@skyramp/mcp 0.3.3 → 0.3.5

package/build/services/containerEnv.js

@@ -1,3 +1,4 @@
+import { logger } from "../utils/logger.js";
 /**
  * Rewrite localhost / 127.0.0.1 URLs to host.docker.internal so the Docker
  * executor container can reach services running on the host machine.
@@ -9,10 +10,67 @@
 export function rewriteLocalhostForDocker(url) {
     return url.replace(/^(https?:\/\/)(localhost|127\.0\.0\.1)([:/?#]|$)/, (_, scheme, _host, rest) => `${scheme}host.docker.internal${rest}`);
 }
+/** Names a workspace declaration may never forward. Matching is
+ *  case-insensitive: `process.env` is case-insensitive on Windows, so a
+ *  lower-case declaration there returns the real value and would otherwise
+ *  pass the checks below.
+ *
+ *  Two distinct concerns share one list. The first is CI identity: testbot puts
+ *  the workflow's GitHub token in the MCP process env so the agent's `gh` calls
+ *  authenticate, and a declaration naming it would push it into the container
+ *  and from there into a query string — where the SUT's own access log records
+ *  it. The second is internal signals the executor sets for itself, which a
+ *  declaration must not be able to spoof or override.
+ *
+ *  Deliberately NOT a blanket `*_TOKEN`: a token for the customer's own SUT is
+ *  exactly the kind of value an RBAC query param carries, and refusing it would
+ *  break the feature this list exists to protect. */
+// Names the executor sets for itself. API_KEY carries the Skyramp LLM key and
+// is forwarded unconditionally by the built-in block below, so a declaration
+// adds nothing. UI Smart LLM features keep working either way.
+const PASSTHROUGH_RESERVED_EXACT = new Set([
+    "API_KEY",
+    "PYTEST_ADDOPTS",
+    "PLAYWRIGHT_SAVE_STORAGE_PATH",
+]);
+const PASSTHROUGH_RESERVED_PREFIXES = ["SKYRAMP_"];
+// CI identity and secret-shaped names. Testbot puts the workflow GitHub token
+// in the MCP process env, and a declaration would send it to the container and
+// into a query string, where the SUT access log records it.
+const PASSTHROUGH_CREDENTIAL_EXACT = new Set(["GITHUB_TOKEN", "GH_TOKEN"]);
+const PASSTHROUGH_CREDENTIAL_PREFIXES = ["ACTIONS_", "AWS_"];
+const PASSTHROUGH_CREDENTIAL_SUBSTRINGS = ["_SECRET", "_PRIVATE_KEY"];
+/** Why a name is refused, or null when it is allowed. The two reasons need
+ *  different messages: a reserved name is already provided by the executor, so
+ *  the declaration is only redundant, while a credential name is refused. */
+export function passthroughDenyReason(name) {
+    const upper = name.toUpperCase();
+    if (PASSTHROUGH_CREDENTIAL_EXACT.has(upper) ||
+        PASSTHROUGH_CREDENTIAL_PREFIXES.some((p) => upper.startsWith(p)) ||
+        PASSTHROUGH_CREDENTIAL_SUBSTRINGS.some((s) => upper.includes(s))) {
+        return "credential";
+    }
+    if (PASSTHROUGH_RESERVED_EXACT.has(upper) ||
+        PASSTHROUGH_RESERVED_PREFIXES.some((p) => upper.startsWith(p))) {
+        return "reserved";
+    }
+    return null;
+}
+/** True when a name is refused regardless of who declared it. */
+export function isDeniedPassthroughName(name) {
+    return passthroughDenyReason(name) !== null;
+}
+/** A name is interpolated directly into a Docker `Env` entry, which is a plain
+ *  `NAME=value` string. A name holding `=`, whitespace or a newline produces a
+ *  malformed entry and can inject a second variable. workspace.yml supplies
+ *  these names, so `env.FOO=BAR` would yield the name `FOO=BAR`. */
+export function isValidEnvVarName(name) {
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name);
+}
 /**
  * Build the environment variable array for the Docker executor container.
  */
-export function buildContainerEnv(options, saveStoragePath, hostEnv = process.env) {
+export function buildContainerEnv(options, saveStoragePath, hostEnv = process.env, passthroughNames = []) {
     const env = [
         // Omit entirely when empty so os.getenv() returns None in the test —
         // unauthenticated endpoints won't send an empty auth header (E7).
@@ -68,6 +126,41 @@ export function buildContainerEnv(options, saveStoragePath, hostEnv = process.en
             env.push(`${key}=${val}`);
         }
     }
+    // Environment variables the workspace's query params declare via `env.VAR`
+    // (SKYR-4127). These references resolve where the test RUNS — inside this
+    // container — so a name that does not reach it resolves to nothing, and an
+    // unresolved query param is dropped from the request silently, yielding a
+    // passing test that exercised the wrong identity.
+    //
+    // The list comes from what workspace.yml declared, never from enumerating the
+    // ambient environment: nothing is forwarded that the workspace did not name.
+    // Forwarded on presence, not truthiness, for the same reason as the
+    // credentials above — an empty value is a legitimate declaration.
+    const seen = new Set();
+    for (const name of passthroughNames) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        if (!isValidEnvVarName(name)) {
+            logger.warning(`Ignoring ${JSON.stringify(name)} declared in workspace.yml: it is not a valid environment variable name.`);
+            continue;
+        }
+        const denyReason = passthroughDenyReason(name);
+        if (denyReason === "reserved") {
+            logger.warning(`Ignoring the workspace.yml declaration of ${name}: the executor sets this variable itself. ` +
+                `Its value still reaches the test.`);
+            continue;
+        }
+        if (denyReason === "credential") {
+            logger.warning(`Refusing to forward ${name} to the test executor: the name is credential-shaped. ` +
+                `Declare a variable that carries only the value the request needs.`);
+            continue;
+        }
+        const val = hostEnv[name];
+        if (val !== undefined) {
+            env.push(`${name}=${val}`);
+        }
+    }
     if (hostEnv.SKYRAMP_DEBUG) {
         env.push(`SKYRAMP_DEBUG=${hostEnv.SKYRAMP_DEBUG}`);
     }

