail\` = assertion failure.
+
+${rows}
+</confirmed_failures>
+
+<confirmed_failure_intent_rules>
+A confirmed failure is NOT automatically a test to UPDATE. Before editing ANY confirmed-failing test, classify the breakage:
+- Intended behavior change (PR title/description/linked issue say so and the change is coherent across the codebase) → UPDATE the test, preserving what it ASSERTS (never gut assertions to force green).
+- Unintended or incomplete (the PR broke behavior users depend on, or a consumer wasn't updated) → do NOT edit the test; record the confirmed failure in \`issuesFound\` with the evidence. Editing it green would launder a real regression into a passing suite — the worst outcome.
+- Ambiguous → fix conservatively and flag the intent question in the report.
+This classification is a precondition for any edit to a confirmed-failing test.
+</confirmed_failure_intent_rules>`;
+}
 const _apiPlan = new PromptPlan()
     .addPhase("maintenance", "Test Maintenance Assessment", {
     headerLevel: "##",
@@ -35,7 +82,7 @@ const _uiPlan = new PromptPlan()
  * - ui: when provided, appends a UI drift section for component/browser tests.
  *   Omit when no frontend files changed or no UI tests exist.
  */
-export function buildDriftAnalysisPrompt(stateFile, apiTests, ui, repoPaths) {
+export function buildDriftAnalysisPrompt(stateFile, apiTests, ui, repoPaths, externalTestResults) {
     const parts = [];
     // Emit symbol discovery once at the top regardless of how many sections follow.
     // Placing it inside each plan's checklist caused duplication on mixed diffs.
@@ -43,6 +90,12 @@ export function buildDriftAnalysisPrompt(stateFile, apiTests, ui, repoPaths) {
     const discovery = buildSymbolDiscoveryStep(hasAnyTests, repoPaths);
     if (discovery)
         parts.push(discovery);
+    // Fold in RUN-CONFIRMED failures (external execution) so the agent reasons over
+    // facts, not diff guesses — with the §4.5 intent gate. No-op when external
+    // execution didn't run or found nothing (keeps the static path unchanged).
+    const confirmedFailures = buildConfirmedFailuresSection(externalTestResults);
+    if (confirmedFailures)
+        parts.push(confirmedFailures);
     // Include API drift when there are API tests, or when UI drift is not running
     // (ensures skyramp_actions is always reachable even if apiTests is empty).
     if (apiTests.length > 0 || !ui) {

package/build/prompts/test-recommendation/analysisOutputPrompt.js

@@ -288,11 +288,11 @@ The ranked test recommendation catalog is pre-built and shown below (after the s
 **If** Steps 1–2 revealed additional scenarios the catalog does not cover (e.g. a computed formula or foreign-key relationship that was missed), you may optionally call \`skyramp_recommend_tests\` with \`stateFile: "${p.stateFile ?? p.sessionId}"\` and \`enrichedScenarios\` to regenerate a more complete catalog — but only after presenting the current one.`;
         const hasJavaFiles = p.candidateRouteFiles?.some((f) => /\.(java|kt)$/.test(f)) ?? false;
         const routeFilesSection = p.candidateRouteFiles && p.candidateRouteFiles.length > 0
-            ? `\nRoute/controller files found by static scan (read these to discover endpoints — the regex-based catalog below may be incomplete for your framework):\n${p.candidateRouteFiles.map((f) => `- ${f}`).join("\n")}\n`
+            ? `\nCandidate route/controller files for LLM inspection (read these to discover endpoints; static parser output is only a hint):\n${p.candidateRouteFiles.map((f) => `- ${f}`).join("\n")}\n`
             : "";
         const resolvePathsNote = p.routerMountContext.length
-            ? `**Resolve nested paths** using your Step ${ANALYSIS_STEP_RESOLVE_PATHS} table — a router in the table with prefix \`/api/v1/products/{product_id}/reviews\` means every endpoint in that file lives under that full path.`
-            : `**Resolve full paths** using the prefixes you identified in Step ${ANALYSIS_STEP_READ_FILES} (e.g. Java Spring class-level \`@RequestMapping\` prefix + method-level path).`;
+            ? `**Resolve nested paths** using your Step ${ANALYSIS_STEP_RESOLVE_PATHS} table. The table you build from source/router context is authoritative over static parser hints.`
+            : `**Resolve full paths** using the prefixes, mounts, annotations, decorators, or routing DSL you identify in Step ${ANALYSIS_STEP_READ_FILES}.`;
         return `## Your Task — Fill in and Present the Catalog (full repo)
 
