@skyramp/mcp 0.4.4 → 0.5.0-rc.10

package/build/services/FleetRunRegistry.d.ts

@@ -0,0 +1,49 @@
+import { type FleetExecutionOptions, type FleetExecutionResult } from "./FleetExecutionService.js";
+/** Process-local jobs: callers must poll the same MCP session that started a run. */
+export declare class FleetRunRegistry {
+    private readonly execute;
+    private readonly runs;
+    constructor(execute?: (options: FleetExecutionOptions) => Promise<FleetExecutionResult>);
+    start(options: FleetExecutionOptions): string;
+    /** Start a run and wait for it, under the same per-directory guard; `signal` cancels it. */
+    run(options: FleetExecutionOptions, signal?: AbortSignal): Promise<FleetExecutionResult>;
+    /** Interrupt a running fleet; it gets a grace to cancel its workers before it is killed. */
+    cancel(id: string): {
+        runId: string;
+        done: boolean;
+        events: {
+            sequence: number;
+            event: Record<string, unknown>;
+        }[];
+        next: number;
+        more: boolean;
+        truncated: boolean;
+        counters: Record<string, unknown>;
+        cancelled: true | undefined;
+        elapsedMs: number;
+        runStartedAt: string | undefined;
+        error: string | undefined;
+    };
+    /** Interrupt every running fleet and wait, bounded, for them to end. For shutdown. */
+    cancelAll(waitMs?: number): Promise<void>;
+    private output;
+    private get;
+    status(id: string, since?: number): {
+        runId: string;
+        done: boolean;
+        events: {
+            sequence: number;
+            event: Record<string, unknown>;
+        }[];
+        next: number;
+        more: boolean;
+        truncated: boolean;
+        counters: Record<string, unknown>;
+        cancelled: true | undefined;
+        elapsedMs: number;
+        runStartedAt: string | undefined;
+        error: string | undefined;
+    };
+    result(id: string, release?: boolean): FleetExecutionResult;
+}
+export declare const fleetRuns: FleetRunRegistry;