package/build/tools/executeSkyrampTestTool.d.ts

@@ -10,4 +10,13 @@ export type ContractExecutionMode = (typeof CONTRACT_EXECUTION_MODES)[number];
  */
 export declare function resolveEffectiveToken(unauthenticated?: boolean, paramToken?: string, envToken?: string): string;
 export declare function shouldInjectSkyrampBaseUrl(testType: TestType, contractMode?: ContractExecutionMode): boolean;
+/**
+ * Append the recorded video path to execution output.
+ *
+ * Applied to the failure return as well as the success one (SKYR-4156): a video is
+ * most useful for a test that just failed, and surfacing it only on success meant a
+ * failing UI test reported no recording at all unless Playwright happened to print
+ * its own attachment line.
+ */
+export declare function withVideoInfo(output: string, videoPath?: string): string;
 export declare function registerExecuteSkyrampTestTool(server: McpServer): void;

package/build/tools/executeSkyrampTestTool.js

@@ -11,6 +11,7 @@ import { StateManager, getTestsRepoDir } from "../utils/AnalysisStateManager.js"
 import { TestSource } from "../types/TestAnalysis.js";
 import { logger } from "../utils/logger.js";
 import { toolError } from "../utils/utils.js";
+import { recordExecutionVideo } from "./execution-video-state.js";
 const TOOL_NAME = "skyramp_execute_test";
 export const CONTRACT_EXECUTION_MODES = ["provider", "consumer"];
 /**
@@ -27,6 +28,17 @@ export function resolveEffectiveToken(unauthenticated, paramToken, envToken) {
 export function shouldInjectSkyrampBaseUrl(testType, contractMode) {
     return testType !== TestType.CONTRACT || contractMode !== "consumer";
 }
+/**
+ * Append the recorded video path to execution output.
+ *
+ * Applied to the failure return as well as the success one (SKYR-4156): a video is
+ * most useful for a test that just failed, and surfacing it only on success meant a
+ * failing UI test reported no recording at all unless Playwright happened to print
+ * its own attachment line.
+ */
+export function withVideoInfo(output, videoPath) {
+    return videoPath ? `${output}\n\nVideo recording: ${videoPath}` : output;
+}
 export function registerExecuteSkyrampTestTool(server) {
     server.registerTool(TOOL_NAME, {
         description: `Execute a Skyramp-generated test in isolated containerized environments for reliable, deterministic testing. Call this once a test file exists on disk (from a skyramp_*_test_generation tool). First-time execution may take longer while Docker images download — this is expected, not a failure.`,
@@ -224,23 +236,25 @@ export function registerExecuteSkyrampTestTool(server) {
                     // Don't fail the tool call if stateFile update fails
                 }
             }
+            // Record the recording for the report before returning, so it happens on the
+            // failure path too (SKYR-4156). skyramp_submit_report reads these records to
+            // populate testResults[].videoPath — testbot uploads only the video
+            // directories the report references, so an unrecorded video is never seen.
+            await recordExecutionVideo(result, params.stateFile);
             // Progress is already reported by TestExecutionService
             // Only report final status if not already at 100%
             if (result.status !== TestExecutionStatus.Pass) {
-                errorResult = toolError(`Test execution failed: ${stripVTControlCharacters(result.output || "")}
+                errorResult = toolError(withVideoInfo(`Test execution failed: ${stripVTControlCharacters(result.output || "")}
 
-If this failed with a 401 status code, ask the user for the authentication token (or where to read it from) and retry — leave the generated test file unchanged.`);
+If this failed with a 401 status code, ask the user for the authentication token (or where to read it from) and retry — leave the generated test file unchanged.`, result.videoPath));
                 return errorResult;
             }
             // Success - progress already reported by TestExecutionService
-            const videoInfo = result.videoPath
-                ? `\n\nVideo recording: ${result.videoPath}`
-                : "";
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Test execution result: ${stripVTControlCharacters(result.output || "")}${videoInfo}`,
+                        text: withVideoInfo(`Test execution result: ${stripVTControlCharacters(result.output || "")}`, result.videoPath),
                     },
                 ],
             };

package/build/tools/execution-video-state.d.ts

@@ -0,0 +1,21 @@
+import type { TestExecutionResult } from "../types/TestExecution.js";
+/**
+ * Persistence for the server-derived video recording of a browser test execution,
+ * keyed by test-file basename (what `newTestsCreated[].fileName` carries, so
+ * `skyramp_submit_report` can match without path normalization).
+ *
+ * Why this exists (SKYR-4156): testbot uploads only the `.skyramp/videos`
+ * directories the submitted report actually references, so a recording nobody
+ * references is a recording nobody ever sees. The path is known only inside
+ * `skyramp_execute_test`, and asking the agent to carry it across tool calls left
+ * the signal prose-mediated — it decayed to zero referenced videos, and every
+ * recording of the run was discarded. Recording it here makes the reference
+ * server-derived, the same line already drawn for POM reuse and maintenance
+ * before/after status.
+ *
+ * Every write is best-effort. Video observability must never fail an execution
+ * that otherwise succeeded, so a missing/unreadable/unwritable state file degrades
+ * to "no video link in the report" — the same outcome as running outside a Testbot
+ * run, where there is no run state to record into.
+ */
+export declare function recordExecutionVideo(result: TestExecutionResult, explicitStateFile?: string): Promise<void>;

