@skyramp/mcp 0.3.8 → 0.4.0-rc.1

package/build/recommendation/verifiers/statedDifference.js

@@ -0,0 +1,140 @@
+import { callSteps, isUIPlannedTest, stepRouteKey, subjectStep } from "../subjectStep.js";
+import { STATED_DIFFERENCE_CONTRACT } from "../verifierContracts.js";
+/** What two planned tests must share before this asks how they differ: the method and
+ *  path of their subject step. UI planned tests are OUT — two tests of one screen are
+ *  the normal shape of UI coverage. */
+function subjectIdentity(plannedTest) {
+    if (isUIPlannedTest(plannedTest))
+        return undefined;
+    return stepRouteKey(subjectStep(plannedTest));
+}
+/** A reference reduced to the spelling the id is stored in: trimmed, and exact
+ *  otherwise. Case is NOT folded — the report joins on the exact id, so folding
+ *  here would make two ids one name. */
+function nameKey(raw) {
+    return typeof raw === "string" ? raw.trim() : "";
+}
+/** Whether either side states a real difference from the other. A planned test id IS
+ *  its scenario name and the schema refuses a repeated one, so a reference either
+ *  names exactly one planned test or names none. A reference naming none states no
+ *  difference, and the pair's own objection is the question about it — naming the
+ *  bad reference too would ask twice about one mistake. */
+function differenceStated(a, b) {
+    const states = (from, to) => (from.declarations?.differsFrom ?? []).some((entry) => nameKey(entry?.plannedTestId) === nameKey(to.plannedTestId) && (entry?.difference ?? "").trim().length > 0);
+    return states(a, b) || states(b, a);
+}
+/** One objection per `differsFrom` entry naming no planned test in the plan. A
+ *  reference is how the agent states that two tests differ, so a misspelled one
+ *  has to come back AS a misspelling: the pair objection on its own reads as a
+ *  question the agent believes it already answered, and it would answer it again
+ *  the same way. A blank reference names nothing either and is one of these. */
+function unknownPartnerObjections(plannedTests) {
+    const known = new Set(plannedTests.map((plannedTest) => nameKey(plannedTest?.plannedTestId)).filter(Boolean));
+    const seen = new Set();
+    const objections = [];
+    for (const plannedTest of plannedTests) {
+        for (const entry of plannedTest?.declarations?.differsFrom ?? []) {
+            const raw = entry?.plannedTestId;
+            if (typeof raw !== "string")
+                continue;
+            const reference = nameKey(raw);
+            if (reference && known.has(reference))
+                continue;
+            // One objection per (planned test, reference): the same bad name written by
+            // two planned tests is two mistakes, and each owes its own answer.
+            const key = `${nameKey(plannedTest?.plannedTestId)}\u0000${reference}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            objections.push({
+                objectionId: `statedDifference:unknownPartner:${plannedTest.plannedTestId}:${reference}`,
+                verifier: "statedDifference",
+                plannedTestId: plannedTest.plannedTestId,
+                message: STATED_DIFFERENCE_CONTRACT.objections.unknownPartner.message,
+                evidence: `"${raw}" is not the scenarioName of any planned test in this plan`,
+                suggestion: STATED_DIFFERENCE_CONTRACT.objections.unknownPartner.suggestion,
+            });
+        }
+    }
+    return objections;
+}
+/** One objection per planned test that makes calls but has no subject step: it makes
+ *  several and names none, or its `stepUnderTest` names a step it does not make.
