@zibby/core 0.3.5 → 0.3.7

package/dist/templates/generate-test-cases/nodes/setup-node.js

@@ -0,0 +1,142 @@
+/**
+ * Setup Node - Clone repositories and initialize git baseline
+ * Used by: analysisGraph, implementationGraph
+ */
+
+import { spawn } from 'child_process';
+import { join } from 'path';
+import { z } from 'zod';
+
+const SetupOutputSchema = z.object({
+  success: z.boolean(),
+  clonedRepos: z.array(z.object({
+    name: z.string(),
+    path: z.string(),
+    isPrimary: z.boolean().optional()
+  })),
+  baselineCommit: z.string()
+});
+
+export const setupNode = {
+  name: 'setup',
+  outputSchema: SetupOutputSchema,
+  execute: async (state) => {
+    console.log('\n🔧 Setting up environment...');
+    
+    const { workspace, repos, githubToken } = state;
+    const gitlabToken = process.env.GITLAB_TOKEN || '';
+    const gitlabUrl = process.env.GITLAB_URL || '';
+    
+    // DEBUG: Log token status
+    console.log(`🔑 GitHub Token: ${githubToken ? 'Present' : 'MISSING'}`);
+    console.log(`🔑 GitLab Token: ${gitlabToken ? 'Present' : 'MISSING'}`);
+    if (gitlabUrl) console.log(`🔑 GitLab URL: ${gitlabUrl}`);
+    
+    // Log environment
+    console.log('Container: ECS Fargate');
+    console.log('Memory: 4GB');
+    console.log('CPU: 2 vCPU');
+    console.log('Tools: Node.js, Git, Cursor CLI, Zibby CLI');
+    console.log(`Working directory: ${workspace}`);
+    
+    // Clone repositories
+    console.log('\n📦 Cloning repositories...');
+    
+    const clonedRepos = [];
+    for (const repo of repos) {
+      console.log(`Cloning ${repo.name}...`);
+      
+      const repoDir = join(workspace, repo.name);
+      
+      // Use token for authentication based on provider
+      let cloneUrl = repo.url;
+      let cloneEnv = {};
+      const isGitlab = repo.provider === 'gitlab' || (gitlabUrl && repo.url.includes(new URL(gitlabUrl).host));
+      const isGithub = repo.provider === 'github' || repo.url.includes('github.com');
+      
+      if (isGithub && githubToken) {
+        cloneUrl = repo.url.replace('https://github.com', `https://x-access-token:${githubToken}@github.com`);
+        cloneEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo' };
+      } else if (isGitlab && gitlabToken && gitlabUrl) {
+        try {
+          const gitlabHost = new URL(gitlabUrl).host;
+          cloneUrl = repo.url.replace(`https://${gitlabHost}`, `https://oauth2:${gitlabToken}@${gitlabHost}`);
+        } catch (e) {
+          console.warn(`⚠️ Failed to parse GITLAB_URL: ${e.message}`);
+        }
+        cloneEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo' };
+      }
+      
+      // Shallow clone with progress output (async, non-blocking)
+      await execCommand(
+        `git clone --progress --depth 1 --branch ${repo.branch} "${cloneUrl}" "${repoDir}"`,
+        workspace,
+        cloneEnv
+      );
+      console.log(`✓ Cloned ${repo.name} on branch ${repo.branch}`);
+      
+      clonedRepos.push({
+        name: repo.name,
+        path: repoDir,
+        isPrimary: repo.isPrimary
+      });
+    }
+    
+    // Initialize git in workspace for diff tracking
+    await execCommand('git init', workspace);
+    await execCommand('git config user.email "zibby@agent.com"', workspace);
+    await execCommand('git config user.name "Zibby Agent"', workspace);
+    await execCommand('git add .', workspace);
+    await execCommand('git commit --allow-empty -m "baseline"', workspace);
+    
+    console.log('✅ Environment ready');
+    
+    const baselineCommit = await execCommand('git rev-parse HEAD', workspace);
+    
+    return {
+      success: true,
+      clonedRepos,
+      baselineCommit: baselineCommit.trim()
+    };
+  }
+};
+
+// Async version using spawn - streams output in real-time, doesn't block event loop
+async function execCommand(command, cwd, env = {}) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(command, {
+      cwd,
+      shell: true,
+      env: Object.keys(env).length > 0 ? env : process.env
+    });
+    
+    let stdout = '';
+    let stderr = '';
+    
+    // Stream stdout as it comes (triggers middleware setInterval!)
+    proc.stdout.on('data', (data) => {
+      const output = data.toString();
+      stdout += output;
+      console.log(output.trimEnd());
+    });
+    
+    // Stream stderr as it comes
+    proc.stderr.on('data', (data) => {
+      const output = data.toString();
+      stderr += output;
+      console.log(output.trimEnd());
+    });
+    
+    proc.on('close', (code) => {
+      if (code !== 0) {
+        reject(new Error(`Command failed with exit code ${code}: ${command}`));
+      } else {
+        resolve(stdout || stderr || '');
+      }
+    });
+    
+    proc.on('error', (err) => {
+      reject(new Error(`Command error: ${command} - ${err.message}`));
+    });
+  });
+}