package/build/tools/execution-video-state.js

@@ -0,0 +1,51 @@
+import * as path from "path";
+import { logger } from "../utils/logger.js";
+import { resolveRunStatePath, StateManager, } from "../utils/AnalysisStateManager.js";
+/**
+ * Persistence for the server-derived video recording of a browser test execution,
+ * keyed by test-file basename (what `newTestsCreated[].fileName` carries, so
+ * `skyramp_submit_report` can match without path normalization).
+ *
+ * Why this exists (SKYR-4156): testbot uploads only the `.skyramp/videos`
+ * directories the submitted report actually references, so a recording nobody
+ * references is a recording nobody ever sees. The path is known only inside
+ * `skyramp_execute_test`, and asking the agent to carry it across tool calls left
+ * the signal prose-mediated — it decayed to zero referenced videos, and every
+ * recording of the run was discarded. Recording it here makes the reference
+ * server-derived, the same line already drawn for POM reuse and maintenance
+ * before/after status.
+ *
+ * Every write is best-effort. Video observability must never fail an execution
+ * that otherwise succeeded, so a missing/unreadable/unwritable state file degrades
+ * to "no video link in the report" — the same outcome as running outside a Testbot
+ * run, where there is no run state to record into.
+ */
+export async function recordExecutionVideo(result, explicitStateFile) {
+    if (!result.videoPath)
+        return;
+    const stateFile = resolveRunStatePath(explicitStateFile);
+    if (!stateFile)
+        return;
+    try {
+        const manager = StateManager.fromStatePath(stateFile);
+        const data = await manager.readData();
+        if (!data)
+            return;
+        // Last write wins: a retried execution leaves a video directory per attempt,
+        // and the report must reference the attempt whose status it reports.
+        await manager.writeData({
+            ...data,
+            executionVideos: {
+                ...data.executionVideos,
+                [path.basename(result.testFile)]: {
+                    videoPath: result.videoPath,
+                    status: result.status,
+                    executedAt: result.executedAt,
+                },
+            },
+        });
+    }
+    catch (err) {
+        logger.warning("Could not record the test video — the report will omit its video link", { testFile: result.testFile, error: String(err) });
+    }
+}

package/build/tools/generate-tests/generateBatchScenarioRestTool.js

@@ -5,13 +5,16 @@ import { ScenarioGenerationService } from "../../services/ScenarioGenerationServ
 import fs from "fs";
 import { baseSchema, AUTH_PLACEHOLDER_TOKEN, HttpMethod } from "../../types/TestTypes.js";
 import { AnalyticsService } from "../../services/AnalyticsService.js";
-import { resolveAuthFromWorkspace, getWorkspaceDefaultQueryParams, mergeQueryParamsJson } from "../../utils/workspaceAuth.js";
+import { resolveAuthFromWorkspace, getWorkspaceScopedQueryParams, mergeQueryParamsJson } from "../../utils/workspaceAuth.js";
+import { resolveQueryParamsForPath, ensureLeadingSlash, contributesNothing } from "../../workspace/queryParamResolution.js";
+import { deriveBasePath } from "../../utils/urlPath.js";
 import yaml from "js-yaml";
 import { logger } from "../../utils/logger.js";
 import { guardScenarioApproved } from "./planGuard.js";
 import { lintScenarioChaining } from "./scenarioLint.js";
 import { scenarioFileNameFor } from "./scenarioFileIdentity.js";
 import { toolError } from "../../utils/utils.js";
+import { isRecord } from "ts-is-record";
 function isJsonValue(v) {
     if (v === undefined || v === null)
         return true;
@@ -40,8 +43,7 @@ function isJsonObject(v) {
     if (v === undefined || v === null)
         return true;
     try {
-        const p = JSON.parse(v);
-        return typeof p === "object" && !Array.isArray(p) && p !== null;
+        return isRecord(JSON.parse(v));
     }
     catch {
         return false;
@@ -83,7 +85,7 @@ Use this for GET request filters, search terms, pagination, sorting — any para
 
 CRITICAL: For search/filter/list endpoints (e.g., GET /products/search?q=bear&limit=10), parameters MUST go here, NOT in requestBody. GET request bodies are non-standard and may be ignored or rejected by servers and frameworks.
 