+ *  Without this the pair check goes SILENT on exactly the planned tests most likely
+ *  to repeat one another, because a planned test with no subject is never compared. */
+function unstatedSubjectObjections(plannedTests) {
+    const objections = [];
+    for (const plannedTest of plannedTests) {
+        if (isUIPlannedTest(plannedTest))
+            continue;
+        const calls = callSteps(plannedTest);
+        if (calls.length === 0 || subjectStep(plannedTest))
+            continue;
+        const declared = plannedTest?.declarations?.stepUnderTest;
+        objections.push({
+            objectionId: `statedDifference:subjectNotStated:${plannedTest.plannedTestId}`,
+            verifier: "statedDifference",
+            plannedTestId: plannedTest.plannedTestId,
+            message: STATED_DIFFERENCE_CONTRACT.objections.subjectNotStated.message,
+            evidence: typeof declared === "number"
+                ? `stepUnderTest ${declared} names none of the ${calls.length} calls this test makes`
+                : `${calls.length} calls and no stepUnderTest`,
+            suggestion: STATED_DIFFERENCE_CONTRACT.objections.subjectNotStated.suggestion,
+        });
+    }
+    return objections;
+}
+/** Verifier 3. Two planned tests whose subject steps name the same method and path
+ *  must say how they differ — ASKING, where the old dedup key removed one of the
+ *  pair on a string that says nothing about what either asserts. Both sides get an
+ *  objection; a stated difference is taken at its word. No request, no compare. */
+export const statedDifference = {
+    name: "statedDifference",
+    run(registration, _ctx) {
+        const plannedTests = registration.plannedTests ?? [];
+        /** Planned-test id -> route -> the partners on that route it has NOT explained,
+         *  recorded while the pair is known to be unexplained. Deriving it afterwards
+         *  from the route would list partners this planned test already explained. */
+        const unexplained = new Map();
+        const record = (id, route, partnerId) => {
+            let routes = unexplained.get(id);
+            if (!routes) {
+                routes = new Map();
+                unexplained.set(id, routes);
+            }
+            let partners = routes.get(route);
+            if (!partners) {
+                partners = new Set();
+                routes.set(route, partners);
+            }
+            partners.add(partnerId);
+        };
+        for (let i = 0; i < plannedTests.length; i++) {
+            for (let j = i + 1; j < plannedTests.length; j++) {
+                const a = plannedTests[i];
+                const b = plannedTests[j];
+                const identity = subjectIdentity(a);
+                if (!identity || identity !== subjectIdentity(b))
+                    continue;
+                if (differenceStated(a, b))
+                    continue;
+                record(a.plannedTestId, identity, b.plannedTestId);
+                record(b.plannedTestId, identity, a.plannedTestId);
+            }
+        }
+        const objections = unknownPartnerObjections(plannedTests).concat(unstatedSubjectObjections(plannedTests));
+        return objections.concat([...unexplained.entries()].map(([plannedTestId, routes]) => {
+            const shared = [...routes.entries()]
+                .map(([route, partners]) => `${route} with ${[...partners].join(", ")}`)
+                .join("; ");
+            return {
+                objectionId: `statedDifference:${plannedTestId}`,
+                verifier: "statedDifference",
+                plannedTestId,
+                message: STATED_DIFFERENCE_CONTRACT.objections.unexplainedPair.message,
+                evidence: `shares ${shared}`,
+                suggestion: STATED_DIFFERENCE_CONTRACT.objections.unexplainedPair.suggestion,
+            };
+        }));
+    },
+};

package/build/recommendation/verifiers/uiElementGrounded.d.ts

@@ -0,0 +1,7 @@
+import { Verifier } from "../types.js";
+/** Verifier 7. A UI planned test's `elements.items` must be COPIES of elements a
+ *  blueprint captured this run really holds. Captures are EVIDENCE, never an
+ *  allowlist: a page nobody captured draws nothing, and a missing element is
+ *  ANSWERABLE, since one behind a modal is legitimately absent. Plan time only,
+ *  over the pre-scan. */
+export declare const uiElementGrounded: Verifier;

package/build/recommendation/verifiers/uiElementGrounded.js

@@ -0,0 +1,318 @@
+import { isUIPlannedTest } from "../subjectStep.js";
+import { UI_ELEMENT_GROUNDED_CONTRACT } from "../verifierContracts.js";
+/** An IDENTIFIER, compared exactly apart from surrounding space: `saveBtn` and
+ *  `savebtn` are different DOM attributes. Absence has one spelling — the digest
+ *  omits a field the element does not have and a declaration may send `null` or
+ *  `""` for the same thing, so those must not read as two different values. */
+function field(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+/** A ROLE or an accessible NAME, reduced to what two honest copies of it share.