 ### Step ${ANALYSIS_STEP_READ_FILES}: Read key files
@@ -335,36 +335,28 @@ ${p.routerFileContents?.length
                 p.routerMountContext.map((f) => `- \`${f}\``).join("\n")}`
         : "";
     const enrichment = buildEnrichmentInstructions(p);
-    // LLM fallback: when heuristic scanning may have missed backend route files.
-    const scannerFallbackHasCatalog = p.scannedEndpoints.length > 0;
-    const scannerFallbackReason = scannerFallbackHasCatalog
-        ? "The heuristic endpoint scanner may have missed route/controller files in this diff, even though endpoint data is present from another source"
-        : "The heuristic endpoint scanner found **0 endpoints**";
-    const scannerFallbackInstruction = scannerFallbackHasCatalog
-        ? "Treat this as a supplemental gap check: merge only HTTP endpoints that are visibly missing from the existing catalog/spec data, and keep the existing catalog as the primary endpoint source."
-        : "Build a table of discovered endpoints (method, full path, source file) and use it as the authoritative endpoint list for all subsequent steps.";
-    const llmFallbackSection = (isDiffScope || p.scannedEndpoints.length === 0) &&
-        p.candidateRouteFiles &&
-        p.candidateRouteFiles.length > 0
+    const staticHintCount = p.scannedEndpoints.length;
+    const routeDiscoverySection = isDiffScope ||
+        staticHintCount > 0 ||
+        (p.candidateRouteFiles?.length ?? 0) > 0
         ? `
-## Scanner Fallback — Manual Endpoint Discovery Required
+## LLM Route Discovery Inputs
 
-${scannerFallbackReason}, and this repository contains ${p.candidateRouteFiles.length} file(s) that appear to define HTTP routes. The scanner likely failed due to multi-line definitions, framework-specific patterns, indirection the regex does not cover, or endpoint data being supplied by an OpenAPI spec instead of source scanning.
+Static endpoint scan results are **best-effort hints only**. Do not assume the scanner supports this repository's language, framework, routing DSL, or helper abstractions.
 
-**Read the following controller/router files and identify all HTTP route registrations (method + path).** Include these discovered endpoints when executing the steps above.
+${staticHintCount > 0 ? `Static hints available: ${staticHintCount}. Verify every hinted method/path against source before using it.` : "Static hints available: 0. Build the endpoint list from source, router context, spec, and diff."}
 
-${p.candidateRouteFiles.slice(0, 15).map((f) => `- \`${f}\``).join("\n")}
-${p.candidateRouteFiles.length > 15 ? `\n_(${p.candidateRouteFiles.length - 15} more files not shown)_` : ""}
+${p.candidateRouteFiles && p.candidateRouteFiles.length > 0
+            ? `Candidate files to inspect:\n${p.candidateRouteFiles
+                .slice(0, 15)
+                .map((f) => `- \`${f}\``)
+                .join("\n")}${p.candidateRouteFiles.length > 15 ? `\n_(${p.candidateRouteFiles.length - 15} more files not shown)_` : ""}`
+            : staticHintCount > 0
+                ? "Candidate files to inspect: none identified by static scanning. Verify the static hints against their source files, changed files, router context, and specs above."
+                : "Candidate files to inspect: use the changed files and routing entry-point files above."}
 