package/build/services/FleetRunRegistry.js

@@ -0,0 +1,178 @@
+import { randomUUID } from "node:crypto";
+import * as path from "node:path";
+import { executeFleet, } from "./FleetExecutionService.js";
+const MAX_RETAINED_RUNS = 16;
+/** How long shutdown waits for interrupted runs to cancel their workers and end. */
+const SHUTDOWN_WAIT_MS = 30_000;
+const RESULT_RETENTION_MS = 60 * 60 * 1000;
+const MAX_EVENTS = 10000;
+/** Events one status call returns; the rest follow from its next cursor. */
+const MAX_PAGE_EVENTS = 200;
+/** Process-local jobs: callers must poll the same MCP session that started a run. */
+export class FleetRunRegistry {
+    execute;
+    runs = new Map();
+    constructor(execute = executeFleet) {
+        this.execute = execute;
+    }
+    start(options) {
+        const now = Date.now();
+        for (const [id, run] of this.runs) {
+            if (run.ended && now - run.ended > RESULT_RETENTION_MS)
+                this.runs.delete(id);
+        }
+        const directory = path.resolve(options.directory);
+        for (const run of this.runs.values()) {
+            if (!run.ended && run.directory === directory)
+                throw new Error("a fleet is already running from this directory");
+        }
+        if (this.runs.size >= MAX_RETAINED_RUNS) {
+            // Finished runs make room, oldest first; only running ones are never dropped.
+            const finished = [...this.runs.values()]
+                .filter((r) => r.ended !== undefined)
+                .sort((a, b) => a.ended - b.ended);
+            for (const run of finished.slice(0, this.runs.size - MAX_RETAINED_RUNS + 1))
+                this.runs.delete(run.id);
+            if (this.runs.size >= MAX_RETAINED_RUNS)
+                throw new Error(`${MAX_RETAINED_RUNS} fleets are already running; wait for one to finish or cancel one`);
+        }
+        const id = randomUUID();
+        const abort = new AbortController();
+        const run = {
+            id,
+            directory,
+            started: now,
+            pending: "",
+            next: 0,
+            events: [],
+            counters: {},
+            abort,
+            finished: Promise.resolve(),
+        };
+        this.runs.set(id, run);
+        // Store rejection as data; starting a job must never produce an unhandled promise.
+        run.finished = Promise.resolve()
+            .then(() => this.execute({
+            ...options,
+            onOutput: (chunk) => this.output(run, chunk),
+            signal: abort.signal,
+        }))
+            .then((result) => {
+            run.result = result;
+        }, (error) => {
+            run.error = error instanceof Error ? error.message : String(error);
+        })
+            .finally(() => {
+            if (run.pending)
+                this.output(run, "\n");
+            run.ended = Date.now();
+        });
+        return id;
+    }
+    /** Start a run and wait for it, under the same per-directory guard; `signal` cancels it. */
+    async run(options, signal) {
+        const id = this.start(options);
+        const cancel = () => this.cancel(id);
+        if (signal?.aborted)
+            cancel();
+        else
+            signal?.addEventListener("abort", cancel, { once: true });
+        try {
+            await this.get(id).finished;
+        }
+        finally {
+            signal?.removeEventListener("abort", cancel);
+        }
+        return this.result(id, true);
+    }
+    /** Interrupt a running fleet; it gets a grace to cancel its workers before it is killed. */
+    cancel(id) {
+        const run = this.get(id);
+        if (run.ended === undefined)
+            run.abort.abort();
+        return this.status(id);
+    }
+    /** Interrupt every running fleet and wait, bounded, for them to end. For shutdown. */
+    async cancelAll(waitMs = SHUTDOWN_WAIT_MS) {
+        const running = [...this.runs.values()].filter((r) => !r.ended);
+        for (const run of running)
+            run.abort.abort();
+        let timer;
+        await Promise.race([
+            Promise.all(running.map((r) => r.finished)),
+            new Promise((resolve) => (timer = setTimeout(resolve, waitMs))),
+        ]);
+        clearTimeout(timer);
+    }
+    output(run, chunk) {
+        run.pending += chunk;
+        const lines = run.pending.split(/\r?\n/);
+        run.pending = lines.pop() ?? "";
+        // A malformed unterminated log line must not grow without bound.
+        if (run.pending.length > 1024 * 1024)
+            run.pending = run.pending.slice(-1024 * 1024);
+        for (const line of lines) {
+            const match = line.match(/SKYRAMP_(?:LIMIT|PROGRESS) (\{.*\})$/);
+            if (!match)
+                continue;
+            try {
+                const event = JSON.parse(match[1]);
+                if (typeof event.runStartedAt === "string" &&
+                    Number.isFinite(Date.parse(event.runStartedAt)) &&
+                    (!run.runStartedAt ||
+                        Date.parse(event.runStartedAt) < Date.parse(run.runStartedAt))) {
+                    run.runStartedAt = event.runStartedAt;
+                }
+                if (event.stats && typeof event.host === "string")
+                    run.counters[event.host] = event.stats;
+                if (event.phase !== "limit")
+                    continue;
+                run.events.push({ sequence: run.next++, event });
+                if (run.events.length > MAX_EVENTS)
+                    run.events.shift();
+            }
+            catch {
+                /* Unrelated or truncated output is not a limit event. */
+            }
+        }
+    }
+    get(id) {
+        const run = this.runs.get(id);
+        if (!run)
+            throw new Error("unknown fleet runId (use the same MCP session)");
+        return run;
+    }
+    status(id, since = 0) {
+        const run = this.get(id);
+        if (!Number.isSafeInteger(since) || since < 0 || since > run.next)
+            throw new Error("invalid event cursor");
+        const first = run.events[0]?.sequence ?? run.next;
+        const pending = run.events.filter((e) => e.sequence >= since);
+        const events = pending.slice(0, MAX_PAGE_EVENTS);
+        const more = events.length < pending.length;
+        return {
+            runId: id,
+            done: run.ended !== undefined,
+            events,
+            next: more ? events[events.length - 1].sequence + 1 : run.next,
+            more,
+            truncated: since < first,
+            counters: run.counters,
+            cancelled: run.abort.signal.aborted || undefined,
+            elapsedMs: (run.ended ?? Date.now()) - run.started,
+            runStartedAt: run.runStartedAt,
+            error: run.error,
+        };
+    }
+    result(id, release = false) {
+        const run = this.get(id);
+        if (!run.ended)
+            throw new Error("fleet is still running; poll skyramp_fleet_status");
+        if (release)
+            this.runs.delete(id);
+        if (run.error)
+            throw new Error(run.error);
+        return run.result;
+    }
+}
+export const fleetRuns = new FleetRunRegistry();