+ *  This much leniency is deliberate and one-directional: it can only ground an
+ *  element that would otherwise draw an objection, and a false objection teaches
+ *  the agent that objections are noise. It forgives how a name is SPELLED —
+ *  letter case, and the repeated spaces an HTML render collapses — and nothing
+ *  about what it says: a shortened or paraphrased name is not a copy. */
+function folded(value) {
+    return typeof value === "string" ? value.trim().replace(/\s+/g, " ").toLowerCase() : "";
+}
+function context(value) {
+    return Array.isArray(value) ? value.map(folded).filter(Boolean) : [];
+}
+function fieldsOf(raw) {
+    const element = (raw && typeof raw === "object" ? raw : {});
+    return {
+        role: folded(element.role),
+        name: folded(element.accessibleName),
+        testId: field(element.testId),
+        stableId: field(element.stableId),
+        contextText: context(element.contextText),
+    };
+}
+/** Whether a captured element is the one the declaration names.
+ *
+ *  An IDENTIFIER decides on its own. `data-testid` and `id` name exactly one
+ *  element on a page, so a declaration carrying one a capture holds names an
+ *  element that is really there, whatever else the declaration got wrong. The
+ *  other fields are not compared then, and deliberately so: objecting that an
+ *  element "is in no capture" when its test id IS in the capture states
+ *  something false, and a false objection teaches the agent that objections are
+ *  noise.
+ *
+ *  With no identifier to go on, the role, the name and a row's context text have
+ *  to agree — spelling forgiven, content not. Four tiers used to stand here, each
+ *  with its own leniency and its own rule about when a blank role counted; this
+ *  is the same reach with one rule per kind of evidence. */
+function names(declared, captured) {
+    if (declared.testId)
+        return declared.testId === captured.testId;
+    if (declared.stableId)
+        return declared.stableId === captured.stableId;
+    if (declared.role && declared.role !== captured.role)
+        return false;
+    // A row's own text, which is what separates it from its siblings. Its NAME is
+    // not compared here: the capture keeps a repeating element under a template
+    // name and again per row with the values filled in, so a row's name really
+    // does vary between two honest readings of one page. Row text never grounds an
+    // element on its own — the role has to agree, checked above — because a probe
+    // got an invented button onto a page by copying a real table row's text.
+    if (declared.contextText.length > 0)
+        return rowKey(declared) === rowKey(captured);
+    return declared.name === captured.name;
+}
+/** `role` plus a row's own text, serialised rather than joined on a separator:
+ *  row text is page content and can hold any character. */
+function rowKey(element) {
+    return JSON.stringify([element.role, element.contextText]);
+}
+function addTo(index, key, element) {
+    if (!key)
+        return;
+    const bucket = index.get(key);
+    if (bucket)
+        bucket.push(element);
+    else
+        index.set(key, [element]);
+}
+function poolOf(captured) {
+    const pool = { byTestId: new Map(), byStableId: new Map(), byRow: new Map(), byName: new Map() };
+    for (const raw of captured) {
+        const element = fieldsOf(raw);
+        addTo(pool.byTestId, element.testId, element);
+        addTo(pool.byStableId, element.stableId, element);
+        if (element.contextText.length > 0)
+            addTo(pool.byRow, rowKey(element), element);
+        addTo(pool.byName, element.name, element);
+    }
+    return pool;
+}
+/** Narrowed by whatever the declaration can be looked up by, in the order
+ *  `names` reads them. An entry that states none of the four is UNGROUNDED:
+ *  there is nothing to look it up by. The schema refuses one, so that only
+ *  decides the unvalidated path, and refusing is the safe answer there. */
+function grounded(declared, pool) {
+    const narrowed = (declared.testId && pool.byTestId.get(declared.testId)) ||
+        (declared.stableId && pool.byStableId.get(declared.stableId)) ||
+        (declared.contextText.length > 0 && pool.byRow.get(rowKey(declared))) ||
+        (declared.name && pool.byName.get(declared.name)) ||
+        [];
+    return narrowed.some((captured) => names(declared, captured));
+}