-For each file, look for:
-- Express/Fastify/Koa/Hapi: \`router.<method>('/path', ...)\` or \`app.<method>('/path', ...)\`
-- FastAPI/Flask: \`@router.<method>('/path')\` or \`@app.route('/path', ...)\`
-- Spring/NestJS: \`@GetMapping\`, \`@PostMapping\`, \`@Controller\`, etc.
-- Go (Gin/Echo/Chi): \`r.GET("/path", ...)\`, \`r.Group("/prefix")\`
-- GraphQL: schema/resolver artifacts are unsupported for REST test generation; do not invent REST endpoints from them
-- Any other framework-specific route registration pattern
-
-${scannerFallbackInstruction}`
+For each candidate file, infer route registrations from the source's actual framework or DSL. Record method, full path, and source file. Resolve mount prefixes through the routing entry-point files. If a file is GraphQL-only, do not invent REST endpoints from it.
+`
         : "";
     return `# Repository Analysis
 
@@ -373,7 +365,7 @@ ${scannerFallbackInstruction}`
 **Analysis Scope**: \`${p.analysisScope}\`
 ${isDiffScope ? `**Diff endpoints**: ${(p.parsedDiff?.newEndpoints.length ?? 0) + (p.parsedDiff?.modifiedEndpoints.length ?? 0) + (p.parsedDiff?.removedEndpoints?.length ?? 0)}` : `**Pre-scanned endpoints**: ${p.scannedEndpoints.length}`}
 ${routerSection}
-${llmFallbackSection}
+${routeDiscoverySection}
 ${enrichment}
 
 **CRITICAL**: No .json/.md file creation. Prioritize cross-resource workflows.`;

package/build/prompts/test-recommendation/scopeAssessment.d.ts

@@ -54,8 +54,11 @@ export declare function isTestFile(filePath: string): boolean;
 /**
  * Builds the PR scope assessment section.
  *
- * When `precomputedUIPct` is provided (0 = backend-only, 100 = UI-only) the server
- * has already determined the split unambiguously — skip Steps A–C and emit one line.
+ * When `precomputedUIPct` is provided (0 = backend-only, 100 = UI-only) the server has
+ * already determined the split unambiguously, so Steps A–C are skipped. Backend-only
+ * (0) renders a single Budget Plan line; UI-only (100) renders that line plus the
+ * zero-new-surface override (SKYR-4099), because the budget is a default there rather
+ * than a mandate and a diff that adds no new surface must be able to abstain.
  *
  * For mixed PRs (`precomputedUIPct` is undefined, `hasFrontendChanges` is true) skip
  * Steps A–C but keep Step D so the LLM can apply judgment to determine the UI%.