package/dist/templates/generate-test-cases/state.js

@@ -0,0 +1,54 @@
+/**
+ * State schema for the generate-test-cases standalone template.
+ *
+ * Same shape as code-analysis (workspace + repos + ticketContext) PLUS
+ * a `codeImplementation` field — the diff this template generates tests
+ * for. In code-analysis that field is produced by the upstream
+ * generate_code node; here, the user provides it directly.
+ */
+
+import { z } from 'zod';
+
+export const generateTestCasesStateSchema = z.object({
+  workspace: z.string().describe('Local workspace path'),
+
+  repos: z.array(z.object({
+    name: z.string(),
+    url: z.string().url(),
+    path: z.string().optional(),
+    branch: z.string().default('main'),
+    isPrimary: z.boolean().default(false),
+  })).optional().describe('Repository configurations (cloned by setup node so the LLM can explore routing/components)'),
+
+  ticketContext: z.object({
+    key: z.string().regex(/^[A-Z]+-\d+$/, 'Invalid ticket format (expected PROJ-123)').optional(),
+    ticketKey: z.string().optional(),
+    summary: z.string().min(1).describe('Ticket summary/title'),
+    description: z.any().optional().describe('Ticket description (string or ADF object)'),
+    acceptanceCriteria: z.string().optional(),
+    type: z.string().optional(),
+    priority: z.string().optional(),
+    labels: z.array(z.string()).optional(),
+    components: z.array(z.string()).optional(),
+  }).describe('Jira/ticket context — informs test priorities + naming'),
+
+  // The new direct-input field that distinguishes this standalone template
+  // from code-analysis. In code-analysis this comes from generate_code's
+  // output; here the user supplies it (e.g. from `git diff` of a PR they
+  // want tests for).
+  codeImplementation: z.object({
+    diff: z.string().describe('Unified-diff string of the changes'),
+    changedFiles: z.array(z.string()).describe('List of file paths touched'),
+  }).describe('Code changes to generate tests for'),
+
+  githubToken: z.string().optional().describe('GitHub PAT (needed only if repos[].url requires auth)'),
+  model: z.string().default('auto').describe('AI model to use'),
+  nodeConfigs: z.record(z.string(), z.any()).optional().describe('Per-node configuration overrides (e.g. extractContext for test credentials)'),
+});
+
+// Clean isolation: this schema declares ONLY what the template's nodes
+// actually need. No EXECUTION_ID / PROGRESS_QUEUE_URL / SQS_AUTH_TOKEN
+// / PROJECT_API_TOKEN — those were legacy analysis-UI plumbing fields
+// and the new templates run via the standard `workflow run` /
+// `workflow trigger` cloud pipeline, which has its own progress
+// reporting outside the state object.