package/build/services/containerEnv.js

@@ -36,8 +36,14 @@ const PASSTHROUGH_RESERVED_EXACT = new Set([
 const PASSTHROUGH_RESERVED_PREFIXES = ["SKYRAMP_"];
 // CI identity and secret-shaped names. Testbot puts the workflow GitHub token
 // in the MCP process env, and a declaration would send it to the container and
-// into a query string, where the SUT access log records it.
-const PASSTHROUGH_CREDENTIAL_EXACT = new Set(["GITHUB_TOKEN", "GH_TOKEN"]);
+// into a query string, where the SUT access log records it. The Azure DevOps
+// names are the pipeline's token and the `az devops` CLI's.
+const PASSTHROUGH_CREDENTIAL_EXACT = new Set([
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "SYSTEM_ACCESSTOKEN",
+    "AZURE_DEVOPS_EXT_PAT",
+]);
 const PASSTHROUGH_CREDENTIAL_PREFIXES = ["ACTIONS_", "AWS_"];
 const PASSTHROUGH_CREDENTIAL_SUBSTRINGS = ["_SECRET", "_PRIVATE_KEY"];
 /** Why a name is refused, or null when it is allowed. The two reasons need

package/build/services/fleetLimitConfirmation.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The limit lines a fleet file will run, read from the file itself so a confirmation
+ * covers what actually executes. Fails closed on anything but one list of string literals.
+ */
+export declare function readFleetFileLimits(fleetFile: string): string[];
+/** Ties a confirmation to one fleet file and the exact set of limits it runs. */
+export declare function limitConfirmationToken(fleetFile: string, limits: string[]): string;
+/**
+ * D10: a fleet that carries limits runs only with the token the generation returned
+ * beside the echoed limits. The token is recomputed from the fleet file, so an edited
+ * limit, another fleet or a guessed value does not pass. It binds the run to the echoed
+ * limits; it does not prove the user confirmed them, which is the agent's job. A fleet
+ * with no limits (legacy thresholds included) runs as before.
+ */
+export declare function assertFleetLimitsConfirmed(args: {
+    directory: string;
+    entryClass?: string;
+    confirmationToken?: string;
+}): void;