-Workspace-configured api.defaultQueryParams (if set) are merged into every step automatically — no need to repeat them here. An explicit value for the same key in a step overrides the workspace default for that step only.`),
+Workspace-configured api.defaultQueryParams (if set) are merged into every step automatically, and any api.queryParamOverrides entry whose pathPattern matches that step's path is layered on top — no need to repeat them here. An explicit value for the same key in a step overrides both, for that step only.`),
     responseBody: z
         .string()
         .optional()
@@ -253,13 +255,31 @@ Call \`skyramp_integration_test_generation\` with the returned \`scenarioFile\`
                 logger.warning("Could not resolve auth from workspace config");
             }
         }
-        let defaultQueryParams;
+        // Workspace-declared query params (SKYR-4050, path-scoped in SKYR-4127).
+        // Loaded once here; resolved per step below, since each step has its own
+        // path and may match a different override.
+        let scopedQueryParams;
+        // The request ScenarioGenerationService actually emits is basePath +
+        // step.path, so pathPattern matching has to see that same composed path —
+        // otherwise a prefix-inclusive pattern (as the workspace.yml schema docs
+        // instruct authors to write) never matches a scenario step (SKYR-4127
+        // final review). deriveBasePath is the one definition of that prefix,
+        // shared with the service itself so the two cannot drift.
+        let basePrefix = "";
         try {
             const repoPath = params.outputDir || process.cwd();
-            defaultQueryParams = await getWorkspaceDefaultQueryParams(repoPath);
-            if (defaultQueryParams) {
-                logger.info("Merged workspace defaultQueryParams into queryParams", {
-                    keys: Object.keys(defaultQueryParams),
+            scopedQueryParams = await getWorkspaceScopedQueryParams(repoPath);
+            if (scopedQueryParams && contributesNothing(scopedQueryParams)) {
+                // Skip the merge entirely rather than setting queryParams to "{}"
+                // where the old code left it untouched (Finding 4).
+                scopedQueryParams = undefined;
+            }
+            if (scopedQueryParams) {
+                basePrefix = deriveBasePath(params.baseURL);
+                logger.info("Loaded workspace query params for scenario steps", {
+                    baseKeys: Object.keys(scopedQueryParams.base),
+                    overrideCount: scopedQueryParams.overrides.length,
+                    basePrefix,
                 });
             }
         }
@@ -410,8 +430,8 @@ Call \`skyramp_integration_test_generation\` with the returned \`scenarioFile\`
                 method: step.method,
                 path: step.path,
                 requestBody: step.requestBody,
-                queryParams: defaultQueryParams
-                    ? mergeQueryParamsJson(step.queryParams, defaultQueryParams)
+                queryParams: scopedQueryParams
+                    ? mergeQueryParamsJson(step.queryParams, resolveQueryParamsForPath(scopedQueryParams, basePrefix + ensureLeadingSlash(step.path)))
                     : step.queryParams,
                 responseBody: step.responseBody,
                 statusCode: step.statusCode,

package/build/tools/generate-tests/planGuard.d.ts

@@ -1,10 +1,10 @@
 import { PlanMatchQuery } from "../../utils/planMatchKeys.js";
 export type PlanGuardQuery = PlanMatchQuery;
-/** Extract the URL path from a generation tool's `endpointURL` param — used
- *  for contract/direct-mode integration guard queries. Falls back to treating
- *  the value as a bare path when it isn't a parseable absolute URL, and to
- *  undefined (no path-based match attempted) when it's neither. */
-export declare function pathFromEndpointURL(endpointURL: string | undefined): string | undefined;
+/** Re-exported for the generation tools that already import it from here.
+ *  The implementation moved to utils/urlPath.ts (SKYR-4127) once workspace
+ *  query-param resolution needed the same derivation — see that module for why
+ *  it must not be copied. */
+export { pathFromEndpointURL } from "../../utils/urlPath.js";
 /**
  * Returns null when the generation call is allowed, or a human-readable error
  * message (for `toolError`) when it must be rejected because it doesn't match