package/dist/templates/index.js

@@ -12,6 +12,18 @@ export const TEMPLATES = {
     description: 'Complete browser test automation workflow with title generation, live execution, and script generation',
     path: join(__dirname, 'browser-test-automation'),
     default: true,
+    // Suggested slug for `zibby workflow new <slug> -t <name>`. Used in
+    // the `template list` scaffold hint so the printed command is
+    // copy-paste-ready instead of `your-workflow-name`. Users can still
+    // pick anything they want at scaffold time.
+    defaultSlug: 'browser-tests',
+    // Runtime deps the scaffolded copy needs in addition to @zibby/core.
+    // graph.mjs now imports state.js which `import { z } from 'zod'`s
+    // directly, so the user's package.json must declare zod or the
+    // scaffolded workflow fails on first import.
+    deps: {
+      zod: '^3.23.0',
+    },
     features: [
       'Preflight analysis: extract title + assertion checklist from spec',
       'Execute test live with AI + browser (Claude or Cursor)',
@@ -19,6 +31,47 @@ export const TEMPLATES = {
       'Real-time streaming output',
       'Video recording of browser sessions'
     ]
+  },
+  'code-analysis': {
+    name: 'code-analysis',
+    displayName: 'Code Analysis (Ticket → Code + Tests)',
+    description: 'Multi-node workflow that analyzes a Jira ticket against a code repo, generates code changes, and emits test cases',
+    path: join(__dirname, 'code-analysis'),
+    defaultSlug: 'ticket-analyzer',
+    // Runtime deps the scaffolded copy needs in addition to @zibby/core.
+    // Merged into the generated package.json so `npm install` works
+    // without manual edits. Browser-test doesn't declare any because
+    // its nodes only depend on @zibby/core.
+    deps: {
+      axios: '^1.6.0',
+      handlebars: '^4.7.8',
+      zod: '^3.23.0',
+    },
+    features: [
+      'Clone repos + snapshot git baseline',
+      'LLM analysis of ticket against codebase (canProceed gate)',
+      'Conditional routing: skip code-gen if ticket is invalid',
+      'Generate scoped code changes',
+      'Generate test cases covering the changes',
+      'Customizable prompts in prompts/*.md'
+    ]
+  },
+  'generate-test-cases': {
+    name: 'generate-test-cases',
+    displayName: 'Generate Test Cases (Diff → Test Specs)',
+    description: 'Standalone slice — takes an existing code diff and generates plain-English test specifications for it. Skips ticket-analysis and code-gen.',
+    path: join(__dirname, 'generate-test-cases'),
+    defaultSlug: 'tests-from-diff',
+    deps: {
+      zod: '^3.23.0',
+    },
+    features: [
+      'Two-node graph: setup → generate_test_cases',
+      'Takes a PR diff directly as state input (no upstream code-gen needed)',
+      'LLM explores codebase routing/components for accurate test steps',
+      'Emits 4-8 prioritized test specs (Critical/High/Medium/Low)',
+      'Plain-English test steps — runnable by AI agents'
+    ]
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zibby/core",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Core test automation engine with multi-agent and multi-MCP support",
   "type": "module",
   "main": "dist/index.js",
@@ -10,6 +10,7 @@
     "./sync": "./dist/sync/index.js",
     "./function-bridge.js": "./dist/function-bridge.js",
     "./function-skill-registry.js": "./dist/function-skill-registry.js",
+    "./utils/adf-converter.js": "./dist/utils/adf-converter.js",
     "./utils/ast-utils.js": "./dist/utils/ast-utils.js",
     "./utils/mcp-config-writer.js": "./dist/utils/mcp-config-writer.js",
     "./utils/node-schema-parser.js": "./dist/utils/node-schema-parser.js",