+/** Identity for the duplicate check: two entries agreeing on every field name
+ *  one element, so the second says nothing the first did not. */
+function identityKey(element) {
+    return JSON.stringify([element.role, element.name, element.testId, element.stableId, element.contextText]);
+}
+/** How an element reads back in an objection, in the agent's own spelling. */
+function label(raw) {
+    const element = (raw && typeof raw === "object" ? raw : {});
+    const parts = [
+        element.role ? `role "${String(element.role).trim()}"` : "",
+        element.accessibleName ? `name "${String(element.accessibleName).trim()}"` : "",
+        element.testId ? `testId "${String(element.testId).trim()}"` : "",
+        element.stableId ? `stableId "${String(element.stableId).trim()}"` : "",
+    ].filter(Boolean);
+    return parts.length > 0 ? parts.join(" ") : "an entry with no role, name or identifier";
+}
+/** A url split into the part before the fragment and the fragment WHEN it is a
+ *  route (`#/…`). An ordinary anchor comes back as an empty route and is
+ *  dropped: it names a place on a page, not a page. */
+function splitHashRoute(raw) {
+    const value = String(raw ?? "").trim();
+    const hash = value.indexOf("#");
+    if (hash < 0)
+        return { base: value, route: "" };
+    const fragment = value.slice(hash);
+    return { base: value.slice(0, hash), route: fragment.startsWith("#/") ? fragment.replace(/\/+$/, "") : "" };
+}
+/** The path half of a url. The ROOT stays `/` rather than folding to empty, or a
+ *  page named by its host alone would have no path to match on and the check
+ *  would go silent on it. The query string is dropped, which only pools MORE
+ *  captures for one page. */
+function urlPath(raw) {
+    const { base, route } = splitHashRoute(raw);
+    // A hash route IS the path for these apps; the part before the `#` is the same
+    // shell url on every screen.
+    if (route)
+        return route.slice(1).split("?")[0].replace(/\/+$/, "") || "/";
+    if (!base)
+        return "";
+    try {
+        return new URL(base).pathname.replace(/\/+$/, "") || "/";
+    }
+    catch {
+        return base.startsWith("/") ? base.split("?")[0].replace(/\/+$/, "") || "/" : "";
+    }
+}
+/** The spellings of the machine the run is on: a capture at `127.0.0.1` and a
+ *  page url at `localhost` are the same page. */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
+/** The host half of a url, empty for a path-only one. Read so a wrong host
+ *  cannot ground an element on another service's capture. */
+function urlHost(raw) {
+    const value = String(raw ?? "").trim().split("#")[0];
+    if (!value)
+        return "";
+    try {
+        const url = new URL(value);
+        const hostname = url.hostname.toLowerCase();
+        const host = LOOPBACK_HOSTS.has(hostname) ? "localhost" : hostname;
+        return url.port ? `${host}:${url.port}` : host;
+    }
+    catch {
+        return "";
+    }
+}
+/** Every element captured for the page the planned test names.
+ *  UNDEFINED means NO CAPTURE COVERS THE PAGE; a capture that covers it and holds
+ *  nothing returns an EMPTY pool, so a declared element is ungrounded. Every
+ *  capture of the page is pooled — later ones hold what an action revealed. */
+function elementsForPage(captures, url) {
+    const path = urlPath(url);
+    if (!path)
+        return undefined;
+    const host = urlHost(url);
+    const pool = captures.filter((capture) => urlPath(capture.url) === path && (!host || urlHost(capture.url) === host));
+    if (pool.length === 0)
+        return undefined;
+    return poolOf(pool.flatMap((capture) => (Array.isArray(capture.elements) ? capture.elements : [])));
+}
+/** How many elements this run captured, across every page. The exemption below
+ *  reads this and never `captures.length`: a capture object that holds nothing
+ *  is not evidence of anything the run saw. */
+function capturedElementCount(captures) {
+    return captures.reduce((total, capture) => total + (Array.isArray(capture.elements) ? capture.elements.length : 0), 0);
+}
+function capturedPages(captures) {
+    const pages = [];
+    for (const capture of captures) {
+        const url = String(capture?.url ?? "").trim();
+        if (url && !pages.includes(url))
+            pages.push(url);
+    }
+    return pages;
+}
+/** The `data-testid` values the diff removed from a page that survives.
