[37/37] Reconcile OpenCollection PR review fixes

.agents/skills/missio-agent-coordination/SKILL.md

@@ -31,6 +31,7 @@ description: Coordinate parallel AI agent work on Missio's OpenCollection featur
 
 - Do not overwrite another agent's table row or log entry unless you are completing an explicit handoff.
 - Prefer splitting work in the task log over broad overlapping claims.
+- Keep dependency additions minimal; record non-trivial dependency necessity, transitive/packaging impact, and approval in `AGENT_PROGRESS.md`, and never add unused packages.
 - Mark `Blocked` only when a concrete dependency or missing decision prevents progress.
 - Include test evidence in the log: command, result, coverage matched to the plan, and any skipped tests.
 - Do not set `Review Ready` or `Done` until the coverage plan is satisfied by passing automated tests and the claimed changes are committed to the recorded GitButler branch/stack.

.github/workflows/pr.yml

@@ -22,6 +22,9 @@ jobs:
 
       - name: Install dependencies
         run: npm ci
+
+      - name: Type check
+        run: npm run compile
 
       - name: Build
         run: npm run build

docs/open-collection-gap-analysis/AGENT_GOAL_PROMPTS.md

@@ -49,7 +49,7 @@ If an agent host does not inject the project-local skills, tell the agent to rea
 ## User And Agent Surfaces
 
 ```text
-/goal Complete OC-070 request creation, import/export, snippet, and Copilot protocol surface polish using $missio-agent-coordination and $missio-editor-schema-implementer without stopping until protocol-specific new request templates, protocol-preserving get/dry-run/list/send tooling, explicit unsupported import/export/snippet diagnostics, baseline tree/CodeLens/command regressions, AGENT_PROGRESS updates, and complete automated tests are implemented and passing.
+/goal Complete OC-070 request creation, Postman script/event mapping, import/export, snippet, and Copilot protocol surface polish using $missio-agent-coordination and $missio-editor-schema-implementer without stopping until protocol-specific new request templates, protocol-preserving get/dry-run/list/send tooling, explicit unsupported import/export/snippet diagnostics, baseline tree/CodeLens/command regressions, AGENT_PROGRESS updates, and complete automated tests are implemented and passing.
 ```
 
 ## Request Type UX

docs/open-collection-gap-analysis/README.md

@@ -31,11 +31,15 @@ GitButler skill availability has been verified with `but skill check`:
 
 | Install | Path | Version |
 | --- | --- | --- |
-| Agent Skills global | `C:\Users\chris\.agents\skills\gitbutler` | `0.20.0` |
+| Agent Skills global | `%USERPROFILE%\.agents\skills\gitbutler` | `0.20.0` |
 | OpenCode local | `.opencode/skills/gitbutler` | `0.20.0` |
 
 If an agent host injects the GitButler skill, use it. If not, read `.opencode/skills/gitbutler/SKILL.md` before performing version-control operations.
 
+## Dependency Budget
+
+Prefer zero or low-transitive-cost dependencies. Before adding a non-trivial dependency, record its necessity, transitive and packaging impact, and approval in `AGENT_PROGRESS.md`. Do not add speculative or unused packages.
+
 ## Test Coverage Contract
 
 Every implementation change needs complete automated coverage for the behavior it adds or changes. A task cannot move to `Review Ready` or `Done` until the task row and log include the coverage plan, exact commands run, results, and any remaining gaps.

docs/open-collection-gap-analysis/tasks/00-foundation-and-dispatch.md

@@ -59,3 +59,4 @@ Add schema-aligned TypeScript types for:
 
 This task should be claimed before major protocol implementation begins. If multiple agents need it, split by `models/types.ts`, parser/type guards, and executor facade, then coordinate through `AGENT_PROGRESS.md`.
 
+OC-000 owns the shared model, type guards, parser routing, and execution facade. Protocol-specific tree, CodeLens, command, import, and export behavior remains with the protocol tracks or OC-070.

docs/open-collection-gap-analysis/tasks/01-graphql.md

@@ -80,4 +80,3 @@ Missio has no GraphQL types, editor, executor, validation selection, tree render
 ## Out Of Scope
 
 GraphQL schema introspection, autocomplete, persisted queries, and GraphQL subscriptions should be separate follow-up tasks after basic request support lands.
-

docs/open-collection-gap-analysis/tasks/02-websocket.md

@@ -70,4 +70,3 @@ There is no WebSocket dependency, editor, connection manager, response/message U
 ## Dependency Choice
 
 Prefer the established `ws` package unless VS Code/Electron APIs provide a better fit. Add types and tests with a local in-process server.
-

docs/open-collection-gap-analysis/tasks/03-grpc.md

@@ -32,7 +32,7 @@ Missio has no protobuf config model, no gRPC metadata/defaults handling, no prot
 | `protoFiles` | Path, disabled, add/remove. |
 | `importPaths` | Path, disabled, add/remove. |
 
