Fix: build-npx-tarball.cjs skips prepare-pack - #477
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…on the packed manifest Two hardening amendments on top of the prepare/restore wrapping: - run() exits the process on failure, which silently skips a `finally` — spawn the pack directly so the original package.json is restored even when npm pack fails, then propagate the exit code. - After extraction, fail the build if the packed package.json still contains workspace: specifiers, so this path can never regress to shipping an un-installable tarball again (the assertion the issue asked for). Verified end to end: dist-tarball/mcp-debugger-latest.tgz now carries real versions in optionalDependencies (1.11.8, zero workspace: refs), npm install of the tarball succeeds in an isolated directory, and the installed CLI runs (--version → 0.24.2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
This one is exactly right — clean branch, single concern, and the prepare/restore wrapping matches what the issue called for. Thank you, this is release-blocking for 0.25.0 so the turnaround is much appreciated. I pushed one hardening commit to your branch (ea804a4) rather than round-tripping, since we're bundling for the release:
Verified end to end on your branch: the packed Also: this branch is exactly the shape we want PRs in — no lockfile churn, no unrelated commits. If you bring #474 and #475 to the same shape per the reviews there, those can land too. |
debugmcpdev
left a comment
debugmcpdev
left a comment
There was a problem hiding this comment.
Verified end to end (see comment): packed manifest carries real versions, tarball npm-installs in isolation, CLI runs. Hardening commit adds restore-on-failure and the workspace: regression guard.
3 participants
Closes #463. Wraps the pack command in build-npx-tarball.cjs with prepare-pack prepare and restore so the tarball contains correct package version specifiers.