package/templates/browser-test-automation/graph.mjs

@@ -6,30 +6,44 @@
  */
 
 import { WorkflowAgent, WorkflowGraph } from '@zibby/core';
-import { 
-  preflightNode, 
-  executeLiveNode, 
+import {
+  preflightNode,
+  executeLiveNode,
   generateScriptNode,
 } from './nodes/index.mjs';
 import { BrowserTestResultHandler } from './result-handler.mjs';
+import { browserTestAutomationStateSchema } from './state.js';
 
 export class BrowserTestAutomationAgent extends WorkflowAgent {
   buildGraph() {
     const graph = new WorkflowGraph();
+    graph.setStateSchema(browserTestAutomationStateSchema);
 
     graph.addNode('preflight', preflightNode);
     graph.addNode('execute_live', executeLiveNode);
     graph.addNode('generate_script', generateScriptNode);
             
     graph.setEntryPoint('preflight');
-    graph.addEdge('preflight', 'execute_live');
-    
+
+    // Short-circuit when preflight produced nothing usable. Triggered when:
+    //   - the user invoked `zibby workflow run browser-tests` with no spec
+    //     (state.input is undefined / empty), so preflight had nothing to
+    //     analyze and the LLM came back with `assertions: []`
+    //   - the spec is so vague the LLM can't extract any assertions
+    // Without this gate the graph would barrel into execute_live, fire up
+    // a real browser session + a second expensive LLM call, then waste
+    // ~30s before failing — bad UX and bad bill.
+    graph.addConditionalEdges('preflight', (state) => {
+      const assertions = state.preflight?.assertions || [];
+      return assertions.length > 0 ? 'execute_live' : 'END';
+    });
+
     graph.addConditionalEdges('execute_live', (state) => {
       const result = state.execute_live;
       const hasExecution = (result?.steps?.length > 0) || (result?.actions?.length > 0);
       return hasExecution ? 'generate_script' : 'END';
     });
-    
+
     graph.addEdge('generate_script', 'END');
     return graph;
   }

package/templates/browser-test-automation/nodes/preflight.mjs

@@ -13,7 +13,7 @@
  * - generate_script: must implement each assertion in the test
  */
 
-import { z } from '@zibby/core';
+import { z, invokeAgent } from '@zibby/core';
 import { writeFileSync } from 'fs';
 import { join } from 'path';
 
@@ -27,8 +27,57 @@ const PreflightOutputSchema = z.object({
   assertions: z.array(AssertionSchema).describe('Every expected result from the spec as a verifiable assertion')
 });
 
+// Detect "no usable spec" before invoking the LLM. Catches:
+//   - state.testSpec is undefined (workflow run with no input)
+//   - empty string / whitespace only
+//   - the literal string "undefined" (some upstream paths stringify
+//     undefined into state, e.g. when --param isn't passed)
+function isMissingSpec(spec) {
+  if (spec == null) return true;
+  const s = String(spec).trim();
+  return s === '' || s.toLowerCase() === 'undefined';
+}
+
+const PROMPT = (testSpec) => `Analyze this test specification and extract:
+1. A concise test title (5-10 words, action-oriented). If you find a ticket ID (e.g., PROJ-123, ACME-456), prefix the title with it.
+2. Every expected result as a verifiable assertion. Each assertion must be something the browser can check after execution.
+
+Test Spec:
+${testSpec}
+
+IMPORTANT: You MUST create ONE assertion for EACH expected result in the spec. Do NOT skip any.
+
+Return ONLY this JSON:
+{ "title": "TICKET-ID: Short action title", "assertions": [ { "description": "...", "expected": "..." }, ... ] }`;
+
 export const preflightNode = {
   name: 'preflight',
+  outputSchema: PreflightOutputSchema,
+
+  async execute(state) {
+    // Early exit BEFORE the LLM call when there's no spec to analyze.
+    // Without this guard the node fires the LLM, gets back
+    // `{title: "No test specification provided", assertions: []}`, and
+    // the graph's conditional edge then skips execute_live — but we've
+    // still paid for one preflight LLM call we didn't need to make.
+    // Returning empty assertions here triggers the same skip-to-END
+    // path in graph.mjs's preflight conditional edge.
+    if (isMissingSpec(state.testSpec)) {
+      console.log('⚠️  No test spec provided — skipping browser run.');
+      console.log('   Pass a spec via:  zibby test "<inline spec>"  or  zibby test path/to/spec.txt');
+      return {
+        title: 'No test specification provided',
+        assertions: [],
+      };
+    }
+
+    const result = await invokeAgent(PROMPT(state.testSpec), {
+      state,
+      model: state.model || 'auto',
+      schema: PreflightOutputSchema,
+    });
+    return result?.structured || result;
+  },
 