+ *
+ *  A removal-guard element is DECLARED because it is gone: the test asserts it no
+ *  longer renders, so no capture of the page can hold it and "not in any capture"
+ *  is not a fault. `testbot-task1.md` asks the agent for exactly this entry, so
+ *  objecting to it would contradict the instruction it followed.
+ *
+ *  `data-testid` alone: it is the one attribute a declared element has a field
+ *  for. A guard on `data-cy` or `data-qa` reaches the plan with `testId` null and
+ *  nothing else that carries the pair, so this cannot recognise it. */
+function removedTestIds(ctx) {
+    const removed = Array.isArray(ctx?.removedUiElements) ? ctx.removedUiElements : [];
+    return new Set(removed
+        .filter((item) => field(item?.attribute).toLowerCase() === "data-testid")
+        .map((item) => field(item?.value))
+        .filter(Boolean));
+}
+/** An objection names everything it saw. It used to stop at eight and say "and
+ *  N more", which decided for the agent which pages were worth reading. */
+function list(values) {
+    return values.join("; ");
+}
+/** Verifier 7. A UI planned test's `elements.items` must be COPIES of elements a
+ *  blueprint captured this run really holds. Captures are EVIDENCE, never an
+ *  allowlist: a page nobody captured draws nothing, and a missing element is
+ *  ANSWERABLE, since one behind a modal is legitimately absent. Plan time only,
+ *  over the pre-scan. */
+export const uiElementGrounded = {
+    name: "uiElementGrounded",
+    run(registration, ctx) {
+        const objections = [];
+        const captures = Array.isArray(ctx.uiCaptures) ? ctx.uiCaptures.filter((capture) => capture && typeof capture === "object") : [];
+        const pools = new Map();
+        const removedIds = removedTestIds(ctx);
+        for (const plannedTest of registration.plannedTests ?? []) {
+            if (!isUIPlannedTest(plannedTest))
+                continue;
+            const raw = plannedTest.declarations?.elements?.items;
+            const declared = Array.isArray(raw) ? raw : [];
+            const url = String(plannedTest.declarations?.elements?.pageUrl ?? "").trim();
+            if (declared.length === 0) {
+                // A run that saw nothing cannot ask this: standalone and IDE use store no
+                // digest and a backend-only run takes none. The boundary is the ELEMENT
+                // count, not the capture count — a capture holding no elements shows the
+                // agent nothing to copy, and the suggestion has no element to name.
+                if (capturedElementCount(captures) === 0)
+                    continue;
+                objections.push({
+                    objectionId: `uiElementGrounded:nogrounding:${plannedTest.plannedTestId}`,
+                    verifier: "uiElementGrounded",
+                    plannedTestId: plannedTest.plannedTestId,
+                    message: UI_ELEMENT_GROUNDED_CONTRACT.objections.nogrounding.message,
+                    evidence: `this run captured ${captures.length} blueprint(s), covering: ${list(capturedPages(captures))}`,
+                    suggestion: UI_ELEMENT_GROUNDED_CONTRACT.objections.nogrounding.suggestion,
+                });
+                continue;
+            }
+            const seen = new Set();
+            const duplicates = declared.filter((element) => {
+                const key = identityKey(fieldsOf(element));
+                if (seen.has(key))
+                    return true;
+                seen.add(key);
+                return false;
+            });
+            if (duplicates.length > 0) {
+                objections.push({
+                    objectionId: `uiElementGrounded:duplicate:${plannedTest.plannedTestId}`,
+                    verifier: "uiElementGrounded",
+                    plannedTestId: plannedTest.plannedTestId,
+                    message: UI_ELEMENT_GROUNDED_CONTRACT.objections.duplicate.message,
+                    evidence: `repeated: ${list(duplicates.map(label))}`,
+                    suggestion: UI_ELEMENT_GROUNDED_CONTRACT.objections.duplicate.suggestion,
+                });
+            }
+            if (!url) {
+                objections.push({
+                    objectionId: `uiElementGrounded:pagecontext:${plannedTest.plannedTestId}`,
+                    verifier: "uiElementGrounded",
+                    plannedTestId: plannedTest.plannedTestId,
+                    message: UI_ELEMENT_GROUNDED_CONTRACT.objections.pagecontext.message,
+                    evidence: `${declared.length} element(s) declared, \`elements.pageUrl\` empty`,
+                    suggestion: UI_ELEMENT_GROUNDED_CONTRACT.objections.pagecontext.suggestion,
+                });
+                continue;
+            }
+            // Pooled once per page, not once per planned test: two planned tests on one page
+            // are the normal shape of a UI plan.
