modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore: address Copilot review round 1 (#2226)

Browse source 
- Include `optionalDependencies` in the declared tier's candidate union. A
  peer range constrains the consumer's host; an optional range is a direct
  declaration npm attempts to install, so omitting it left an optional-only
  package free to skew unseen. `peerDependencies` stays excluded, with the
  reason stated.
- Make the end-to-end fixture's client copy UNDECLARED — only the root
  manifest names `solo`, while `clients/web` merely holds a top-level copy.
  That is #2226's defining shape, and it is what makes the candidate set a
  union across installs rather than a per-install intersection; the old
  fixture would have passed a per-install implementation. Adds the mirror
  case (declared only by a client, held by the root) so the union is pinned
  in both directions.
- Update the two docs that still described the single-tier guard:
  `.claude/skills/local-dev/SKILL.md` said "nothing gates either of those,
  and `verify:dep-lockstep` is not it" and cited the live `@types/node`
  drift in the present tense; `docs/quality-gate.md` described only the
  program tier. Both now state what each tier covers and the two limits
  that remain.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J86a6vMcA9csPtdsg7ZcCZ
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-05 16:09:44 -04:00
commit 8e2c4d49fa
1 changed files with 110 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

30
scripts/verify-dep-lockstep.test.mjs
View file

@ -413,10 +413,12 @@ test("majorOf: prerelease and build metadata are irrelevant", () => {
// The declared tier (#2226). One case per rule, same convention as above.
// ---------------------------------------------------------------------------
test("declaredPackages: dependencies and devDependencies from every install", () => {
// devDependencies count because the boundary is "does the repo name it", not
// "does it ship" — `@types/node` and the toolchain are exactly the case #2226
// is about, and all of them are devDependencies.
test("declaredPackages: dependencies, devDependencies and optionalDependencies from every install", () => {
// devDependencies count because the boundary is "does the repo name a package
// npm installs for us", not "does it ship" — `@types/node` and the toolchain
// are exactly the case #2226 is about, and all of them are devDependencies.
// optionalDependencies count for the same reason: npm attempts to install one
// like any other direct declaration (Copilot, #2226).
assert.deepEqual(
[
...declaredPackages([
@ -426,28 +428,24 @@ test("declaredPackages: dependencies and devDependencies from every install", ()
manifest: {
dependencies: { "react-dom": "^19.2.4" },
devDependencies: { "@types/react": "^19.2.14" },
optionalDependencies: { fsevents: "^2.3.3" },
},
},
]),
].sort(),
["@types/react", "react", "react-dom"],
["@types/react", "fsevents", "react", "react-dom"],
);
});
test("declaredPackages: peer and optional ranges are not declarations", () => {
// A peer range constrains the consumer rather than naming what we install;
// the copy npm auto-installs to satisfy one is still caught, because it lands
// top-level in an install whose sibling declares the same name.
test("declaredPackages: a peer range is not a declaration", () => {
// A peer range constrains the consumer's HOST rather than naming what this
// repo installs; the copy npm auto-installs to satisfy an unmet one is still
// caught whenever some manifest declares that name, which is the
// eslint/typescript/vitest shadow case (all three are root devDependencies).
assert.deepEqual(
[
...declaredPackages([
{
dir: ".",
manifest: {
peerDependencies: { react: "^19.0.0" },
optionalDependencies: { fsevents: "^2.3.3" },
},
},
{ dir: ".", manifest: { peerDependencies: { react: "^19.0.0" } } },
]),
],
[],