[kentcdodds]

Intent

Resolve field-report findings K-04, K-05, K-07, and K-08 so ad hoc execute can use npm dependencies, dynamic package invocation fails fast on malformed input, removed helpers are truly absent, and timeout outcomes do not imply side effects were rolled back.

Summary

• Detect literal bare npm imports in ad hoc execute and synthesize a deterministic ephemeral package.json with latest dependencies before bundle preparation; modules without bare imports retain the existing one-file source set.
• Give unresolved ad hoc bundle imports execute-specific guidance while preserving saved module/import/app labels.
• Reject unknown packages.invoke keys and list the accepted camel-case contract.
• Remove packages.check and packages.invokeChecked teaching stubs from the execute runtime helper.
• Propagate the host evaluation abort signal through the package-invoke bridge into nested saved-package executors, and use timeout text that warns already-started remote side effects may complete and points to idempotencyKey/run_get recovery.
• Update execute guidance and usage docs to match npm resolution and timeout behavior.

Testing

• npm run validate: passed.
• Pre-push node + Workers suite: 566 files / 1,942 tests passed.
• Pre-push Playwright E2E: 7 passed.
• Focused node regressions: 40 passed.
• PR CI: all checks passed; CodeRabbit completed with no actionable comments.
• Production deployment: passed (run).

System changes

System recap — extends existing primitives (medium risk)

Mode: recap · Base: main @ 1916ffe · Head: fe48666

Classification: extends — changes execute bundling, package invocation validation/cancellation, and timeout contracts without adding a primitive.

Primitives touched

Primitive	Group	Impact
mcp-server	surfaces	extends — strict invoke input and honest timeout contract
capabilities-execute	runtime	extends — ephemeral npm manifest synthesis and abort propagation
package-runtime	runtime	extends — context-aware bundle errors and nested invoke cancellation

System map

Ad hoc execute discovers npm dependencies before bundling; runtime package calls carry the execute deadline into nested package execution.

Legend: green = composes (wiring only) · amber = extended by this PR · red = new primitive · gray = context (unchanged, included only when an edge crosses it).

flowchart LR
	mcpServer["mcp-server<br/>MCP endpoint (/mcp)"]:::extended
	execute["capabilities-execute<br/>Capabilities execute runtime"]:::extended
	packageRuntime["package-runtime<br/>Package runtime"]:::extended
	mcpServer -->|"strict input + timeout response"| execute
	execute -->|"ephemeral npm manifest + bundle context"| packageRuntime
	execute -->|"AbortSignal on nested packages.invoke"| packageRuntime
	classDef touched fill:#1a7f37,color:#fff
	classDef extended fill:#9a6700,color:#fff
	classDef added fill:#cf222e,color:#fff
	classDef untouched fill:#57606a,color:#fff

Loading

Before / after

Before	After
Bare npm imports stayed unresolved	Execute synthesizes latest dependency entries before bundling
Unknown invoke keys were dropped	Unknown keys reject with the accepted key list
Removed helper properties threw teaching errors	Only packages.invoke exists
Timeout implied execution stopped	Timeout states observation stopped and side effects may finish

Conductor report

Track C report: STATUS(done); PR merged at e52578a9655d14bfaaab5c9aa8f429faf142aa0e; production deploy succeeded; evidence: npm run validate and all PR CI green, CodeRabbit completed with no actionable comments, 1,942 node/Workers tests and 7 Playwright tests passed in the push gate; remains: no Track C work, while sibling-owned package-app/history references account for remaining invokeChecked search hits.

  

Summary by CodeRabbit

• New Features
  • Ad hoc executions now automatically discover and bundle literal npm imports using current registry versions.
  • Nested executions and package invocations support cooperative cancellation.
• Bug Fixes
  • Timeout messages now explain cancellation status, possible side effects, affected tools, and retry guidance.
  • Package invocation inputs now reject unknown fields and unsupported legacy naming formats.
  • Unresolved dependency errors provide clearer guidance for ad hoc executions.
• Documentation
  • Updated execution guidance for dependency discovery, timeouts, cancellation, and safe retries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a84b4d5-f1c1-42a7-9623-359a4b72d1c0

📥 Commits

Reviewing files that changed from the base of the PR and between 1916ffe and fe48666.

