fix(mcp-server): ship payload-size runner dep for npm consumers (#62) by rfxlamia · Pull Request #67 · rfxlamia/agent-pair-protocol

rfxlamia · 2026-07-23T05:10:58Z

Summary

Partial v1.0 fix for #62 (judges-approved §5 path):

Move json-schema-faker to production dependencies so payload-size works from published npm / npx agentpair installs
Add scripts/verify-npm-consumer.sh + CI step: staged publish-shaped pack, manifest assertion, fresh npm install, runPayloadSize smoke test
Replace misleading runner "dev dependency" errors with consumer-facing install hints
Document atest/1 runner deps in user guides (EN + ID)

Not in scope (deferred v1.1): @agentpair/runners extraction (#66), codegen-compile registration, spectral bundling. #62 stays open until v1.1.

Type of Change

Test plan

bash scripts/verify-npm-consumer.sh — manifest + consumer install smoke passed
pnpm --filter agentpair test — passed
pnpm lint — clean

Pre-flight Checklist

Scoped to atest runners unusable from published npm package: devDeps not shipped, codegen-compile not registered #62 payload-size npm consumer slice only
No secrets committed
Conventional commit with issue reference
Debt tracked in v1.1: extract @agentpair/runners package + npx resolution design #66 for v1.1 runner packaging

Summary by CodeRabbit

Bug Fixes
- The payload-size runner now works correctly when installed from npm by including its required runtime dependency.
- Improved error messages explain how to resolve unavailable runners, including payload-size, spectral, and quicktype.
Documentation
- Clarified runner dependencies, installation requirements, and planned packaging improvements.
Chores
- Added automated verification for packed npm installations and consumer smoke tests.

Move json-schema-faker to production dependencies so payload-size works from published npm installs. Add CI consumer smoke test, clarify runner error messages, and document atest/1 deps. Full runner packaging deferred to v1.1 (#66).

coderabbitai · 2026-07-23T05:11:09Z

Warning

Review limit reached

@rfxlamia, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a6ece00f-dae4-4905-bbc8-0916381bc92b

📥 Commits

Reviewing files that changed from the base of the PR and between e751090 and 28559f6.

📒 Files selected for processing (1)

scripts/verify-npm-consumer.sh

📝 Walkthrough

Walkthrough

The change packages json-schema-faker as a runtime dependency, updates unavailable-runner guidance, adds npm consumer verification, wires it into CI, and documents bundled and opt-in runner dependencies.

Changes

NPM packaging and runner availability

Layer / File(s)	Summary
Runtime dependency and runner availability `packages/mcp-server/package.json`, `packages/mcp-server/src/runners/*`, `packages/mcp-server/src/e2e/dual-server.ts`	`json-schema-faker` moves to runtime dependencies, and runner error messages provide updated installation or reinstallation guidance.
Packed consumer verification `scripts/verify-npm-consumer.sh`	Builds or validates artifacts, packs both packages, checks package metadata and contents, and smoke-tests `runPayloadSize` from an isolated npm installation.
CI and runner dependency documentation `.github/workflows/ci.yml`, `docs/user-guide.md`, `docs/user-guide-ID.md`	CI runs the consumer verification script, and both guides document bundled and opt-in runner dependencies.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

v1.1: extract @agentpair/runners package + npx resolution design #66 — Covers the v1.0 packaging workaround and planned v1.1 runner packaging.
atest runners unusable from published npm package: devDeps not shipped, codegen-compile not registered #62 — Addresses npm packaging, runner availability, and consumer-install verification.

Possibly related PRs

rfxlamia/agent-pair-protocol#46 — Adds the related CI workflow that this change extends with npm consumer verification.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: shipping the payload-size runner dependency for npm consumers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/62-npm-consumer-payload-size

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

rfxlamia · 2026-07-23T05:18:29Z

    const detail =
      "error" in initiatorAtest && /unavailable/i.test(initiatorAtest.error)
-        ? " (install json-schema-faker dev dependency for payload-size runner)"
+        ? " (payload-size runner unavailable — reinstall agentpair or check json-schema-faker dependency)"


[nit] The e2e detail string still says "check json-schema-faker dependency", which slightly reintroduces the old "install jsf yourself" framing that payload-size.ts intentionally left behind ("should ship with the package"). In a monorepo e2e failure this can send developers hunting for a missing optional dep instead of a broken install/link of agentpair itself.