package/build/services/fleetLimitConfirmation.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import fs from "fs";
+import path from "path";
+import { findEntryClass, fleetFileName, fleetLanguage, } from "./FleetExecutionService.js";
+/**
+ * Where each language's generated fleet file opens its limit list: Java's builder
+ * `.limits(List.of(`, Python's `limits=[` and TypeScript/JavaScript's `limits: [`.
+ */
+const LIMITS_OPENER = {
+    java: /\.\s*limits\s*\(\s*List\s*\.\s*of\s*\(/,
+    python: /\blimits\s*=\s*\[/,
+    typescript: /\blimits\s*:\s*\[/,
+    javascript: /\blimits\s*:\s*\[/,
+};
+/** One double-quoted literal; the generator writes JSON-compatible escapes in every language. */
+const STRING_LITERAL = /\s*("(?:[^"\\]|\\.)*")\s*,?/y;
+/** Any mention of limits: a variable, a quoted key, a second list or a comment. */
+const LIMITS_WORD = /\blimits\b/g;
+/**
+ * What actually closes the limit list in each language: Java's `List.of(` and `.limits(`
+ * must both close, a bare array literal just needs its `]`.
+ */
+const LIMITS_CLOSER = {
+    java: /^\s*\)\s*\)/,
+    python: /^\s*\]/,
+    typescript: /^\s*\]/,
+    javascript: /^\s*\]/,
+};
+/**
+ * What may follow the closed list without silently extending its value, e.g. Python's
+ * `["safe"] + [...]` or TypeScript's `["safe"].concat([...])`. Java allows a `.` because
+ * by this point the list itself is already closed, so a `.` only continues the
+ * surrounding builder chain (`.limits(List.of(...)).timeout(5)`).
+ */
+const LIMITS_TERMINATOR = {
+    java: /^(?:$|[.,;)}])/,
+    python: /^(?:$|[,;)}])/,
+    typescript: /^(?:$|[,;)}])/,
+    javascript: /^(?:$|[,;)}])/,
+};
+/**
+ * The limit lines a fleet file will run, read from the file itself so a confirmation
+ * covers what actually executes. Fails closed on anything but one list of string literals.
+ */
+export function readFleetFileLimits(fleetFile) {
+    const source = fs.readFileSync(fleetFile, "utf8");
+    const unreadable = new Error(`${path.basename(fleetFile)} sets limits that are not one list of plain string ` +
+        "literals; regenerate it so the limits can be confirmed");
+    const mentions = source.match(LIMITS_WORD)?.length ?? 0;
+    const language = fleetLanguage(path.basename(fleetFile));
+    const opener = LIMITS_OPENER[language].exec(source);
+    if (!opener) {
+        if (mentions > 0)
+            throw unreadable;
+        return [];
+    }
+    if (mentions > 1)
+        throw unreadable;
+    const limits = [];
+    // A failed sticky match resets lastIndex, so the position is kept here.
+    let at = opener.index + opener[0].length;
+    for (;;) {
+        STRING_LITERAL.lastIndex = at;
+        const m = STRING_LITERAL.exec(source);
+        if (!m)
+            break;
+        try {
+            limits.push(JSON.parse(m[1]));
+        }
+        catch {
+            throw unreadable;
+        }
+        at = STRING_LITERAL.lastIndex;
+    }
+    const closer = LIMITS_CLOSER[language].exec(source.slice(at));
+    if (!closer)
+        throw unreadable;
+    const afterClose = source.slice(at + closer[0].length).trimStart();
+    if (!LIMITS_TERMINATOR[language].test(afterClose))
+        throw unreadable;
+    return limits;
+}
+/** Ties a confirmation to one fleet file and the exact set of limits it runs. */
+export function limitConfirmationToken(fleetFile, limits) {
+    let file = path.resolve(fleetFile);
+    try {
+        file = fs.realpathSync(file);
+    }
+    catch {
+        // A file that does not exist yet cannot be confirmed anyway.
+    }
+    const set = [...new Set(limits.map((l) => l.trim()))].sort();
+    return createHash("sha256")
+        .update(file + "\0" + set.join("\n"))
+        .digest("hex")
+        .slice(0, 16);
+}
+/**
+ * D10: a fleet that carries limits runs only with the token the generation returned
+ * beside the echoed limits. The token is recomputed from the fleet file, so an edited
+ * limit, another fleet or a guessed value does not pass. It binds the run to the echoed
+ * limits; it does not prove the user confirmed them, which is the agent's job. A fleet
+ * with no limits (legacy thresholds included) runs as before.
+ */
+export function assertFleetLimitsConfirmed(args) {
+    const directory = path.resolve(args.directory);
+    if (!fs.existsSync(directory))
+        return; // the run itself reports the missing directory
+    const fleetFile = path.join(directory, fleetFileName(findEntryClass(directory, args.entryClass)));
+    if (!fs.existsSync(fleetFile))
+        return;
+    const limits = readFleetFileLimits(fleetFile);
+    if (limits.length === 0)
+        return;
+    const expected = limitConfirmationToken(fleetFile, limits);
+    if (args.confirmationToken === expected)
+        return;
+    throw new Error((args.confirmationToken
+        ? "confirmationToken does not match the limits in "
+        : "no confirmationToken was passed for the limits in ") +
+        `${path.basename(fleetFile)}:\n` +
+        limits.map((l) => `- ${l}`).join("\n") +
+        "\nThe user confirms limits through the echo of skyramp_ui_load_test_generation, " +
+        "which returns the confirmationToken. Echo these limits, wait for the user's " +
+        "confirmation, and pass that token; regenerate the fleet if you do not hold it.");
+}