package/build/tools/generate-tests/planGuard.js

@@ -7,23 +7,11 @@
 import { resolveRunStatePath, StateManager } from "../../utils/AnalysisStateManager.js";
 import { matchesApprovedPlan } from "../../utils/planMatchKeys.js";
 import { TOOL_REGISTER_TEST_PLAN } from "../../toolNames.js";
-/** Extract the URL path from a generation tool's `endpointURL` param — used
- *  for contract/direct-mode integration guard queries. Falls back to treating
- *  the value as a bare path when it isn't a parseable absolute URL, and to
- *  undefined (no path-based match attempted) when it's neither. */
-export function pathFromEndpointURL(endpointURL) {
-    if (!endpointURL)
-        return undefined;
-    try {
-        // new URL() percent-encodes {param} placeholders ({id} → %7Bid%7D), while
-        // register-time matchKeys are computed from raw scenario paths with braces
-        // intact — restore them or parameterized endpoints never match the plan.
-        return new URL(endpointURL).pathname.replace(/%7B/gi, "{").replace(/%7D/gi, "}");
-    }
-    catch {
-        return endpointURL.startsWith("/") ? endpointURL : undefined;
-    }
-}
+/** Re-exported for the generation tools that already import it from here.
+ *  The implementation moved to utils/urlPath.ts (SKYR-4127) once workspace
+ *  query-param resolution needed the same derivation — see that module for why
+ *  it must not be copied. */
+export { pathFromEndpointURL } from "../../utils/urlPath.js";
 /**
  * Returns null when the generation call is allowed, or a human-readable error
  * message (for `toolError`) when it must be rejected because it doesn't match