   async onComplete(state, result) {
     const sessionPath = state.sessionPath || process.env.ZIBBY_SESSION_PATH;
@@ -42,18 +91,4 @@ export const preflightNode = {
     }
     return result;
   },
-
-  prompt: (state) => `Analyze this test specification and extract:
-1. A concise test title (5-10 words, action-oriented). If you find a ticket ID (e.g., PROJ-123, ACME-456), prefix the title with it.
-2. Every expected result as a verifiable assertion. Each assertion must be something the browser can check after execution.
-
-Test Spec:
-${state.testSpec}
-
-IMPORTANT: You MUST create ONE assertion for EACH expected result in the spec. Do NOT skip any.
-
-Return ONLY this JSON:
-{ "title": "TICKET-ID: Short action title", "assertions": [ { "description": "...", "expected": "..." }, ... ] }`,
-
-  outputSchema: PreflightOutputSchema
 };

package/templates/browser-test-automation/state.js

@@ -0,0 +1,61 @@
+/**
+ * Browser Test Automation — Workflow State Schema
+ *
+ * Declares the input shape that nodes in this template actually read off
+ * `state`. Wired into the graph via `graph.setStateSchema(...)` in
+ * graph.mjs so that:
+ *
+ *   - `zibby workflow run <slug> -p testSpec=...` validates inputs
+ *     against this schema before nodes ever execute.
+ *   - The post-scaffold `Pass inputs:` cheatsheet reads top-level fields
+ *     from this schema so the printed examples match what the template
+ *     actually consumes (testSpec, model) instead of generic placeholders.
+ *
+ * Field provenance:
+ *   - testSpec, model        — USER input (passed via -p / --input).
+ *   - cwd, sessionPath,      — FRAMEWORK-injected by the workflow runner
+ *     outputPath, context      (NOT user input). Declared optional so a
+ *                              user-only payload validates cleanly.
+ *   - preflight, execute_live — DOWNSTREAM node outputs (set by earlier
+ *                              nodes during graph execution). Same: kept
+ *                              optional so initial inputs validate.
+ *
+ * `zod` is imported directly from the `zod` package (not re-exported via
+ * @zibby/core) — same convention as code-analysis/state.js. The
+ * scaffolded user copy gets `zod` via the template's dep merge in
+ * templates/index.js.
+ */
+
+import { z } from 'zod';
+
+export const browserTestAutomationStateSchema = z.object({
+  // ---- USER INPUT (what `-p` / `--input` populates) ----
+  testSpec: z.string().describe(
+    'Plain-English description of the browser test to analyze + execute (REQUIRED).',
+  ),
+  model: z.string().default('auto').describe(
+    'Agent model override (e.g. "auto", "opus-4.6"). Defaults to "auto".',
+  ),
+
+  // ---- FRAMEWORK-INJECTED (set by the workflow runner, not the user) ----
+  cwd: z.string().optional().describe(
+    'Working directory the workflow runs in. Injected by the runner.',
+  ),
+  sessionPath: z.string().optional().describe(
+    'Per-run session directory under .zibby/output/. Injected by the runner.',
+  ),
+  outputPath: z.string().optional().describe(
+    'Target path for the generated Playwright test file. Injected by the runner.',
+  ),
+  context: z.any().optional().describe(
+    'Run context bag (project config, env, …). Injected by the runner.',
+  ),
+
+  // ---- DOWNSTREAM NODE OUTPUTS (populated mid-graph, not by the user) ----
+  preflight: z.any().optional().describe(
+    'Output of the preflight node (assertion checklist + title). Set during the run.',
+  ),
+  execute_live: z.any().optional().describe(
+    'Output of the execute_live node (recorded actions + steps). Set during the run.',
+  ),
+});