package/build/prompts/test-recommendation/scopeAssessment.js

@@ -188,11 +188,77 @@ export function isTestFile(filePath) {
         /(?:^|\/)__tests__\//.test(filePath));
 }
 // ── LLM scope assessment ──────────────────────────────────────────────────────
+/**
+ * The zero-new-surface abstention rule, shared by every branch that can see a frontend
+ * diff (SKYR-4099).
+ *
+ * It previously existed only on the mixed-PR branch, so a frontend-ONLY diff — which
+ * takes the precomputed branch — had no sanctioned path to zero tests and the agent
+ * generated unnecessary UI tests while stating in its own reasoning that the change was
+ * cosmetic. Two copies then meant two definitions, and the mixed-PR one carved out
+ * "changes that alter visibility, layout, or state", which classifies a spacing-token
+ * change as non-cosmetic and made the override inert for exactly the diffs it should
+ * catch. One definition, both branches.
+ *
+ * Scoped to match `testbot-prompts.ts`'s "Do not fabricate tests outside the GENERATE
+ * list", which names three zero-test cases — deletion-only, cosmetic, and
+ * modification-of-existing-with-no-new-surface — under one principle: a new spec covers
+ * NEW observable surface only. An earlier revision of this section implemented cosmetic
+ * alone, and its keep-the-budget list contradicted the other two (an element being
+ * removed, or a `data-testid` being renamed, both forced the budget to stand). The test
+ * is coverage, not the kind of edit: does an existing test already reach this surface?
+ *
+ * `skipClause` is appended to the opening paragraph: the mixed-PR branch has a UI%
+ * step that becomes irrelevant once the budget is 0, the precomputed branch does not.
+ */
+/**
+ * The zero-new-surface abstention rule, shared by every branch that can see a frontend
+ * diff (SKYR-4099).
+ *
+ * It previously existed only on the mixed-PR branch, so a frontend-ONLY diff — which
+ * takes the precomputed branch — had no sanctioned path to zero tests and the agent
+ * generated unnecessary UI tests while stating in its own reasoning that the change was
+ * cosmetic. Two copies then meant two definitions, and the mixed-PR one carved out
+ * "changes that alter visibility, layout, or state", which classifies a spacing-token
+ * change as non-cosmetic and made the override inert for exactly the diffs it should
+ * catch. One definition, both branches.
+ *
+ * Scoped to match `testbot-prompts.ts`'s "Do not fabricate tests outside the GENERATE
+ * list", which names three zero-test cases — deletion-only, cosmetic, and
+ * modification-of-existing-with-no-new-surface — under one principle: a new spec covers
+ * NEW observable surface only. The test is coverage, not the kind of edit: does an
+ * existing test already reach this surface?
+ *
+ * `skipClause` is appended to the opening paragraph: the mixed-PR branch has a UI% step
+ * that becomes irrelevant once the budget is 0, the precomputed branch does not.
+ */
+function zeroSurfaceSection(skipClause = "") {
+    return `**Zero-new-surface override:** The total above is a default, not a mandate. A new spec exists to cover **new observable surface** — a component, route, page or flow that no existing test reaches. If your code review finds the diff adds none, set your Budget Plan to **0 total** and abstain — recommend and generate zero tests${skipClause}.
+
+Abstain — the diff adds no new surface:
+- **Cosmetic.** A styling-only value change (a spacing, size, color or font token, or a utility class swap such as \`size-4\`→\`size-5\`), or a \`.css\`/\`.scss\` reformat (property reordering, comment or whitespace edits, \`0px\`→\`0\`).
+- **Deletion-only.** A component, route, element or feature was removed. The work is DELETING the tests that covered it — a removed surface cannot be the subject of a new spec.
+- **Modification of an already-covered surface.** A renamed or moved selector, \`data-testid\`, \`aria-*\` or role; changed copy; an added field; a reordered or conditionally hidden element — where an existing test already reaches it. The work is UPDATING that test in place.
+
+Keep the budget only for surface no existing test covers:
+- A newly added component, route, page or flow.
+- A component that was previously unintegrated and now has an integration point.
+- New interactive behavior, state or validation on a surface no existing test reaches.
+
+Two things that are NOT evidence of new surface: a frontend file appearing in the diff, and a large diff. Judge by whether an existing test already reaches the changed surface.
+
+With a 0-total Budget Plan the work this diff needs is maintenance of the tests that already cover the affected surface — update the ones whose selectors or copy moved, and delete the ones that covered something this diff removed. Do NOT add a spec asserting that a removed feature is absent: the tests that covered it are the ones to delete, and an "is not present" assertion breaks the next time an unrelated sibling element changes.
+
+If nothing currently covers the changed surface, there is no maintenance to do — and still no new spec to write, because a test added now would assert behavior this diff did not change. The missing coverage is a pre-existing gap, not something this PR introduced. Record it in \`additionalRecommendations\` in recommendatory voice ("would verify …") so the gap is visible without claiming a test was written.`;
+}
 /**
  * Builds the PR scope assessment section.
  *
- * When `precomputedUIPct` is provided (0 = backend-only, 100 = UI-only) the server
- * has already determined the split unambiguously — skip Steps A–C and emit one line.
+ * When `precomputedUIPct` is provided (0 = backend-only, 100 = UI-only) the server has
+ * already determined the split unambiguously, so Steps A–C are skipped. Backend-only
+ * (0) renders a single Budget Plan line; UI-only (100) renders that line plus the
+ * zero-new-surface override (SKYR-4099), because the budget is a default there rather
+ * than a mandate and a diff that adds no new surface must be able to abstain.
  *
  * For mixed PRs (`precomputedUIPct` is undefined, `hasFrontendChanges` is true) skip
  * Steps A–C but keep Step D so the LLM can apply judgment to determine the UI%.
@@ -229,12 +295,18 @@ With a 0-total Budget Plan: generate zero tests, recommend zero tests, and follo
 