Suggestion: Align with the runner message, e.g. "payload-size runner unavailable — reinstall agentpair (json-schema-faker should ship with the package)".

rfxlamia · 2026-07-23T05:18:29Z

+trap 'rm -rf "${TMP_DIR}"' EXIT
+
+echo "==> Building protocol and agentpair"
+pnpm --filter @agentpair/protocol build


[suggestion] The script always rebuilds @agentpair/protocol and agentpair, including the WASM step. CI already ran pnpm build and pnpm test (which rebuilds again via pretest) before this step, so every PR pays a third protocol/wasm compile. Standalone local use wants a rebuild; CI does not.

Suggestion: Either document that the script is standalone-safe and accept the cost, or skip rebuild when dist artifacts already exist / add a SKIP_BUILD=1 path for the CI step so only pack+install+smoke runs after the existing Build/Test jobs.

rfxlamia · 2026-07-23T05:18:29Z

+node --input-type=module -e "
+import { readFileSync, writeFileSync } from 'node:fs';
+const pkg = JSON.parse(readFileSync('${MCP_DIR}/package.json', 'utf8'));
+const publishable = {


[suggestion] The publish-shaped package is hand-assembled (subset of package.json fields + cp dist + LICENSE) rather than produced by pnpm pack / publish, which is what actually rewrites workspace: and applies the real files allowlist. Today the subset matches package.json, so the smoke test is valid for #62, but it can drift if fields like exports, bin, or files change and still pass this gate.

Suggestion: Prefer pnpm --filter agentpair exec/pnpm pack (or pack the real package after a workspace-protocol rewrite) so the verified tarball matches publish output more closely; keep the explicit json-schema-faker dependency assertion either way.

- Align e2e unavailable hint with payload-size runner message - Add SKIP_BUILD=1 for CI verify step (skip redundant wasm rebuild) - Use pnpm pack instead of hand-assembled publish tarball

rfxlamia · 2026-07-23T05:29:11Z

Review follow-up (`e751090`)

E2E dual-server hint aligned with payload-size runner message
CI verify: SKIP_BUILD=1 — skips redundant protocol/wasm rebuild after Build/Test
verify-npm-consumer.sh now uses pnpm pack on real packages (publish-shaped manifest + files allowlist)

rfxlamia commented Jul 23, 2026

View reviewed changes

fix(mcp-server): address PR review feedback for #62 consumer verify

e751090

- Align e2e unavailable hint with payload-size runner message - Add SKIP_BUILD=1 for CI verify step (skip redundant wasm rebuild) - Use pnpm pack instead of hand-assembled publish tarball

fix(ci): avoid pipefail SIGPIPE in verify tarball member checks

28559f6

rfxlamia merged commit 995f2cd into main Jul 23, 2026
2 checks passed

rfxlamia deleted the fix/62-npm-consumer-payload-size branch July 23, 2026 05:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(mcp-server): ship payload-size runner dep for npm consumers (#62)#67

fix(mcp-server): ship payload-size runner dep for npm consumers (#62)#67
rfxlamia merged 3 commits into
mainfrom
fix/62-npm-consumer-payload-size

rfxlamia commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

rfxlamia Jul 23, 2026

Uh oh!

rfxlamia Jul 23, 2026

Uh oh!

rfxlamia Jul 23, 2026

Uh oh!

rfxlamia commented Jul 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

rfxlamia commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Test plan

Pre-flight Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

rfxlamia Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

rfxlamia Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

rfxlamia Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

rfxlamia commented Jul 23, 2026

Review follow-up (e751090)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rfxlamia commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Review follow-up (`e751090`)