package/build/tool-phases.d.ts

@@ -1,11 +1,12 @@
 /**
- * Canonical mapping of Skyramp MCP tool names to testbot progress phases.
+ * One entry per Skyramp MCP tool: its testbot progress phase, if it has one,
+ * and the entitlement code it needs when the run has a SKYRAMP_RUN_TOKEN.
+ * Every registered tool must have an entry; tool-phase-coverage.test.ts fails
+ * when one is missing.
  *
- * The testbot progress UI reads this map at runtime to know which tool calls
- * correspond to which progress steps. When adding or renaming tools, update
- * this map so the progress UI stays accurate.
- *
- * Tools not in this map must be listed in TOOLS_WITHOUT_PHASE.
+ * The testbot progress UI reads TOOL_PHASE_MAP at runtime (through the
+ * `@skyramp/mcp/tool-phases` package export) to know which tool calls
+ * correspond to which progress steps.
  *
  * Phases: analyzing, generating, executing, maintaining, reporting
  *
@@ -29,10 +30,15 @@ export type PhaseMapping = string | {
     before: string;
     after: string;
 };
+export type EntitlementCode = "analyze" | "recommend" | "generate" | "execute";
+export declare const NOT_GATED = "not gated";
+export type ToolEntry = {
+    phase?: PhaseMapping;
+    entitlement: EntitlementCode | typeof NOT_GATED;
+};
+export declare const TOOLS: Readonly<Record<string, ToolEntry>>;
 export declare const TOOL_PHASE_MAP: Record<string, PhaseMapping>;
 /** Tools whose phase depends on context — listed here for consumer discovery. */
 export declare const CONTEXT_DEPENDENT_TOOLS: Set<string>;
 /** All tools that belong to the "generating" phase — used as the boundary. */
 export declare const GENERATING_TOOLS: Set<string>;
-/** Tools that intentionally have no progress phase (infrastructure/utility). */
-export declare const TOOLS_WITHOUT_PHASE: Set<string>;