 **Exception — claim the ceiling only with evidence:** if your code review of the changed files shows an observable API behavior change the classifier missed (e.g. a DTO/serializer/service change that alters a response shape, a shared library/default-value or business-rule constant change that alters the behavior of an existing, unchanged endpoint (e.g. a default schedule, threshold, or config constant imported by a route handler elsewhere in the codebase), a deployment/config change that newly exposes or removes endpoints, or a schema-defined API contract change — a CRD type/kubebuilder validation marker, GraphQL schema, or gRPC proto edit that adds, removes, or re-validates what the server accepts or returns), raise your Budget Plan to cover exactly those affected endpoints, up to ${maxTotal} total (${effectiveGenerate} generate + ${additional} additional), 0% UI/E2E. Note: repositories whose entire API surface is schema-defined (e.g. a Kubernetes operator serving CRDs through the kube-apiserver) ALWAYS classify zero endpoints — for these, a schema change in the diff IS the endpoint change; evaluate this exception against the schema files instead of concluding there is nothing to test. Similarly, a changed file with zero classified endpoints is not by itself evidence of "no testable surface" — trace what imports the changed export (grep for its name) to check whether it feeds an existing endpoint's behavior before concluding the diff has no test value. Every test must name the changed file that justifies it. State your raised plan now in the canonical format — \`Budget Plan: <total> total (<generate> generate + <additional> additional), 0% UI/E2E\` — and use those exact numbers throughout the rest of the prompt; the raised generate count is your committed generate count.`;
     }
-    // Unambiguous backend-only or UI-only: emit a single Budget Plan line — no LLM counting needed.
+    // Unambiguous backend-only or UI-only: no LLM counting needed. Backend-only emits just
+    // the Budget Plan line; UI-only appends the zero-new-surface override (see below).
     if (precomputedUIPct !== undefined) {
+        const uiSuffix = precomputedUIPct > 0 ? `, ${precomputedUIPct}% UI/E2E` : "";
+        // Ordered ahead of the "use these exact numbers" line — that line reads as final, so
+        // an override printed after it cannot fire. Backend-only (precomputedUIPct === 0) has
+        // no frontend file to call cosmetic, so it gets no override.
+        const cosmeticOverride = precomputedUIPct > 0 ? `${zeroSurfaceSection()}\n\n` : "";
         return `### PR Scope Assessment
-Budget Plan: ${maxTotal} total (${effectiveGenerate} generate + ${additional} additional), ${precomputedUIPct}% UI/E2E
+Budget Plan: ${maxTotal} total (${effectiveGenerate} generate + ${additional} additional)${uiSuffix}
 
-Use these exact numbers throughout the rest of the prompt.`;
+${cosmeticOverride}Use these exact numbers throughout the rest of the prompt.`;
     }
     // Mixed PR: server can pre-compute the total but not the UI/E2E split — keep Step D.
     if (hasFrontendChanges) {
@@ -242,7 +314,7 @@ Use these exact numbers throughout the rest of the prompt.`;
 
 Budget Plan (total already determined): **${maxTotal} total (${effectiveGenerate} generate + ${additional} additional)**
 
