Add tests for default branch paths (model/prompt/stream falsy), completions
params branch, search with model set, web.fetch depth=0, reversed markers
in parseImprovedContent. All new production files reach 100% branch coverage.
16 tests covering all 5 endpoints:
- GET /agent-skills: 42 total, category/area filters, invalid category → 400
- GET /agent-skills/[id]: found api+cli skills, unknown → 404
- GET /agent-skills/[id]/raw: unknown → 404, valid → 200/502/500 (network-tolerant)
- GET /agent-skills/coverage: SkillCoverage shape (api.total=22, cli.total=20)
- POST /generate: no auth → 401/403, invalid body → 400, no generator → 503
Hard Rule #12 verified explicitly in every error case: error.message must
not match /\bat \/|\bat file:\/\// (no stack trace exposure). Final test
collects all error paths and asserts sanitization in a single sweep.
Implements POST /api/agent-skills/generate (F4):
- Requires management auth via requireManagementAuth (same pattern as
usage/combo-health-dashboard and other management routes)
- Validates body via GenerateBodySchema (dryRun defaults true, prune
defaults false — safe preview mode)
- Dynamic import of @/lib/agentSkills/generator so the route coexists
before F3 (generator.ts) is merged; returns 503 if module unavailable
- Hard Rule #12: all error paths use buildErrorBody (400/401/403/503/500)
- Hard Rule #7: Zod validates both JSON parse and schema shape
Implements four read-only endpoints for the Agent Skills REST API (F4):
- GET /api/agent-skills — catalog with ?category= and ?area= filters,
returns { skills, count, coverage }
- GET /api/agent-skills/[id] — single skill by canonical ID (404 if absent)
- GET /api/agent-skills/[id]/raw — SKILL.md as text/markdown with
Cache-Control: public, max-age=3600; 502 on GitHub fallback failure
- GET /api/agent-skills/coverage — SkillCoverage (filesystem vs catalog)
All routes: export const dynamic = "force-dynamic" (filesystem reads),
error responses via buildErrorBody (Hard Rule #12), Zod input validation
(Hard Rule #7). coverage/route.ts force-added to git because .gitignore
matches the directory name "coverage/" — this is an API route, not a
report directory.
Adds 6 tests for executeListCapabilities (§3.7 shape, 42-skill IDs in markdown,
coverage bounds, ISO datetime, handler registration) and 5 tests for the Agent
Card route (6 skills total, list-capabilities presence + tags + examples, all
original 5 skills preserved). All 11 pass.
Adds "list-capabilities" entry to A2A_SKILL_HANDLERS in taskExecution.ts
(dynamic import pattern, consistent with the 5 existing skills) and adds
the 6th skill entry to /.well-known/agent.json with tags [discovery, capabilities]
and example questions for agent discovery.
Implements executeListCapabilities() which calls getCatalog() + computeCoverage()
from the agentSkills catalog (F1/F2) and returns a markdown table covering all
42 skills (22 API + 20 CLI) with ID, name, category, area, endpoints/commands,
and raw SKILL.md URL, matching the §3.7 result contract.
Two additions to src/mitm/manager.ts:
1. writeTargetsJson(targets?) — persists the static ALL_TARGETS
registry to <DATA_DIR>/mitm/targets.json. server.cjs reads this
file at boot and extends its baseline TARGET_HOSTS set so the
full AgentBridge target catalog is intercepted alongside the
historical antigravity hosts.
2. getAllAgentsStatus() — read-only aggregate of every registered
target plus its current installation detection result, used by
the AgentBridge dashboard.
startMitm() now invokes writeTargetsJson() before any DNS/cert work;
write failures are logged but never block startup.
server.cjs now reads <DATA_DIR>/mitm/targets.json at startup and
adds the listed hostnames to TARGET_HOSTS. The antigravity baseline
remains hard-coded so existing installs continue to work even if
targets.json is missing or malformed (loader catches all errors and
returns 0).
All additions are marked with // T-A-F3: comments to make the
forward-port-only changes easy to audit.
Filesystem-only installation probes for antigravity, kiro, copilot,
codex, cursor, zed, claude-code, and open-code. detectAgent(id)
dispatcher returns {installed, path?} without ever spawning a shell
or interpolating runtime paths (Hard Rule #13).
Trae has no detector — its entry in the dispatch table returns
{installed: false} until upstream viability is confirmed.
ALL_TARGETS aggregates the nine MitmTarget descriptors in canonical
order. resolveTarget(hostname) does a case-insensitive exact-match
lookup against each target.hosts list. routeConnection(hostname,
userBypass) returns {kind: bypass|target|passthrough} per plan 11
§4.6 precedence: default+user bypass > known target host > passthrough.
Implements MitmHandlerBase abstract class with shared concerns
(request body capture, secret masking, router forwarding, SSE
piping, Traffic Inspector hooks via dynamic import) plus concrete
handlers for antigravity, kiro, copilot, codex, cursor, zed,
claude-code, open-code, and trae (stub for investigating viability).
Each concrete handler maps request body model field to a configured
target, forwards to OmniRoute router, and pipes back SSE.
Targets antigravity and kiro updated to the new MitmTarget shape
while preserving legacy MITM_PROFILE export aliases.
Re-exports all playground types and adds static MODEL_PRICING_TABLE with
8-10 popular models labeled (estimated) for client-side cost estimation (D13).
Exports getModelPricing and getProviderPricing helpers.
Adds META_SYSTEM_PROMPT, ImprovePromptRequestSchema, buildImproveChatBody,
and parseImprovedContent for the Prompt Improver feature (D8). Handles
system-only, prompt-only, and both-present scenarios with <<SYSTEM>>/<<PROMPT>>
markers.
Rename the page route from /dashboard/skills to /dashboard/omni-skills
to align with the task-15 F8 redesign plan. The server component wrapper
is reduced to a 5-line delegator, removing the prior 870-line monolith.
- Extracted Compression Preview from PlaygroundMode lines 506-584 into standalone accordion
- Wrapped in Collapsible with lazy-render (D7): content only mounts after first open
- Accepts inputContent via prop (lifted from TranslateTab in F9) or shows empty-state hint
- POST /api/compression/preview unchanged; error path sanitized (no stack-trace leak)
- 33 Vitest tests covering smoke, lazy-render guard, mode select, fetch dispatch, result grid, error path