package/build/tool-phases.js

@@ -1,25 +1,92 @@
-export const TOOL_PHASE_MAP = {
-    skyramp_recommend_tests: "analyzing",
-    skyramp_analyze_changes: "analyzing",
-    skyramp_register_test_plan: "analyzing",
-    skyramp_smoke_test_generation: "generating",
-    skyramp_fuzz_test_generation: "generating",
-    skyramp_contract_test_generation: "generating",
-    skyramp_load_test_generation: "generating",
-    skyramp_integration_test_generation: "generating",
-    skyramp_e2e_test_generation: "generating",
-    skyramp_ui_test_generation: "generating",
-    skyramp_ui_load_test_generation: "generating",
-    skyramp_batch_scenario_test_generation: "generating",
-    skyramp_mock_generation: "generating",
-    skyramp_batch_mock_generation: "generating",
-    skyramp_generate_enriched_integration_test: "generating",
-    skyramp_enrich_test_with_mocks: "generating",
-    skyramp_execute_test: { before: "maintaining", after: "executing" },
-    skyramp_execute_fleet: { before: "maintaining", after: "executing" },
-    skyramp_analyze_test_health: "maintaining",
-    skyramp_submit_report: "reporting",
+import { ESSENTIAL_TOOLS } from "./playwright/essentialTools.js";
+export const NOT_GATED = "not gated";
+const EXECUTION_PHASE = { before: "maintaining", after: "executing" };
+export const TOOLS = {
+    skyramp_analyze_changes: { phase: "analyzing", entitlement: "analyze" },
+    skyramp_analyze_test_health: {
+        phase: "maintaining",
+        entitlement: "analyze",
+    },
+    // A prompt, not a tool; listed for its phase.
+    skyramp_recommend_tests: { phase: "analyzing", entitlement: "recommend" },
+    skyramp_register_test_plan: { phase: "analyzing", entitlement: "recommend" },
+    skyramp_resolve_screen: { entitlement: "recommend" },
+    skyramp_smoke_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_fuzz_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_contract_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_load_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_integration_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_e2e_test_generation: { phase: "generating", entitlement: "generate" },
+    skyramp_ui_test_generation: { phase: "generating", entitlement: "generate" },
+    skyramp_ui_load_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_batch_scenario_test_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_mock_generation: { phase: "generating", entitlement: "generate" },
+    skyramp_batch_mock_generation: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_generate_enriched_integration_test: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_enrich_test_with_mocks: {
+        phase: "generating",
+        entitlement: "generate",
+    },
+    skyramp_reuse_code: { entitlement: "generate" },
+    skyramp_modularization: { entitlement: "generate" },
+    skyramp_enhance_assertions: { entitlement: "generate" },
+    skyramp_enhance_assertions_snapshot: { entitlement: "generate" },
+    skyramp_verify_enhance_assertions: { entitlement: "generate" },
+    skyramp_align_assertions: { entitlement: "generate" },
+    skyramp_verify_test_dependencies: { entitlement: "generate" },
+    skyramp_fix_errors: { entitlement: "generate" },
+    skyramp_actions: { entitlement: "generate" },
+    skyramp_one_click_tool: { entitlement: "generate" },
+    skyramp_preflight_mock_check: { entitlement: "generate" },
+    skyramp_setup_local_dev_worker: { entitlement: "generate" },
+    skyramp_query_proxy_mocks: { entitlement: "generate" },
+    ...Object.fromEntries([...ESSENTIAL_TOOLS].map((name) => [
+        name,
+        { entitlement: "generate" },
+    ])),
+    skyramp_execute_test: { phase: EXECUTION_PHASE, entitlement: "execute" },
+    skyramp_execute_fleet: { phase: EXECUTION_PHASE, entitlement: "execute" },
+    skyramp_start_fleet: { phase: EXECUTION_PHASE, entitlement: "execute" },
+    skyramp_fleet_status: { phase: EXECUTION_PHASE, entitlement: "execute" },
+    skyramp_fleet_result: { phase: "reporting", entitlement: "execute" },
+    skyramp_fleet_cancel: { phase: EXECUTION_PHASE, entitlement: "execute" },
+    skyramp_kpi_catalog: { entitlement: NOT_GATED },
+    skyramp_start_trace_collection: { entitlement: "execute" },
+    skyramp_stop_trace_collection: { entitlement: "execute" },
+    skyramp_submit_report: { phase: "reporting", entitlement: NOT_GATED },
+    skyramp_login: { entitlement: NOT_GATED },
+    skyramp_logout: { entitlement: NOT_GATED },
+    skyramp_init_scan: { entitlement: NOT_GATED },
+    skyramp_init_workspace: { entitlement: NOT_GATED },
 };
+export const TOOL_PHASE_MAP = Object.fromEntries(Object.entries(TOOLS).flatMap(([name, entry]) => entry.phase === undefined ? [] : [[name, entry.phase]]));
 /** Tools whose phase depends on context — listed here for consumer discovery. */
 export const CONTEXT_DEPENDENT_TOOLS = new Set(Object.entries(TOOL_PHASE_MAP)
     .filter((entry) => typeof entry[1] === "object")
@@ -28,25 +95,3 @@ export const CONTEXT_DEPENDENT_TOOLS = new Set(Object.entries(TOOL_PHASE_MAP)
 export const GENERATING_TOOLS = new Set(Object.entries(TOOL_PHASE_MAP)
     .filter((entry) => typeof entry[1] === "string" && entry[1] === "generating")
     .map((entry) => entry[0]));
-/** Tools that intentionally have no progress phase (infrastructure/utility). */
-export const TOOLS_WITHOUT_PHASE = new Set([
-    "skyramp_login",
-    "skyramp_logout",
-    "skyramp_init_scan",
-    "skyramp_init_workspace",
-    "skyramp_one_click_tool",
-    "skyramp_setup_local_dev_worker",
-    "skyramp_actions",
-    "skyramp_start_trace_collection",
-    "skyramp_stop_trace_collection",
-    "skyramp_fix_errors",
-    "skyramp_modularization",
-    "skyramp_reuse_code",
-    "skyramp_enhance_assertions",
-    "skyramp_enhance_assertions_snapshot",
-    "skyramp_verify_enhance_assertions",
-    "skyramp_align_assertions",
-    "skyramp_preflight_mock_check",
-    "skyramp_query_proxy_mocks",
-    "skyramp_verify_test_dependencies",
-]);