-**Cosmetic-only override:** If, after code review, the entire diff is cosmetic with no observable rendering or interaction change (e.g. a \`.css\`/\`.scss\` reformat — property reordering, comment/whitespace edits, \`0px\`→\`0\`), the total above does NOT apply — set your Budget Plan to **0 total**, abstain (recommend and generate zero tests), and skip Step D below. A frontend file appearing in the diff is not, by itself, a behavior change. (Style changes that alter visibility, layout, or state are NOT cosmetic — keep the budget for those.)
+${zeroSurfaceSection(", and skip Step D below")}
 
 **Step D — Determine UI vs backend split for the budget above:**
 - Non-UI slots are backend tests; start from file-count ratio for UI%, then apply judgment:

package/build/prompts/test-recommendation/test-recommendation-prompt.js

@@ -178,6 +178,9 @@ Write UI recommendation \`reasoning\` fields in **natural prose** that names ele
         }
     }
     const fmtEndpoint = (m, ep) => `  ${m.method} ${ep.path}${m.authRequired ? " [auth]" : ""} (${(m.interactions ?? []).length} interactions)`;
+    // In diff scope, cap the reference endpoint list to prevent context overflow.
+    // Changed endpoints are always shown in full; only the "other" list is capped.
+    const DIFF_SCOPE_OTHER_ENDPOINT_CAP = 20;
     let endpointLines;
     if (isDiffScope && changedEndpointKeys.size > 0) {
         const changedLines = [];
@@ -201,7 +204,25 @@ Write UI recommendation \`reasoning\` fields in **natural prose** that names ele
                 changedLines.push(`  ${m.method} ${ep.path} [removed]`);
             }
         }
-        endpointLines = `**Likely changed in this PR (from static file→endpoint mapping — verify against diff in Step ${ANALYSIS_STEP_EXTRACT}):**\n${changedLines.join("\n") || "  none"}\n\n**Other endpoints (reference only):**\n${otherLines.join("\n") || "  none"}`;
+        const cappedOther = otherLines.slice(0, DIFF_SCOPE_OTHER_ENDPOINT_CAP);
+        const hiddenOtherCount = otherLines.length - cappedOther.length;
+        const otherSuffix = hiddenOtherCount > 0
+            ? `\n  ... and ${hiddenOtherCount} more (full endpoint list in state file)`
+            : "";
+        const otherLabel = hiddenOtherCount > 0
+            ? `Other endpoints (reference only, ${cappedOther.length} of ${otherLines.length} shown)`
+            : "Other endpoints (reference only)";
+        endpointLines = `**Likely changed in this PR (from static file→endpoint mapping — verify against diff in Step ${ANALYSIS_STEP_EXTRACT}):**\n${changedLines.join("\n") || "  none"}\n\n**${otherLabel}:**\n${cappedOther.join("\n") || "  none"}${otherSuffix}`;
+    }
+    else if (isDiffScope) {
+        // Diff scope but no changed endpoints detected — cap to avoid dumping the full catalog.
+        const allMethodLines = allEndpoints.flatMap((ep) => (ep.methods ?? []).map((m) => fmtEndpoint(m, ep)));
+        const cappedLines = allMethodLines.slice(0, DIFF_SCOPE_OTHER_ENDPOINT_CAP);
+        const hiddenCount = allMethodLines.length - cappedLines.length;
+        const suffix = hiddenCount > 0
+            ? `\n  ... and ${hiddenCount} more (full endpoint list in state file — trace changed files directly from the diff to find affected endpoints)`
+            : "";
+        endpointLines = `${cappedLines.join("\n") || "  none"}${suffix}`;
     }
     else {
         endpointLines = allEndpoints
@@ -230,9 +251,22 @@ Write UI recommendation \`reasoning\` fields in **natural prose** that names ele
         }
     }
     const { authSchemeSnippet } = getAuthSnippets(authHeaderValue, authTypeValue, workspaceAuthScheme);
+    const routeDiscovery = analysis.routeDiscovery;
+    const routeDiscoverySection = routeDiscovery
+        ? `
+## LLM Route Discovery Inputs
+Static endpoint data below is a best-effort hint, not a complete parser for every framework.
+Authoritative endpoint extraction must come from reading the changed source files, router/module context, OpenAPI paths when available, and the diff.
+Candidate files to inspect: ${routeDiscovery.candidateFiles.length > 0 ? routeDiscovery.candidateFiles.join(", ") : "none"}
+Router/module context files: ${routeDiscovery.routerMountContext.length > 0 ? routeDiscovery.routerMountContext.join(", ") : "none"}
+OpenAPI paths available: ${routeDiscovery.openApiPaths.length}
+Static hints available: ${routeDiscovery.staticHints.length}
+${routeDiscovery.diffFilePath ? `Diff file: ${routeDiscovery.diffFilePath}` : ""}
+`.trim()
+        : "";
     const sourcePriority = `
 ## Source Priority
-When information conflicts, prefer: **Traces** (actual behavior) > **Code** (implemented behavior) > **Spec/Docs** (documented behavior).
+When information conflicts, prefer: **Traces** (actual behavior) > **Source code read by the LLM** (implemented behavior) > **OpenAPI spec/docs** (documented behavior) > **Static parser hints** (best-effort, may be incomplete or framework-blind).
 `;
     // Compact fingerprint of tests already covering endpoints in this repo (Skyramp + external).
     // Re-derived fresh each run from test files on disk — no separate persistence needed.
@@ -274,8 +308,11 @@ Framework: ${analysis.projectClassification.primaryFramework} (${analysis.projec
 Project type: ${analysis.projectClassification.projectType}
 Auth: ${authMethod} (header: ${authHeaderValue}${authTypeValue ? `, type: ${authTypeValue}` : ""})
 Base URL: ${analysis.apiEndpoints.baseUrl}
-Candidate endpoints from static scan — unverified, confirm paths against spec or source before use (${analysis.apiEndpoints.totalCount}):
+Candidate endpoint hints from static scan — unverified and non-exhaustive; confirm paths by reading source/router context before use (${analysis.apiEndpoints.totalCount}):
 ${endpointLines}${testFingerprint}
+${routeDiscoverySection ? `
+
+${routeDiscoverySection}` : ""}
 `.trim();
     // ── Branch diff ──
     let diffSection = "";
@@ -295,7 +332,7 @@ Affected services: ${diffContext.affectedServices.join(", ") || "N/A"}
 