+            if (!pools.has(url))
+                pools.set(url, elementsForPage(captures, url));
+            const pool = pools.get(url);
+            // A page no capture covers is SILENT: the pre-scan captures the plan is
+            // checked against are taken before generation's action-gated states, so a
+            // page can be legitimately missing from all of them.
+            if (pool === undefined)
+                continue;
+            const ungrounded = declared.filter((element) => {
+                const fields = fieldsOf(element);
+                // The removal guard: gone from the page on purpose, so the capture is
+                // the wrong place to look for it.
+                if (fields.testId && removedIds.has(fields.testId))
+                    return false;
+                return !grounded(fields, pool);
+            });
+            if (ungrounded.length === 0)
+                continue;
+            objections.push({
+                objectionId: `uiElementGrounded:${plannedTest.plannedTestId}`,
+                verifier: "uiElementGrounded",
+                plannedTestId: plannedTest.plannedTestId,
+                message: UI_ELEMENT_GROUNDED_CONTRACT.objections.ungrounded.message,
+                // A capture the element cap cut is a PARTIAL view of that page, so "not
+                // in any capture" is not a fact about it. The objection still fires — it
+                // is answerable — but it says which it is.
+                evidence: `not in any capture of ${url}: ${list(ungrounded.map(label))}` +
+                    (captures.some((capture) => capture.url === url && capture.elementsTruncated)
+                        ? " (a capture of this page was cut at the element cap, so it holds only part of the page)"
+                        : ""),
+                suggestion: UI_ELEMENT_GROUNDED_CONTRACT.objections.ungrounded.suggestion,
+            });
+        }
+        return objections;
+    },
+};

package/build/resources/analysisResources.js

@@ -96,14 +96,7 @@ export function registerAnalysisResources(server) {
             },
             authentication: analysis.authentication,
             infrastructure: analysis.infrastructure,
-            endpointStats: {
-                totalPaths: analysis.apiEndpoints.endpoints.length,
-                totalMethods: analysis.apiEndpoints.endpoints.reduce((sum, ep) => sum + ep.methods.length, 0),
-                totalInteractions: analysis.apiEndpoints.endpoints.reduce((sum, ep) => sum +
-                    ep.methods.reduce((msum, m) => msum + m.interactions.length, 0), 0),
-                baseUrl: analysis.apiEndpoints.baseUrl,
-            },
-            scenarioCount: analysis.businessContext.draftedScenarios.length,
+            workspace: analysis.workspace,
             existingTests: analysis.existingTests,
         };
         return {
@@ -116,112 +109,6 @@ export function registerAnalysisResources(server) {
             ],
         };
     });
-    // ── Endpoints (compact listing) ──
-    server.registerResource("analysis_endpoints", new ResourceTemplate(`${ANALYSIS_URI_PREFIX}/{sessionId}/endpoints`, {
-        list: makeListCallback("endpoints"),
-    }), {
-        title: "Endpoint Listing",
-        description: "Compact listing of all endpoints (path, methods, interaction counts). Use path-specific resources for full detail.",
-        mimeType: "application/json",
-    }, async (uri, params) => {
-        const sessionId = params.sessionId;
-        const { analysis } = await loadAnalysis(sessionId);
-        const compact = analysis.apiEndpoints.endpoints.map((ep) => ({
-            path: ep.path,
-            resourceGroup: ep.resourceGroup,
-            pathParams: ep.pathParams.map((p) => p.name),
-            methods: ep.methods.map((m) => ({
-                method: m.method,
-                authRequired: m.authRequired,
-                interactionCount: m.interactions.length,
-                interactionTypes: m.interactions.map((i) => i.type),
-                hasCookies: m.interactions.some((i) => (i.response.cookies?.length ?? 0) > 0),
-                hasResponseHeaders: m.interactions.some((i) => Object.keys(i.response.headers ?? {}).length > 0),
-                createsResource: m.createsResource,
-            })),
-        }));
-        return {
-            contents: [
-                {
-                    uri: uri.href,
-                    mimeType: "application/json",
-                    text: JSON.stringify({ baseUrl: analysis.apiEndpoints.baseUrl, endpoints: compact }, null, 2),
-                },
-            ],
-        };
-    });
-    // ── Single Path Detail ──
-    // No list callback — these are parameterized drilldowns, not top-level resources.