-4. Choose gRPC dependencies, likely `@grpc/grpc-js` and `@grpc/proto-loader`.
+4. Choose gRPC dependencies, likely `@grpc/grpc-js` and `@grpc/proto-loader`, subject to the project dependency budget. Record the package necessity, transitive and packaging impact, and approval in `AGENT_PROGRESS.md` before adding them.
 5. Implement unary execution first:
 
 | Step | Behavior |
@@ -86,4 +86,3 @@ Missio has no protobuf config model, no gRPC metadata/defaults handling, no prot
 ## Coordination Notes
 
 Keep the unary implementation small and well-tested. Streaming support is larger and should be split into separate subtasks after unary lands.
-

docs/open-collection-gap-analysis/tasks/04-runtime-scripting-testing.md

@@ -18,7 +18,7 @@ Use `$missio-demo-server-fixtures` for local runtime fixture routes and user-ver
 
 ## Current Gap
 
-Only TypeScript interfaces exist. There is no sandbox, runtime context, assertion evaluator, action evaluator, test result UI, or Postman script conversion.
+Only TypeScript interfaces exist. There is no sandbox, runtime context, assertion evaluator, action evaluator, or test result UI. Postman script/event conversion is owned by OC-070 and depends on this runtime contract.
 
 ## Implementation Plan
 
@@ -35,8 +35,8 @@ Only TypeScript interfaces exist. There is no sandbox, runtime context, assertio
 
 | Option | Notes |
 | --- | --- |
-| Node `vm` sandbox | Lightweight, local, must restrict globals carefully. |
-| Isolated VM package | Better isolation, extra dependency and packaging work. |
+| Bare Node `vm` | Not a security boundary; never use it for untrusted collection scripts. |
+| Isolated worker or sandbox | Preferred for untrusted scripts; record the isolation and packaging trade-offs before choosing an implementation. |
 
 3. Implement lifecycle order:
 
@@ -84,4 +84,3 @@ Only TypeScript interfaces exist. There is no sandbox, runtime context, assertio
 ## Security Notes
 
 Treat scripts as untrusted collection content. Any powerful API, shell access, or filesystem access must be opt-in and clearly approved by the user.
-

docs/open-collection-gap-analysis/tasks/05-auth-proxy-mtls.md

@@ -85,4 +85,3 @@ Close schema-native auth and transport gaps for HTTP-compatible protocols while
 | Proxy with basic auth. | Proxy receives authenticated request. |
 | mTLS fixture. | Server verifies client certificate. |
 | OAuth2 query token placement. | Resource URL contains token param. |
-

docs/open-collection-gap-analysis/tasks/06-schema-roundtrip-validation.md

@@ -66,4 +66,3 @@ Editors clone documents before editing known fields, which helps preserve unknow
 ## Coordination Notes
 
 This track can start immediately with tests. Many failing tests will document gaps before implementation tracks fix them.
-

docs/open-collection-gap-analysis/tasks/07-import-export-copilot.md

@@ -38,7 +38,7 @@ Finish the user-facing and agent-facing protocol surface after OC-000 through OC
 
 | Area | Work |
 | --- | --- |
-| Postman importer | Preserve scripts/events where mappable after OC-040; record unsupported mappings explicitly. |
+| Postman importer | OC-070 owns preserving mappable scripts/events after the OC-040 runtime contract lands; record unsupported mappings explicitly and cover collection, folder, and request event scopes with importer tests. |
 | OpenAPI importer | Keep HTTP semantics by default; preserve source metadata and avoid inventing GraphQL/WebSocket/gRPC requests unless source metadata truly supports it. |
 | Exporters | Add protocol-aware unsupported messages where export is not implemented and prevent silent data loss. |
 | Snippet exporter | Keep HTTP snippets working; add clear non-HTTP diagnostics or implement protocol-specific snippets if the scope remains small. |
@@ -61,7 +61,7 @@ Finish the user-facing and agent-facing protocol surface after OC-000 through OC
 | --- | --- |
 | OC-050 | If OC-050 changes auth representation or transport settings, OC-070 should update starter templates, import/export preservation, and Copilot redaction tests to match. |
 | OC-080 | If OC-080 changes runtime result shapes for WebSocket/gRPC, OC-070 should update Copilot `send_request` assertions and docs accordingly. |
-| OC-090 | If OC-090 lands first, OC-070 should include gRPC streaming method summaries in list/get/dry-run tests. |
+| OC-090 | OC-090 landed before OC-070, so list/get/dry-run coverage includes gRPC streaming method summaries. |
 | OC-100 | If OC-100 lands first, OC-070 should reuse its request type templates/conversion helpers instead of creating separate protocol starter logic. |
 
