Skip to content

build(deps): update devframe and @devframes packages to 1.2.5 - #409

Merged
erkamyaman merged 3 commits into
mainfrom
build/devframe-1.2.5
Oct 14, 2026
Merged

build(deps): update devframe and @devframes packages to 1.2.5#409
erkamyaman merged 3 commits into
mainfrom
build/devframe-1.2.5

Conversation

@erkamyaman

@erkamyaman erkamyaman commented Oct 14, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

What and why

devframe 1.2.5 is out. It ships the exposeSharedState route option (devframe #444), which our pangularMcp() filter has used since #379, but which only worked inside this repo through a local patch. With 1.2.5, turning an agent inspector off also hides its shared state from agents in a published install.

Closes #238.

  • Every devframe and @devframes/* dependency moves to ^1.2.5. The lockfile was regenerated with pnpm install.
  • Patches:
    • devframe and @devframes/hub: the exposeSharedState hunks are upstream and dropped. The server instructions hunks are not, so they are ported to 1.2.5.
    • @devframes/agentic: kept as is. Image answers and server instructions are not in 1.2.5.
  • New tests fail if a patch adds exposeSharedState back, and require the devframe packages to be at 1.2.4 or later.
  • extension/ui is rebuilt, because the panel bundles the devframe RPC client, which changed in 1.2.4.
  • Docs: the contributing page lists the two remaining patches. The agent tool and MCP server pages now say that published installs get no screenshot-component image and no server instructions until devframe passes them on.

Also fixed upstream by the bump, with no code change here: settings writes from the client are persisted (#423), hub UI shortcut-conflict warnings (#443), language options stay reachable (#447), dock order kept on language change (#446), and the embedded dock mounts in cross-origin previews such as StackBlitz (#441).

How it was verified

  • pnpm commit:check
  • pnpm format:check
  • pnpm typecheck
  • pnpm test:devtools (3098) and pnpm test:panel (737)
  • pnpm skills:check
  • Docs in apps/docs updated and pnpm docs:build passes
  • pnpm extension:build and extension/ui committed
  • pnpm devtools:build-pkg, then the packed package installed with npm into a scratch project (devframe 1.2.5, no patches). With agent.tools.forms: false, the MCP server listed 84 tools, devframe_state_read hid pangular:forms and kept pangular:router, and the forms resource was not listed.

Notes for reviewers

  • The two remaining patches (image answers and server instructions) could be dropped once devframe takes them upstream. No upstream PR exists yet for either.
  • examples/angular-native is outside the workspace. Its range was bumped but not installed or run.

Summary by CodeRabbit

  • Features

    • MCP HTTP endpoints can now pass configured server instructions through when using the supported package patches.
    • Shared-state exposure settings are supported by published packages on devframe 1.2.4 and later.

  • Documentation

    • Clarified that stdio endpoints do not send server instructions, and that installed packages may not yet pass instructions or screenshot images through. In that case, the screenshot tool returns a text note instead of an image.

@erkamyaman
build(deps): update devframe and @devframes packages to 1.2.5
013d5c3 
devframe 1.2.4 ships the exposeSharedState MCP route option
(devframes/devframe#444), so agent.tools.<name>: false now hides an
inspector's shared-state keys from devframe_state_read and the
devframe://state resources in the published package too, not only
inside this repository where a local patch provided the option.

Drop the exposeSharedState hunks from the patches and redo the rest
for 1.2.5: the server instructions route option (devframe, hub and
agentic) and the mcpContent image answers (agentic). Neither is in
1.2.5. Add a test that fails if the shared-state filter goes back onto
a local patch, and update the patched dependencies section of the
development docs.

Closes #238
@erkamyaman
build(extension): rebuild the panel bundle with devframe 1.2.5
e5b0841 
The panel bundles the devframe RPC client, which changed in 1.2.4 (automatic client caching discovery), so the committed extension/ui build must be regenerated to match the lockfile.
@erkamyaman
docs(docs): say published installs get no screenshot image or server …
6e2ca37 
…instructions yet

Both need a local devframe patch that devframe 1.2.5 still lacks, so an installed package answers screenshot-component with the note only and sends no MCP instructions.
@github-actions github-actions Bot added area: package The ng-devtools package (packages/ng-devtools) area: extension The Chrome extension area: demo The demo apps area: docs The documentation site labels Oct 14, 2026
@coderabbitai

coderabbitai Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 570a3fab-e558-4c1a-b84d-6a085534ad93
📥 Commits

Reviewing files that changed from the base of the PR and between 8ed7f92 and 6e2ca37.