-    server.registerResource("analysis_endpoint_path", new ResourceTemplate(`${ANALYSIS_URI_PREFIX}/{sessionId}/endpoints/{+path}`, { list: undefined }), {
-        title: "Endpoint Path Detail",
-        description: "Full detail for a specific path: all methods, interactions, params.",
-        mimeType: "application/json",
-    }, async (uri, params) => {
-        const sessionId = params.sessionId;
-        const endpointPath = "/" + params.path;
-        const { analysis } = await loadAnalysis(sessionId);
-        const ep = analysis.apiEndpoints.endpoints.find((e) => e.path === endpointPath);
-        if (!ep) {
-            throw new Error(`Endpoint path "${endpointPath}" not found in session "${sessionId}".`);
-        }
-        return {
-            contents: [
-                {
-                    uri: uri.href,
-                    mimeType: "application/json",
-                    text: JSON.stringify(ep, null, 2),
-                },
-            ],
-        };
-    });
-    // ── Single Method Detail ──
-    server.registerResource("analysis_endpoint_method", new ResourceTemplate(`${ANALYSIS_URI_PREFIX}/{sessionId}/endpoints/{+path}/{method}`, { list: undefined }), {
-        title: "Endpoint Method Detail",
-        description: "Full detail for a specific method on a path: interactions, params, auth.",
-        mimeType: "application/json",
-    }, async (uri, params) => {
-        const sessionId = params.sessionId;
-        const endpointPath = "/" + params.path;
-        const method = params.method.toUpperCase();
-        const { analysis } = await loadAnalysis(sessionId);
-        const ep = analysis.apiEndpoints.endpoints.find((e) => e.path === endpointPath);
-        if (!ep) {
-            throw new Error(`Endpoint path "${endpointPath}" not found in session "${sessionId}".`);
-        }
-        const m = ep.methods.find((em) => em.method.toUpperCase() === method);
-        if (!m) {
-            throw new Error(`Method "${method}" not found on "${endpointPath}" in session "${sessionId}".`);
-        }
-        return {
-            contents: [
-                {
-                    uri: uri.href,
-                    mimeType: "application/json",
-                    text: JSON.stringify({ path: ep.path, resourceGroup: ep.resourceGroup, pathParams: ep.pathParams, ...m }, null, 2),
-                },
-            ],
-        };
-    });
-    // ── Scenarios ──
-    server.registerResource("analysis_scenarios", new ResourceTemplate(`${ANALYSIS_URI_PREFIX}/{sessionId}/scenarios`, {
-        list: makeListCallback("scenarios"),
-    }), {
-        title: "Drafted Scenarios",
-        description: "All drafted user-flow scenarios with steps, chaining, and priority.",
-        mimeType: "application/json",
-    }, async (uri, params) => {
-        const sessionId = params.sessionId;
-        const { analysis } = await loadAnalysis(sessionId);
-        return {
-            contents: [
-                {
-                    uri: uri.href,
-                    mimeType: "application/json",
-                    text: JSON.stringify(analysis.businessContext.draftedScenarios, null, 2),
-                },
-            ],
-        };
-    });
     // ── Branch Diff ──
     server.registerResource("analysis_diff", new ResourceTemplate(`${ANALYSIS_URI_PREFIX}/{sessionId}/diff`, {
         list: makeListCallback("diff"),

package/build/resources/testbotResource.js

@@ -1,7 +1,6 @@
 import { ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { logger } from "../utils/logger.js";
 import { AnalyticsService } from "../services/AnalyticsService.js";
-import { MAX_TESTS_TO_GENERATE, MAX_RECOMMENDATIONS, MAX_CRITICAL_TESTS, } from "../prompts/test-recommendation/recommendationSections.js";
 import { getTestbotPrompt, parseRelatedRepositories, } from "../prompts/testbot/testbot-prompts.js";