 ## Acceptance Criteria

docs/open-collection-gap-analysis/tasks/08-runtime-non-http-protocols.md

@@ -41,7 +41,7 @@ OC-040 delivered the runtime engine and verified it through HTTP and GraphQL-ove
 | --- | --- |
 | Request mutation | Allow scripts/actions to mutate URL, metadata, message JSON, and runtime variables before unary execution. |
 | Response shape | Expose response message, response metadata, status/code, elapsed time, and errors to tests/assertions. |
-| Diagnostics | Preserve existing missing-proto, invalid-method, connection, and unsupported-streaming diagnostics. |
+| Diagnostics | Preserve missing-proto, invalid-method, connection, and streaming status/partial-history diagnostics from OC-090. |
 
 5. Extend Copilot send-request output, response provider output, and request execution result types to surface runtime results for non-HTTP protocols.
 6. Add demo fixtures:
@@ -77,5 +77,5 @@ OC-040 delivered the runtime engine and verified it through HTTP and GraphQL-ove
 
 | Area | Reason |
 | --- | --- |
-| gRPC streaming runtime lifecycle | Covered by OC-090 after streaming execution exists. |
+| gRPC streaming runtime lifecycle | Streaming execution is owned by completed task OC-090; OC-080 remains scoped to unary gRPC runtime lifecycle. |
 | Persistent interactive WebSocket session scripting | This task covers request-style exchange execution, not a long-running session debugger. |

docs/open-collection-gap-analysis/tasks/09-grpc-streaming.md

@@ -4,18 +4,22 @@
 
 Add schema-native gRPC client-streaming, server-streaming, and bidirectional-streaming execution with editor support, response streaming UI, local demo fixtures, and automated coverage.
 
-## Current Gap
+## Completion Status
 
-OC-030 implemented protobuf configuration, metadata defaults, unary execution, demo fixtures, and explicit diagnostics for streaming methods. OpenCollection gRPC request schema supports method types beyond unary, so Missio needs streaming support to close the remaining gRPC protocol gap.
+OC-090 is complete on PR #38 (`feature/oc-090-grpc-streaming`, commits `2ac3bc4` and `06b8d83`). Missio executes unary, server-streaming, client-streaming, and bidirectional-streaming requests with schema-native message sequences, response summaries, cancellation/error handling, local fixtures, and automated coverage. The original gap and implementation plan below are retained as historical acceptance scope.
+
+## Original Gap (Closed)
+
+OC-030 had implemented protobuf configuration, metadata defaults, unary execution, demo fixtures, and explicit diagnostics for streaming methods. OpenCollection gRPC request schema supported method types beyond unary, so OC-090 closed the remaining gRPC protocol gap.
 
 | Surface | Gap |
 | --- | --- |
-| Method resolution | Proto loader resolves unary execution only. |
-| Request payloads | Streaming requests need message lists, selected variants, or repeatable payload controls. |
-| Execution | Client-streaming, server-streaming, and bidirectional-streaming calls are not executed. |
-| Response UI | Streamed messages, metadata, status, cancellation, and errors need incremental display. |
-| Runtime | Streaming lifecycle should coordinate with OC-080 once non-HTTP runtime support exists. |
-| Demo coverage | Local gRPC server currently proves unary and unsupported-streaming diagnostics, not real streaming. |
+| Method resolution | Closed: proto loading resolves unary and all three streaming method types. |
+| Request payloads | Closed: schema-native selected variants and ordered message sequences are preserved. |
+| Execution | Closed: client-streaming, server-streaming, and bidirectional-streaming calls execute. |
+| Response UI | Closed: streamed events, metadata, status, cancellation, and errors are surfaced. |
+| Runtime | Verified with OC-080 after non-HTTP runtime support landed. |
+| Demo coverage | Closed: local fixtures execute unary, server/client/bidirectional streams, and deterministic stream errors. |
 
 ## Implementation Plan
 

examples/demo-api/AuthTransport/mtls-secure.yml

@@ -2,7 +2,7 @@ info:
   name: mTLS Secure
   type: http
   seq: 4
-  description: Run `node examples/demo-api/mtls-server.js` and set `missio.rejectUnauthorized` to false for this self-signed local fixture.
+  description: Run `node examples/demo-api/mtls-server.js` in a dedicated local-only workspace. Because `missio.rejectUnauthorized` is global, set it to false only for this self-signed fixture and restore it to true before sending requests to external hosts.
 http:
   method: GET
   url: "{{mtlsBaseUrl}}/secure"