package/build/tools/submitReportTool.d.ts

@@ -1,6 +1,20 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { TestType, HttpMethod } from "../types/TestTypes.js";
+/**
+ * Filename of the report, written beside the state file. SKYR-4147: the report path is
+ * derived here rather than accepted as a parameter. The caller builds the state file and
+ * the report path from a single temp dir (testbot's `skyrampTempDir()`), so the state
+ * file's directory IS the directory the caller reads the report back from. Taking the
+ * path from the agent instead meant the agent had to retype it out of a 600-character
+ * encoded prompt URI; one wrong character wrote the report somewhere nobody reads, and
+ * the tool still reported success, throwing away the whole run without a word.
+ *
+ * Must stay in sync with testbot, which hardcodes the same string in main.ts, post.ts and
+ * eval-entry.ts — the same duplication across the two repos that already exists for
+ * `RUN_STATE_FILE_NAME` / testbot's `STATE_FILE_NAME`.
+ */
+export declare const REPORT_FILE_NAME = "testbot-result.txt";
 export declare const targetElementSchema: z.ZodObject<{
     role: z.ZodString;
     accessibleName: z.ZodString;
@@ -36,7 +50,7 @@ export declare const pageContextSchema: z.ZodObject<{
     url: string;
     pageHash?: string | undefined;
 }>;
-export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
+export declare const newTestSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     testId: z.ZodString;
     testType: z.ZodNativeEnum<typeof TestType>;
     category: z.ZodEffects<z.ZodEnum<["business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>, "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud", unknown>;
@@ -94,7 +108,6 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
     repository?: string | undefined;
     traceFile?: string | undefined;
     scenarioFile?: string | undefined;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -108,6 +121,7 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
 }, {
     description: string;
     testType: TestType;
@@ -119,7 +133,6 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
     category?: unknown;
     traceFile?: string | undefined;
     scenarioFile?: string | undefined;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -133,6 +146,7 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
 }>, {
     description: string;
     testType: TestType;
@@ -144,7 +158,6 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
     repository?: string | undefined;
     traceFile?: string | undefined;
     scenarioFile?: string | undefined;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -158,6 +171,7 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
 }, {
     description: string;
     testType: TestType;
@@ -169,7 +183,31 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
     category?: unknown;
     traceFile?: string | undefined;
     scenarioFile?: string | undefined;
+    targetElements?: {
+        role: string;
+        accessibleName: string;
+        testId: string | null;
+        stableId: string | null;
+        contextText: string[] | null;
+        mutability?: "unknown" | "mutable" | "immutable" | undefined;
+        widgetType?: "unknown" | "custom" | "native" | undefined;
+    }[] | null | undefined;
+    pageContext?: {
+        url: string;
+        pageHash?: string | undefined;
+    } | undefined;
     frontendTrace?: string | undefined;
+}>, {
+    description: string;
+    testType: TestType;
+    category: "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+    fileName: string;
+    endpoint: string;
+    testId: string;
+    reasoning: string;
+    repository?: string | undefined;
+    traceFile?: string | undefined;