package/templates/code-analysis/README.md

@@ -0,0 +1,60 @@
+# Code Analysis Template
+
+Multi-node workflow that analyzes a Jira ticket against a code repository
+and emits structured analysis + generated code + test cases.
+
+## Nodes
+
+- `setup` — clone repos into the workspace, snapshot baseline commit
+- `analyze_ticket` — LLM reads ticket + code, produces a validated
+  analysis (canProceed flag + reasoning)
+- `validation_check` — conditional decision: route to `generate_code`
+  if `canProceed`, else `finalize`
+- `generate_code` — LLM generates code changes scoped to the ticket
+- `generate_test_cases` — LLM generates test cases covering the changes
+- `finalize` — write outputs, mark complete
+
+## Required state inputs
+
+```js
+{
+  workspace: '/abs/path/to/workspace',          // local clone target
+  repos: [{
+    name: 'my-app',
+    url: 'https://github.com/org/my-app.git',
+    branch: 'main',
+    isPrimary: true,
+  }],
+  ticketContext: {
+    ticketKey: 'PROJ-123',
+    summary: 'short title',
+    description: 'long description',
+    acceptanceCriteria: 'optional',
+  },
+  githubToken: process.env.GITHUB_TOKEN,
+}
+```
+
+See `state.js` for the full Zod schema.
+
+## Customizing prompts
+
+The three LLM nodes load their prompts from `prompts/`:
+
+- `prompts/analyze-ticket.md`
+- `prompts/generate-code.md`
+- `prompts/generate-test-cases.md`
+
+Edit those files in your scaffolded copy to change agent behavior — no
+code changes needed. The graph reloads them at module-init time.
+
+## Cloud deployment
+
+```bash
+zibby workflow deploy <your-slug>
+zibby workflow trigger <uuid> --input '{"workspace": "...", ...}'
+```
+
+Cloud runs need network access for `git clone` (the `setup` node shells
+out to `git`). Default cloud egress works; pin to a specific IP via the
+dedicated-egress addon if you have firewalled git hosts.

package/templates/code-analysis/graph.mjs

@@ -0,0 +1,33 @@
+/**
+ * code-analysis template — scaffoldable WorkflowAgent wrapper.
+ *
+ * Why this file exists alongside graph.js:
+ *   - graph.js exports `buildAnalysisGraph(graph)` — a builder
+ *     function the existing `zibby analyze-graph` cli + backend
+ *     analysis handlers consume directly. Its shape can't change
+ *     without breaking those callers.
+ *   - To make code-analysis scaffoldable via
+ *     `zibby workflow new <slug> -t code-analysis` and runnable via
+ *     `zibby workflow run <slug>` / `zibby workflow deploy <slug>`,
+ *     the template needs to expose a WorkflowAgent class — same
+ *     contract as browser-test-automation.
+ *
+ * This .mjs is the entry the user-facing scaffold uses; graph.js
+ * stays put for internal callers.
+ */
+
+import { WorkflowAgent, WorkflowGraph } from '@zibby/core';
+import { buildAnalysisGraph } from './graph.js';
+
+export class CodeAnalysisAgent extends WorkflowAgent {
+  buildGraph() {
+    const graph = new WorkflowGraph();
+    buildAnalysisGraph(graph);
+    return graph;
+  }
+
+  async onComplete(result) {
+    const ok = result.success !== false;
+    console.log(`[code-analysis] complete — success: ${ok}`);
+  }
+}