examples/demo-api/GraphQL/folder.yml

@@ -2,4 +2,3 @@ info:
   name: GraphQL
   type: folder
   description: Run node examples/demo-api/server.js before sending these local GraphQL demo requests.
-

examples/demo-api/GraphQL/graphql-create-note-mutation.yml

@@ -31,4 +31,3 @@ runtime:
     - expression: res.body.extensions.operation
       operator: equals
       value: mutation
-

examples/demo-api/GraphQL/graphql-health.yml

@@ -31,4 +31,3 @@ runtime:
     - expression: res.body.data.health.status
       operator: equals
       value: ok
-

examples/demo-api/GraphQL/graphql-user-with-variables.yml

@@ -29,4 +29,3 @@ runtime:
     - expression: res.body.extensions.echoedVariables.id
       operator: equals
       value: "{{userId}}"
-

examples/demo-api/README.md

@@ -15,3 +15,9 @@ node examples/demo-api/grpc-server.js
 ```
 
 The gRPC fixture binds `127.0.0.1:50051`, matching `LOCAL.grpcBaseUrl=localhost:50051` in `opencollection.yml`. If a gRPC demo request reports `UNAVAILABLE` or `ECONNREFUSED`, start or restart that fixture and retry with the LOCAL environment selected.
+
+## Security fixtures
+
+`fixtures/mtls-client.key` is a public, non-production test key committed only so the local mTLS fixture is reproducible. It is excluded from the packaged VSIX and must never be reused for a real client certificate.
+
+The `missio.rejectUnauthorized` setting is global. If you temporarily disable it for the self-signed local mTLS fixture, use a dedicated local-only VS Code workspace/window and restore it to `true` before sending any request to an external host.

examples/demo-api/Runtime/folder.yml

@@ -6,4 +6,3 @@ request:
   headers:
     - name: X-Demo-Folder
       value: runtime
-

examples/demo-api/Runtime/intentional-failure.yml

@@ -27,4 +27,3 @@ settings:
   timeout: 5000
   followRedirects: true
   maxRedirects: 5
-

examples/demo-api/Runtime/lifecycle-token.yml

@@ -62,4 +62,3 @@ settings:
   timeout: 5000
   followRedirects: true
   maxRedirects: 5
-

examples/demo-api/Runtime/scripted-echo.yml

@@ -41,4 +41,3 @@ settings:
   timeout: 5000
   followRedirects: true
   maxRedirects: 5
-

examples/demo-api/WebSocket/runtime-lifecycle.yml

@@ -19,14 +19,15 @@ runtime:
   scripts:
     - type: before-request
       code: |-
-        missio.variables.set("runtimeSocketUser", "{{runtimeSocketUserName}}");
+        missio.variables.set("runtimeSocketUser", missio.variables.get("runtimeSocketUserName"));
     - type: before-request
       code: |-
+        const socketMessageId = missio.variables.get("socketMessageId");
         missio.request.headers.set("X-Demo-Client", "missio-demo");
-        missio.request.headers.set("X-Runtime-Header", "scripted-{{socketMessageId}}");
+        missio.request.headers.set("X-Runtime-Header", `scripted-${socketMessageId}`);
         missio.request.body = {
-          user: "{{runtimeSocketUser}}",
-          count: Number("{{runtimeSocketCount}}")
+          user: missio.variables.get("runtimeSocketUser"),
+          count: Number(missio.variables.get("runtimeSocketCount"))
         };
     - type: after-response
       code: |-

examples/demo-api/gRPC/runtime-unary-lifecycle.yml

@@ -32,15 +32,16 @@ runtime:
   scripts:
     - type: before-request
       code: |-
-        missio.variables.set("grpcRuntimeName", "{{grpcRuntimeNameSeed}}");
+        missio.variables.set("grpcRuntimeName", missio.variables.get("grpcRuntimeNameSeed"));
     - type: before-request
       code: |-
-        missio.variables.set("grpcRuntimeTrace", "runtime-{{grpcRequestId}}");
-        missio.request.metadata.set("x-demo-request", "script-{{grpcRequestId}}");
+        const grpcRequestId = missio.variables.get("grpcRequestId");
+        missio.variables.set("grpcRuntimeTrace", `runtime-${grpcRequestId}`);
+        missio.request.metadata.set("x-demo-request", `script-${grpcRequestId}`);
         missio.request.body = {
-          name: "{{grpcRuntimeName}}",
-          userId: Number("{{grpcRuntimeUserId}}"),
-          trace: { requestId: "{{grpcRuntimeTrace}}" }
+          name: missio.variables.get("grpcRuntimeName"),
+          userId: Number(missio.variables.get("grpcRuntimeUserId")),
+          trace: { requestId: missio.variables.get("grpcRuntimeTrace") }
         };
     - type: after-response
       code: |-