Three independent small items Copilot raised while reviewing the v2.2.0 milestone merge (#1993), each verified. Grouped because none is worth its own card; each is a few lines.
1. clients/web/.npmignore's comment now contradicts the root manifest
#1934 added clients/web/static to the root package.json "files" allowlist, but the explanatory comment in clients/web/.npmignore:11-15 still says the allowlist "restricts publishing to those two directories" (build/ and dist/) and that everything else under clients/web "stays out regardless". That is now false, and it is exactly the kind of packaging claim someone will rely on — the file exists because a packaging contract was misread once already.
Update the comment to name static and say why it ships (read from disk at runtime by sandbox-controller.ts).
2. Unjustified as unknown as Response in a test
clients/web/src/test/core/react/useServers.test.tsx:1016 returns { ok: true, body } as unknown as Response from a stub fetchFn. AGENTS.md prohibits an unjustified double cast: it must either carry an inline comment explaining why no better option exists, or be replaced.
Preferred: build a real Response over a real ReadableStream whose second read blocks, so the double is structurally type-checked. Failing that, add the justification comment.
3. scripts/smoke-web-app.mjs can orphan the test server on a readiness timeout
startMcpServer() (scripts/smoke-web-app.mjs:164-196) returns { child, url } only once the announcement line matches. On the 30-second timeout — a child that is alive but never announces — it throws without ever handing the handle back, so mcpServer is unassigned, the caller's shutdown() cannot stop it, and process.exit(1) leaves the server orphaned, possibly holding its port for a later run.
Make the child reachable before the wait (assign it via an out-param, or have the caller own the spawn), so teardown covers the timeout path. The other early-exit paths (spawnError, exited) are fine — the child is already gone there.
Three independent small items Copilot raised while reviewing the v2.2.0 milestone merge (#1993), each verified. Grouped because none is worth its own card; each is a few lines.
1.
clients/web/.npmignore's comment now contradicts the root manifest#1934 added
clients/web/staticto the rootpackage.json"files"allowlist, but the explanatory comment inclients/web/.npmignore:11-15still says the allowlist "restricts publishing to those two directories" (build/anddist/) and that everything else underclients/web"stays out regardless". That is now false, and it is exactly the kind of packaging claim someone will rely on — the file exists because a packaging contract was misread once already.Update the comment to name
staticand say why it ships (read from disk at runtime bysandbox-controller.ts).2. Unjustified
as unknown as Responsein a testclients/web/src/test/core/react/useServers.test.tsx:1016returns{ ok: true, body } as unknown as Responsefrom a stubfetchFn. AGENTS.md prohibits an unjustified double cast: it must either carry an inline comment explaining why no better option exists, or be replaced.Preferred: build a real
Responseover a realReadableStreamwhose second read blocks, so the double is structurally type-checked. Failing that, add the justification comment.3.
scripts/smoke-web-app.mjscan orphan the test server on a readiness timeoutstartMcpServer()(scripts/smoke-web-app.mjs:164-196) returns{ child, url }only once the announcement line matches. On the 30-second timeout — a child that is alive but never announces — itthrows without ever handing the handle back, somcpServeris unassigned, the caller'sshutdown()cannot stop it, andprocess.exit(1)leaves the server orphaned, possibly holding its port for a later run.Make the child reachable before the wait (assign it via an out-param, or have the caller own the spawn), so teardown covers the timeout path. The other early-exit paths (
spawnError,exited) are fine — the child is already gone there.