fix(mcp): list reporting tabs for an unknown NgRx page

[erkamyaman]

What and why

inspect-signal-store and signal-store-history answered an unknown page with "No page X is reporting NgRx state" followed by "No NgRx state has been reported yet", even when other tabs were reporting. Agents read that as nothing being connected and got no page id to retry with. The agent tools docs (apps/docs/src/content/agents/tools.md, "The page argument") promise that an unknown page lists the tabs that do report, and dispatch-ngrx-action and the other page tools already do this.

Both tools now answer an unknown page with the shared unknownPageText(page, pages, 'NgRx state') helper from rpc/pages.ts. It lists the reporting tabs newest first, with their URLs. When no tab reports NgRx state at all, the answer is unchanged.

I checked the other NgRx agent tools for the same problem and found none:

• dispatch-ngrx-action already uses unknownPageText.
• get-ngrx-store is a source scan with no page argument.
• The pangular:ngrx-store resource takes no page.

How it was verified

• pnpm commit:check: 1 commit message OK
• pnpm format:check: all matched files use Prettier code style
• pnpm typecheck: passes (exit 0); the only output is existing NG8107 warnings in app
• pnpm test:devtools: 129 files, 1429 tests passed, including 4 new tests in rpc/__tests__/ngrx-live-tools.test.ts
• pnpm test:panel: not run, app/ unchanged
• Docs updated + pnpm docs:build: not needed, the docs already describe the new behaviour
• pnpm extension:build: not needed, app/ unchanged
• Browser axe check: not needed, no UI change

Notes for reviewers

• The new answer lists page URLs reported by the browser. Both tools already wrap their answer in the untrusted-data preamble (withUntrustedPreamble), so this adds no new exposure.
• Passing an unknown page when no tab reports at all still gives "No page X is reporting NgRx state." plus the no-data guidance, so agents are still told how to connect a page.

Summary by CodeRabbit

• Bug Fixes
  • NgRx Signal Store inspection and history responses now identify requested pages with no reports and list pages that do have reports, newest first. When no reports exist, the tools continue to indicate that no NgRx state has been reported.

[coderabbitai]

📝 Walkthrough

Walkthrough

The NgRx inspect and history tools now list known reporting pages when a requested page has no matching report. Tests cover this response and the empty-report case.

Changes

NgRx page matching

Layer / File(s)	Summary
Shared no-match handling packages/devtools/src/rpc/ngrx-live-tools.ts, packages/devtools/src/rpc/__tests__/ngrx-live-tools.test.ts	Both tools use shared logic to list known pages when reports exist. When the page map is empty, they retain the no-report response. Tests check that known pages appear newest first.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

---

Merge Risk | ⚪ Minimal · up to c1c6f

Merge Risk: ⚪ Minimal · up to c1c6f

The NgRx tools list reporting pages for an unknown page and retain the no-report response when there are no reports. No material issue is established before merge.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to c1c6f

The change provides retry guidance using information already available through another tool. The affected responses retain their existing untrusted-data warning and output limit. No new permissions, state changes, or material security risk were identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The added response content consists of identifiers and URLs from the receiving devframe's existing NgRx page map. No global page lookup or additional data owner is introduced in the inspected path.

Security Findings and Attack Paths

• inferred — The new responses expose browser-influenced metadata through two additional read-only tool paths, but do not materially expand the available disclosure set: dispatch-ngrx-action already listed the same NgRx pages at the PR base. No new action authority or control bypass was identified.

Trust Boundaries and Controls

• observed — Both public RPC handlers still wrap formatter output with withUntrustedPreamble. The newly listed page metadata therefore remains within the existing untrusted-data response boundary rather than becoming an instruction or privileged operation.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: listing reporting tabs when an unknown NgRx page is requested.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 2
• Waived: $0.50 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		c1c6f36	2026-10-10T22:02:13.712Z	View logs ↗

[coderabbitai]

🔇 Additional comments (2)

packages/devtools/src/rpc/ngrx-live-tools.ts (1)

3-3: LGTM!

Also applies to: 30-37, 132-132, 192-192

packages/devtools/src/rpc/__tests__/ngrx-live-tools.test.ts (1)

343-343: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Loosen the exact-copy assertion.

Line 343 asserts a full user-facing sentence. The sentence comes from the shared unknownPageText helper. A harmless wording change in that helper breaks this test and the other tests that use it. Assert stable parts instead, such as the page id p3 and the NgRx state label.

Proposed change

-      expect(text).toContain('No page `p3` is reporting NgRx state.');
+      expect(text).toContain('`p3`');
+      expect(text).toContain('NgRx state');

Based on learnings: tests should avoid asserting on exact user-facing copy and should prefer stable identifiers or key substrings.

Source: Learnings

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce67ddd8-ecdc-490a-9d1b-bca98f2ea18f

📥 Commits

Reviewing files that changed from the base of the PR and between f245551 and c1c6f36.

📒 Files selected for processing (2)

• packages/devtools/src/rpc/__tests__/ngrx-live-tools.test.ts
• packages/devtools/src/rpc/ngrx-live-tools.ts

Limit details: You’ve used all 10 included reviews currently available.