 import { readWorkspaceServices } from "../prompts/prompt-utils.js";
 export function registerTestbotResource(server) {
@@ -20,10 +19,21 @@ export function registerTestbotResource(server) {
         mimeType: "text/plain",
     }, async (uri) => {
         const param = (name, fallback) => uri.searchParams.get(name) ?? fallback;
-        const maxRec = parseInt(uri.searchParams.get("maxRecommendations") || "", 10);
-        const maxGen = parseInt(uri.searchParams.get("maxGenerate") || "", 10);
-        const prNum = parseInt(uri.searchParams.get("prNumber") || "", 10);
-        const maxCrit = parseInt(uri.searchParams.get("maxCritical") || "", 10);
+        // Absent or unparseable leaves these NaN, so the knobs below pass undefined
+        // rather than the MCP's own default. WHOLE STRING OR NOTHING, where `parseInt`
+        // read `8abc` as 8 and `1e3` as 1. NONNEGATIVE AND SAFE, because every reader
+        // is an `.int().min(0)` field: out of range is treated as unset.
+        const intParam = (name) => {
+            const raw = (uri.searchParams.get(name) ?? "").trim();
+            // No leading zeros, so `00` cannot arrive as a ceiling of zero from
+            // something that reads like a typo. A leading `+` is still accepted — it
+            // is a deliberate spelling of a real number, pinned by its own test.
+            if (!/^\+?(?:0|[1-9]\d*)$/.test(raw))
+                return NaN;
+            const value = Number(raw);
+            return Number.isSafeInteger(value) ? value : NaN;
+        };
+        const prNum = intParam("prNumber");
         const repositoryPath = param("repositoryPath", ".");
         const services = await readWorkspaceServices(repositoryPath);
         const prompt = getTestbotPrompt({
@@ -31,9 +41,6 @@ export function registerTestbotResource(server) {
             prDescription: param("prDescription", ""),
             repositoryPath,
             baseBranch: uri.searchParams.get("baseBranch") || undefined,
-            maxRecommendations: isNaN(maxRec) ? MAX_RECOMMENDATIONS : maxRec,
-            maxGenerate: isNaN(maxGen) ? MAX_TESTS_TO_GENERATE : maxGen,
-            maxCritical: isNaN(maxCrit) ? MAX_CRITICAL_TESTS : maxCrit,
             prNumber: isNaN(prNum) ? undefined : prNum,
             userPrompt: uri.searchParams.get("userPrompt") || undefined,
             services: services.length ? services : undefined,
@@ -47,14 +54,17 @@ export function registerTestbotResource(server) {
             language: uri.searchParams.get("language") || undefined,
         });
         AnalyticsService.pushMCPToolEvent("skyramp_testbot_prompt", undefined, {}).catch(() => { });
-        // Return the original URI — clients may use it to re-fetch the resource,
-        // and the caller already has these params. Credentials never appear in
-        // the rendered prompt text (they are base64-encoded inside the
-        // <ui-credentials> block; see getTestbotPrompt).
+        // The URI WITHOUT its query string. The agent reads this line above the
+        // prompt text, and a legacy count argument in the query was reaching it as
+        // a number to plan against even though the server applies none of them —
+        // plans cited it back as a ceiling. Stripping the query also keeps
+        // `uiCredentials` out of this line. `uri.origin` is the string "null" for a
+        // non-special scheme like `skyramp:`, so the parts are joined by hand.
+        const uriWithoutQuery = `${uri.protocol}//${uri.host}${uri.pathname}`;
         return {
             contents: [
                 {
-                    uri: uri.toString(),
+                    uri: uriWithoutQuery,
                     mimeType: "text/plain",
                     text: prompt,
                 },