feat(config)!: require a server factory from every stdio MCP entry and retire AB4736

[ScriptedAlchemy]

Summary

Every local stdio MCP entry now default-exports a server factory and runs inside the framework stdio lifecycle shell. The second build path, which bundled a self-connecting entry byte for byte with no console guard, signal handling, stdin-EOF exit, or heartbeat, is deleted. AB4730 changes from an informational nudge to an error.

AB4736 is retired. The top-level skills/, commands/, and rules/ document locations were already undiscovered, so the three extra globs that ran on every validate, inspect, build, and dev only existed to report them. Explicit skills paths still work anywhere.

Removal matrix

Removed	Callers migrated	Deleted surface
Self-connecting stdio MCP entries	fixtures/integration/comprehensive, fixtures/integration/packed-release, inline fixtures in 20 test files	byte-for-byte branch in build/entries.ts and build/inspect-bundler.ts; AB4730 info nudge becomes an error
Top-level document detection	tests/package-conventions.test.ts	legacyConventionalDocuments, three fast-glob passes, AB4736

AB4731–AB4735 stay. They flag a confusable current state (explicit config shadowing a conventional file) and accept no old shape. examples/rsc-agent-runtime declares its self-connecting server as entry: { prebuilt }, which is outside the rule.

Consumer impact

A local entry without a default export fails with AB4730. Default-export the server factory, or declare a prebuilt server with command or url. Former self-connecting servers now get the shell's stderr heartbeat and prompt exit at transport close.

Verification

On 832709131f, rebased onto origin/main after #810 merged (18a913e9d8):

• pnpm build: pass
• pnpm typecheck: pass
• pnpm lint: pass
• pnpm test:unit: pass (309 files, 4,480 tests)
• pnpm test:integration:run: pass (whole pool, 104 files, 1,186 tests)
• pnpm test:packed: pass (whole packed pool, 16 files, 47 tests)
• pnpm docs:site:build: pass (language parity OK, diagnostics coverage OK, 0 broken links)

Review

Independent review (GPT-5.6, change-risk pass) found one low item.

• Low, dismissed. AB4730 skips explicit MCP entries whose extension is outside the JS/TS set. Such an entry cannot be bundled on either the old byte-for-byte path or the new wrapped path, so the build already fails for it. This PR opens no new gap.

Follow-up

Codex P1 (CommonJS module.exports factories rejected by AB4730) fixed in #850. AB4730 accepts a top-level module.exports = factory unless the file binds its own module. An integration test builds such a .cjs entry and lists its tools over stdio.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T02:08:44.789607Z	1d31f49	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[changeset-bot]

🦋 Changeset detected

Latest commit: f04864a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agent-bundle	Minor
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

agent-bundle/packages/agent-bundle/src/config/validate.ts

Lines 634 to 636 in 1d31f49

	if (source === undefined || !bundleScriptExtensions.has(extname(source).toLowerCase())) return [];
	try {
	if (scanEntryExportsSource(readFileSync(source, 'utf8'), source).hasDefaultExport) return [];

Accept CommonJS factory exports before raising AB4730

When a supported .cjs MCP entry uses the idiomatic module.exports = () => server, this syntax-only scan reports no default export and the new error blocks validation and builds. Such a module does expose that function as serverModule.default to the generated import * as serverModule shell, so it already satisfies the runtime factory contract; account for CommonJS assignment exports or exclude .cjs from the advertised supported module formats rather than rejecting a usable entry.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@839

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@839

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@839

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@839

commit: 8327091