[21/36] Complete OC-070 protocol surface polish

[cjohnsto-nz]

Summary

• Adds OpenCollection protocol-aware import/export and Copilot surface polish.
• Extends snippet export beyond HTTP where supported and documents final OpenCollection support.
• Keeps release/0.8.0 stacked above this branch.

Verification

• npm run compile
• node scripts\validate-collection.js examples\demo-api
• npm test
• npm run build

---

This is part 2 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56 <-- current
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: request changes, one customer-facing misdetection bug plus a redaction gap.

• Major: the gRPC fallback detector fires on plain URLs. requestImporters.ts:54's fallback regex /\b[A-Za-z_][\w.]*\/[A-Za-z_]\w*\b/ is unanchored and matches any word/word substring. Paste https://api.example.com/v1/users into Import Request: it fails curl/wget detection (those require a leading token), fails raw-HTTP (needs a leading method), fails the GraphQL/WS anchors, then matches this regex via com/v1 and the user is told "gRPC request text import is not implemented" instead of "could not detect format". Directly contradicts the README line this PR adds about explicit diagnostics for unsupported formats. Anchor the pattern or require gRPC context (grpcurl prefix, scheme, package.Service/Method shape).
• Minor, security: redactAuth (getRequestTool.ts:42-58) never touches AuthCli.command. A cli auth whose command embeds a literal secret (echo my-token instead of calling a secret manager) is exposed verbatim to Copilot despite the tool's stated redaction. Add command to the redaction set, or redact cli auth wholesale.
• Nit: attachImportMetadata is duplicated near-verbatim in postmanImporter.ts and openApiImporter.ts, factor it out.

Tests: solid happy paths (protocol identity through tree/CodeLens/tools, Postman script mapping, OpenAPI webhook/callback diagnostics). Gaps line up with the bugs: no test pastes a plain URL or arbitrary text through the detector, and redaction tests only cover bearer/ws-header/grpc-metadata, missing cli, awsv4 and the nested OAuth2 branches.

Deps: none added.

[APKiwi]

Re-review (whole-stack pass, per REVIEW_GUIDE.md)

The Postman event-mapping claim from the #35 thread is verified: convertEvents wires collection/folder/request events and test/oc070SurfacePolish.test.ts covers all three plus the unsupported-event diagnostic. One correction, test/postmanImporter.test.ts has no event coverage, so "plus the Postman importer tests" is wrong for events specifically. That coverage lives only in oc070SurfacePolish.test.ts.

Prior findings still open:

• (major) The gRPC fallback detector fires on plain URLs. requestImporters.ts:54 uses the unanchored /\b[A-Za-z_][\w.]*\/[A-Za-z_]\w*\b/, so pasting https://api.example.com/v1/users reports "gRPC request text import is not implemented" via the com/v1 substring. Contradicts this PR's own README line about explicit diagnostics for unsupported paste formats. No negative-case paste test exists.
• (minor, security) AuthCli.command is not in the getRequestTool redaction list (types.ts:200-206), while the tool description promises sensitive auth values are redacted.
• (nit) attachImportMetadata is duplicated byte-identical in postmanImporter.ts and openApiImporter.ts:246-255.

New:

• (medium) convertEvents imports collection- and folder-level Postman test events as {type:'tests'} scripts into slots the runtime never executes. runtimeExecutionService.ts merges collection/folder scripts only for the before-request phase (lines 92-94, 185), and passes undefined for the tests phase (203-205). In Postman those run after every request in scope. Imported collections silently lose that with no diagnostic, the exact "record unsupported mappings explicitly" class this task owns. The PR's test only uses a collection-level prerequest event, so the gap is uncovered.
• (medium) convertEvents drops event.disabled, so a disabled Postman script imports as active and starts executing. The same file preserves disabled on headers/params/form fields, and the Script def supports it.
• (low) extractScriptCode reports a Postman v2.1 script.src (external reference, no exec) as the misleading "script is empty and was skipped" diagnostic instead of unsupported-reference.
• (low) getRequestTool redaction covers runtime.auth only. request.examples (saved response snapshots, which commonly capture real access tokens and Set-Cookie) are returned to Copilot verbatim.

Verdict: changes-needed. The URL-misdetected-as-gRPC path is customer-facing and contradicts this PR's own README, and Postman imports silently activate disabled scripts and orphan collection/folder test scripts, both invisible until an imported suite behaves differently than in Postman.

[cjohnsto-nz]

The substantive findings are fixed in efd3226.

• The gRPC fallback now accepts only an anchored package.Service/Method value, a grpcurl command, or a gRPC scheme. Plain URLs and arbitrary text containing a service/method substring no longer produce a gRPC diagnostic; both negative cases are covered.
• AuthCli.command is now redacted wholesale. The same path now covers sensitive protocol headers, nested OAuth2 parameters, AWS credentials, and sensitive headers or JSON token fields stored in request examples. Non-sensitive values remain visible.
• Collection- and folder-level Postman test events are no longer imported into runtime slots that Missio does not execute. They produce MISSIO_IMPORT_UNSUPPORTED_INHERITED_TEST_EVENT with the exact source scope. Request-level test scripts remain imported.
• event.disabled and script.disabled are preserved as disabled: true.
• Postman script.src without executable exec content now produces MISSIO_IMPORT_UNSUPPORTED_SCRIPT_REFERENCE, not the empty-script diagnostic.
• The event-mapping coverage is in test/oc070SurfacePolish.test.ts; test/postmanImporter.test.ts does not contain event-specific coverage. That correction is accepted.

I did not extract attachImportMetadata. The two private ten-line helpers write importer-owned source metadata and diagnostics; there is no shared policy or state to centralize. Extracting them would add a cross-importer dependency and a new stack conflict surface without changing behavior, validation, or the data contract.

Validation:

• npm run compile passed.
• Focused importer/OC-070 run passed 3 files / 125 tests.
• Full suite passed 23 files / 439 tests.
• npm run build passed.
• GitHub build and security checks passed.

Stack integrity was checked before push. Updated PR #53 → PR #56, PR #56 → PR #54, PR #56 → PR #71, and PR #56 → PR #72 all simulate cleanly. GitHub reports PR #56 and immediate child PR #54 as MERGEABLE/CLEAN.

[cjohnsto-nz]

Response to the second review: the actionable items are addressed on the current head (efd3226).

• gRPC shorthand detection is anchored, with a regression proving an ordinary URL containing grpc:// is not misclassified.
• CLI commands and generated examples redact sensitive values.
• Collection- and folder-level test events are not imported as request scripts; the importer emits an explicit diagnostic for that unsupported inheritance.
• Disabled scripts remain disabled.
• script.src produces an explicit unsupported-reference diagnostic.

The review is correct that the focused event-scope regression covers oc070SurfacePolish, not postmanImporter; I am not claiming otherwise.

I am retaining the two small attachImportMetadata helpers. Each is private to its importer and marks that importer's metadata boundary; sharing a ten-line helper would couple otherwise independent importers without changing behavior or closing a defect.

I validated the complete 37-PR composition with npm run build, npm run compile, all 539 tests, and all 47 demo validations passing.