+    scenarioFile?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -183,8 +221,9 @@ export declare const newTestSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
-}>;
-export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
+    frontendTrace?: string | undefined;
+}, unknown>;
+export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     testId: z.ZodString;
     testType: z.ZodNativeEnum<typeof TestType>;
     category: z.ZodEffects<z.ZodEnum<["business_rule", "security_boundary", "data_integrity", "breaking_change", "auth", "error_handling", "workflow", "data_validation", "crud"]>, "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud", unknown>;
@@ -271,7 +310,6 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
     reasoning: string;
     repository?: string | undefined;
     scenarioName?: string | undefined;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -285,6 +323,7 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
     primaryEndpoint?: string | undefined;
     openApiSpec?: string | undefined;
     backendTrace?: string | undefined;
@@ -305,7 +344,6 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
     repository?: string | undefined;
     scenarioName?: string | undefined;
     category?: unknown;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -319,6 +357,7 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
     primaryEndpoint?: string | undefined;
     openApiSpec?: string | undefined;
     backendTrace?: string | undefined;
@@ -339,7 +378,6 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
     reasoning: string;
     repository?: string | undefined;
     scenarioName?: string | undefined;
-    frontendTrace?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -353,6 +391,7 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
     primaryEndpoint?: string | undefined;
     openApiSpec?: string | undefined;
     backendTrace?: string | undefined;
@@ -373,7 +412,40 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
     repository?: string | undefined;
     scenarioName?: string | undefined;
     category?: unknown;
+    targetElements?: {
+        role: string;
+        accessibleName: string;
+        testId: string | null;
+        stableId: string | null;
+        contextText: string[] | null;
+        mutability?: "unknown" | "mutable" | "immutable" | undefined;
+        widgetType?: "unknown" | "custom" | "native" | undefined;
+    }[] | null | undefined;
+    pageContext?: {
+        url: string;
+        pageHash?: string | undefined;
+    } | undefined;
     frontendTrace?: string | undefined;
+    primaryEndpoint?: string | undefined;
+    openApiSpec?: string | undefined;
+    backendTrace?: string | undefined;
+}>, {
+    description: string;
+    priority: "high" | "medium" | "low";
+    testType: TestType;
+    category: "business_rule" | "security_boundary" | "data_integrity" | "breaking_change" | "auth" | "error_handling" | "workflow" | "data_validation" | "crud";
+    steps: {
+        description: string;
+        path?: string | undefined;
+        method?: HttpMethod | undefined;
+        requestBody?: Record<string, any> | undefined;
+        responseBody?: Record<string, any> | undefined;
+        expectedStatusCode?: number | undefined;
+    }[];
+    testId: string;
+    reasoning: string;
+    repository?: string | undefined;
+    scenarioName?: string | undefined;
     targetElements?: {
         role: string;
         accessibleName: string;
@@ -387,8 +459,9 @@ export declare const additionalRecommendationSchema: z.ZodEffects<z.ZodObject<{
         url: string;
         pageHash?: string | undefined;
     } | undefined;
+    frontendTrace?: string | undefined;
     primaryEndpoint?: string | undefined;
     openApiSpec?: string | undefined;
     backendTrace?: string | undefined;
-}>;
+}, unknown>;
 export declare function registerSubmitReportTool(server: McpServer): void;