 Focus on tests that validate these changes and how they interact with existing resources.
 For removed endpoints: verify they now return 404 or the appropriate deprecation status code.
-Allocate your test budget to endpoints listed under "Likely changed in this PR". Use other endpoints only as setup steps (e.g. creating a resource before testing its deletion).
+Treat the endpoint lists above as static hints. If source/diff inspection finds a different changed endpoint set, prefer the source-grounded set and use other endpoints only as setup steps.
 `;
     }
     // ── Interactions ──

package/build/prompts/testbot/testbot-prompts.d.ts

@@ -17,10 +17,5 @@ export interface RelatedRepository {
 export declare function parseRelatedRepositories(raw: string | undefined): RelatedRepository[] | undefined;
 export declare function getTestbotPrompt(prTitle: string, prDescription: string, summaryOutputFile: string, repositoryPath: string, baseBranch?: string, maxRecommendations?: number, maxGenerate?: number, _maxCritical?: number, // Reserved — accepted for API compat but not yet wired into prompt
 prNumber?: number, userPrompt?: string, services?: Service[], uiCredentials?: string, testsRepoDir?: string, relatedRepositories?: RelatedRepository[], primaryRepo?: string, planOnly?: boolean, language?: string): string;
-/**
- * Read services from .skyramp/workspace.yml. Returns empty array if
- * the workspace file doesn't exist or can't be parsed.
- */
-export declare function readWorkspaceServices(repositoryPath: string): Promise<Service[]>;
 export declare function buildWorkspaceRecoveryPrefix(repositoryPath: string): string;
 export declare function registerTestbotPrompt(server: McpServer): void;