⛔ Files ignored due to path filters: 2
  • extension/ui/assets/index-BUftb8RW.js is excluded by !**/assets/index-[0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-][0-9a-z_-].js
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing: 15
  • apps/docs/src/content/agents/mcp-server.md
  • apps/docs/src/content/agents/tools.md
  • apps/docs/src/content/contributing/development.md
  • examples/angular-native/package.json
  • extension/ui/assets/browser-agent-rpc-BXhoSh1z-BF1s_IvO.js
  • extension/ui/index.html
  • package.json
  • packages/devtools/package.json
  • packages/devtools/src/__tests__/agent-mcp.test.ts
  • packages/devtools/src/agent-mcp.ts
  • patches/@devframes__agentic@1.2.5.patch
  • patches/@devframes__hub@1.2.5.patch
  • patches/devframe@1.2.3.patch
  • patches/devframe@1.2.5.patch
  • pnpm-workspace.yaml
💤 Files with no reviewable changes: 1

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Dependencies and patch mappings move to version 1.2.5. MCP patches forward instructions and use the configured shared-state exposure value. Tests, documentation, and extension UI asset references are also updated.

Changes: MCP dependency and patch update

Layer / File(s) Summary
Align dependency and patch versions
package.json, packages/devtools/package.json, examples/angular-native/package.json, pnpm-workspace.yaml, extension/ui/index.html, extension/ui/assets/*		 Dependencies and workspace patch mappings now target version 1.2.5. The extension UI points to the updated module asset.
Update MCP route patches
patches/devframe@1.2.3.patch, patches/devframe@1.2.5.patch, patches/@devframes__hub@1.2.5.patch		 The devframe patch adds instructions to MCP configuration and route options, then forwards it when creating the server. The hub patch passes configured instructions and uses configured exposeSharedState, defaulting to true.
Update MCP validation and documentation
packages/devtools/src/__tests__/agent-mcp.test.ts, packages/devtools/src/agent-mcp.ts, apps/docs/src/content/agents/*, apps/docs/src/content/contributing/development.md		 Tests check patch contents and dependency versions. Documentation describes support for exposeSharedState, the instructions patch, and published-package limitations for server instructions and screenshot image content.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Merge Risk: 🔵 Low · up to 6e2ca

This dependency upgrade mostly aligns versions and documentation. The open question is whether published installs actually hide a disabled inspector's shared state when the hub is used, because the repository still patches the hub to honor that setting. The owner should confirm that behavior before relying on issue #238 being closed.

Security architecture risk: 🔵 Low · up to 6e2ca

No newly introduced exposure was demonstrated. The existing restrictions remain configured, and the integration tests assert denial across state-read and resource interfaces. However, enforcement in the published dependencies was not fully verified, so some uncertainty remains at this security boundary.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — A failure to apply the predicate could expose otherwise disabled application state to clients able to reach and pass the MCP route's access controls. The policy inventory includes forms, HTTP payloads, routing, errors and plugin state. The inspected evidence does not establish wider service, datastore or environment authority.

Security Findings and Attack Paths

  • observed — The supplied verifier rejected the shared-state exposure candidate. The strongest source counterevidence asserts denial of disabled forms state across MCP listing, direct state-read and resource access, while preserving panel registration and successful router reads. These are existing assertions, not tests executed during this review.

Trust Boundaries and Controls

  • observed — The hub patch retains forwarding of authorization and allowedOrigins alongside the exposure predicate. Local hub configuration also supplies a token when neither an explicit MCP setting nor disabled authentication overrides that default. The upstream execution of those controls remains outside the inspected source.

Resilience and Maintainability Implications

  • observed — The new guards reject local additions of exposeSharedState and require dependency versions expected to support the route option. They reduce drift back to repository-only filtering, but static patch and version checks do not prove effective filtering in a published installation.

Hardening Proposals

  • proposed — Add a packed-install boundary check without workspace patches that verifies disabled-state denial through MCP state and resource reads, together with an allowed-state positive control. This would directly validate the published-install guarantee that motivates the upgrade.
Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (10 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the primary change: updating devframe and @devframes dependencies to version 1.2.5.
Linked Issues check Passed Issue #238 requires disabled inspectors' shared-state keys to be hidden from devframe_state_read and devframe://state, while the inspector tab remains available. The existing pangularMcp() filte…
Out of Scope Changes check Passed The dependency updates, lockfile regeneration, patch changes, focused tests, documentation updates, extension rebuild, and examples/angular-native range update support the devframe 1.2.5 migration a…
Full details: Docstring Coverage

Explanation

Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (10 skipped: 10 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 2
📝 Generate docstrings: 💡
  • Commit to this branch
  • Create a new PR
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 14, 2026

Copy link
Copy Markdown

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Failed ❌

View logs ↗		 6e2ca37 2026-10-14T07:28:31.258Z View logs ↗

@nx-cloud

nx-cloud Bot commented Oct 14, 2026

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit 6e2ca37

Command Status Duration Result
nx affected -t test build ✅ Succeeded 2m 39s View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-10-14 07:30:12 UTC

@erkamyaman
erkamyaman merged commit e0de840 into main Oct 14, 2026
8 of 10 checks passed
@erkamyaman
erkamyaman deleted the build/devframe-1.2.5 branch October 14, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@santoshyadavdev santoshyadavdev Awaiting requested review from santoshyadavdev santoshyadavdev is a code owner

Assignees

No one assigned

Labels

area: demo The demo apps area: docs The documentation site area: extension The Chrome extension area: package The ng-devtools package (packages/ng-devtools)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

mcp: agent.tools.<inspector>=false still exposes the inspector's data through devframe_state_read

1 participant

@erkamyaman