package/templates/code-analysis/nodes/analyze-ticket-node.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { randomBytes } from 'crypto';
 import { z } from 'zod';
-import { adfToText } from '../../../src/utils/adf-converter.js';
+import { adfToText } from '@zibby/core/utils/adf-converter.js';
 
 const generateId = () => randomBytes(16).toString('hex');
 

package/templates/code-analysis/nodes/create-pr-node.js

@@ -1,5 +1,5 @@
 import axios from 'axios';
-import { adfToText } from '../../../src/utils/adf-converter.js';
+import { adfToText } from '@zibby/core/utils/adf-converter.js';
 import { z } from 'zod';
 
 const CreatePROutputSchema = z.object({

package/templates/code-analysis/nodes/generate-code-node.js

@@ -10,7 +10,7 @@ import { existsSync, readFileSync } from 'fs';
 import Handlebars from 'handlebars';
 import { invokeAgent } from '@zibby/core';
 import { generatePRMeta } from './services/prMetaService.js';
-import { adfToText } from '../../../src/utils/adf-converter.js';
+import { adfToText } from '@zibby/core/utils/adf-converter.js';
 import { z } from 'zod';
 
 const CodeImplementationOutputSchema = z.object({

package/templates/code-analysis/nodes/generate-test-cases-node.js

@@ -11,7 +11,7 @@
 import { invokeAgent } from '@zibby/core';
 import { z } from 'zod';
 import { randomBytes } from 'crypto';
-import { adfToText } from '../../../src/utils/adf-converter.js';
+import { adfToText } from '@zibby/core/utils/adf-converter.js';
 
 // Generate a simple unique ID
 const generateId = () => randomBytes(8).toString('hex');

package/templates/code-analysis/nodes/services/prMetaService.js

@@ -4,7 +4,7 @@
 
 import { z } from 'zod';
 import { invokeAgent } from '@zibby/core';
-import { adfToText } from '../../../../src/utils/adf-converter.js';
+import { adfToText } from '@zibby/core/utils/adf-converter.js';
 
 const PRMetaSchema = z.object({
   prTitle: z.string().describe('Short PR title that includes the ticket key'),

package/templates/code-analysis/state.js

@@ -31,10 +31,18 @@ export const analysisStateSchema = z.object({
   githubToken: z.string().optional().describe('GitHub personal access token'),
   model: z.string().default('auto').describe('AI model to use'),
   nodeConfigs: z.record(z.string(), z.any()).optional().describe('Per-node configuration overrides'),
-  
-  EXECUTION_ID: z.string().nullable().optional(),
-  PROGRESS_QUEUE_URL: z.string().url().nullable().optional(),
-  PROGRESS_API_URL: z.string().url().nullable().optional(),
-  SQS_AUTH_TOKEN: z.string().nullable().optional(),
-  PROJECT_API_TOKEN: z.string().nullable().optional(),
 });
+
+// NOTE: legacy `EXECUTION_ID`, `PROGRESS_QUEUE_URL`, `PROGRESS_API_URL`,
+// `SQS_AUTH_TOKEN`, `PROJECT_API_TOKEN` fields are no longer declared in
+// this schema. They were used only by the legacy `analyze-graph` cli +
+// the analysis UI's progress reporter — never by template nodes. Zod's
+// safeParse here doesn't strip unknown keys (see graph.js:504), so the
+// legacy flow still works at runtime: analyze-graph.js injects them
+// into initialState, validation passes, nodes ignore them, the
+// progress-reporter middleware reads them off the state argument.
+//
+// Keeping them out of the schema means scaffolded user copies (via
+// `zibby workflow new -t code-analysis`) ship a clean state that
+// reflects only what the template actually needs — no false coupling
+// to internal infra fields.