package/build/tools/code-refactor/assertion-state.js

@@ -3,7 +3,7 @@ import { realpathSync } from "fs";
 import { mkdir, readFile, rm, writeFile } from "fs/promises";
 import { logger } from "../../utils/logger.js";
 import { resolveRunStatePath, StateManager, } from "../../utils/AnalysisStateManager.js";
-import { computeAssertionMetrics, detectAssertionLanguage, formatAssertionVerifyReport, sha256Of, verifyAssertionEnhancement, } from "../../utils/assertion-verify/index.js";
+import { collectCreatedAddLines, computeAssertionMetrics, detectAssertionLanguage, formatAssertionVerifyReport, sha256Of, verifyAssertionEnhancement, } from "../../utils/assertion-verify/index.js";
 /**
  * Persistence for the assertion-enhancement verification loop, keyed by the
  * spec's CANONICAL absolute path in `UnifiedAnalysisState.assertionOutcomes`.
@@ -157,6 +157,7 @@ export async function recordAssertionBaseline(testFile, testType, enhanceType, e
             baselineCount: metrics?.count,
             baselineStrength: metrics?.strengthScore,
             baselineFingerprints: metrics?.fingerprints,
+            baselineCreatedAddLines: collectCreatedAddLines(content),
             issuedAt: new Date().toISOString(),
         }), explicitStateFile, data);
         // A failed record write must not strand an orphan copy nobody references.
@@ -203,6 +204,7 @@ export function baselineFrom(record, testFile) {
         count: record.baselineCount,
         strengthScore: record.baselineStrength,
         fingerprints: record.baselineFingerprints,
+        createdAddLines: record.baselineCreatedAddLines,
         baselineFilePath: record.baselineFilePath,
     };
 }

package/build/tools/code-refactor/codeReuseTool.js

@@ -469,8 +469,9 @@ export function registerCodeReuseTool(server) {
             return errorResult;
         }
         finally {
+            // No prompt: it carries the user's test code, and PushToolEvent
+            // forwards every field verbatim.
             AnalyticsService.pushMCPToolEvent(TOOL_NAME, errorResult, {
-                prompt: params.prompt,
                 testFile: params.testFile,
                 language: params.language,
                 framework: params.framework,

package/build/tools/code-refactor/utils-verify-gates.js

@@ -248,7 +248,7 @@ function inlineCallSitesAdvisory(r) {
         "",
         "",
         `ADVISORY — ${n} ${family.inlineSite.noun}${n === 1 ? "" : "s"} in other Skyramp-generated tests that a shared helper already ${family.inlineSite.already}:`,
-        ...r.inlineCallSites.map((c) => `- ${show(c.file, r)}:${lines(c)}${c.localHelper ? ` (in local helper ${c.localHelper})` : ""} · ${what(c)} · ${labelOf(c.utilsFile)}.${c.helper}`),
+        ...r.inlineCallSites.map((c) => `- ${show(c.file, r)}:${lines(c)}${c.localHelper ? ` (in local helper ${c.localHelper})` : ""} · ${what(c)} · ${labelOf(c.utilsFile)}.${c.helper}${c.kind === "sequence" && c.call ? ` · replace lines ${lines(c)} (the generated bindings in them included) with \`${c.call}\`` : ""}`),
         `${family.inlineSite.instruction} ${inlineSiteTail(family.inlineSite.localCopy)}`,
     ].join("\n");
 }

package/build/tools/executeFleetTool.d.ts

@@ -3,9 +3,11 @@ import { McpServer } from "@modelcontextprotocol/server";
 export declare const fleetExecutionInputSchema: {
     directory: z.ZodString;
     entryClass: z.ZodOptional<z.ZodString>;
-    certsDir: z.ZodString;
+    certsDir: z.ZodOptional<z.ZodString>;
+    localDocker: z.ZodOptional<z.ZodBoolean>;
     credentials: z.ZodOptional<z.ZodString>;
     libraryJar: z.ZodOptional<z.ZodString>;
+    libraryPackage: z.ZodOptional<z.ZodString>;
     executorImage: z.ZodOptional<z.ZodString>;
     platform: z.ZodOptional<z.ZodEnum<{
         linux: "linux";
@@ -13,6 +15,7 @@ export declare const fleetExecutionInputSchema: {
     }>>;
     timeoutSec: z.ZodOptional<z.ZodNumber>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    confirmationToken: z.ZodOptional<z.ZodString>;
 };
 /**
  * Runs a generated fleet test and reports what happened.
@@ -21,8 +24,7 @@ export declare const fleetExecutionInputSchema: {
  * executor container every other generated test runs in compiles the trio and starts the
  * fleet manager, and the caller gets the run's own report plus its result as data.
  *
- * The worker is deployed by the test, not by this tool, so the run needs a remote Docker
- * engine: inside a container, a locally deployed worker is not reachable at the localhost
- * address the fleet resolves for it.
+ * The worker is deployed by the test, not by this tool: on a remote Docker engine over mTLS,
+ * or, for a host that names no engine, on the local daemon through its socket.
  */
 export declare function registerExecuteFleetTool(server: McpServer): void;