📒 Files selected for processing (17)

• docs/use/execute.md
• packages/worker/src/mcp/executor.node.test.ts
• packages/worker/src/mcp/executor.ts
• packages/worker/src/mcp/instructions/execute-tool-description.ts
• packages/worker/src/mcp/run-kody-registry.node.test.ts
• packages/worker/src/mcp/run-kody-registry.ts
• packages/worker/src/mcp/runtime-helper-manifest.ts
• packages/worker/src/package-invocations/http-invoke.ts
• packages/worker/src/package-invocations/idempotent-module-invocation.ts
• packages/worker/src/package-invocations/input-parsing.node.test.ts
• packages/worker/src/package-invocations/input-parsing.ts
• packages/worker/src/package-invocations/module-execution.ts
• packages/worker/src/package-invocations/runtime-tool-factories.ts
• packages/worker/src/package-runtime/module-graph-artifacts.ts
• packages/worker/src/package-runtime/module-graph-bundle-builders.ts
• packages/worker/src/package-runtime/module-graph.workers.test.ts
• packages/worker/src/sentry-options.ts

---

📝 Walkthrough

Walkthrough

Ad hoc execute now discovers literal npm imports during bundling. Execution timeouts and external cancellation propagate through nested package calls. Package invocation parsing rejects unknown and legacy fields, and removed runtime helpers are no longer exposed.

Changes

Execute runtime changes

Layer / File(s)	Summary
Ad hoc npm bundling docs/use/execute.md, packages/worker/src/mcp/run-kody-registry.ts, packages/worker/src/package-runtime/..., packages/worker/src/mcp/...test.ts	Ad hoc execution extracts bare npm imports, generates sorted package.json dependencies pinned to latest, and reports context-specific bundle errors. Tests cover runtime-only code and npm imports.
Nested execution cancellation packages/worker/src/mcp/executor.ts, packages/worker/src/mcp/runtime-helper-manifest.ts, packages/worker/src/package-invocations/..., packages/worker/src/mcp/executor.node.test.ts, packages/worker/src/sentry-options.ts, docs/use/execute.md	Abort signals now propagate through dynamic workers, abort-aware tools, package invocations, and saved modules. Timeout diagnostics describe cancellation and possible side effects.
Invocation contract cleanup packages/worker/src/package-invocations/input-parsing.ts, packages/worker/src/package-invocations/input-parsing.node.test.ts, packages/worker/src/mcp/runtime-helper-manifest.ts, packages/worker/src/package-runtime/module-graph.workers.test.ts, packages/worker/src/mcp/instructions/execute-tool-description.ts	Parsing accepts only documented camelCase fields and rejects unknown keys. The runtime exposes only packages.invoke; related guidance and tests were updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ExecuteCaller
  participant runBundledModuleWithRegistry
  participant createExecuteExecutor
  participant DynamicWorker
  participant PackageInvokeTools
  ExecuteCaller->>runBundledModuleWithRegistry: start execute with AbortSignal
  runBundledModuleWithRegistry->>createExecuteExecutor: pass signal
  createExecuteExecutor->>DynamicWorker: evaluate with deadline
  DynamicWorker->>PackageInvokeTools: invoke with active signal
  ExecuteCaller-->>createExecuteExecutor: timeout or abort
  createExecuteExecutor-->>DynamicWorker: abort evaluation
  PackageInvokeTools-->>DynamicWorker: stop cooperative nested work

Loading

Possibly related PRs

• kentcdodds/kody#976: Both changes modify MCP execution timeout and cancellation behavior.
• kentcdodds/kody#1029: Both changes modify runModuleWithRegistry and ad hoc bundling flow.
• kentcdodds/kody#1046: Both changes modify package invocation APIs and execution plumbing.

Suggested reviewers: kody-bot

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main runtime hardening changes for ad hoc execute and package invocation.
Description check	✅ Passed	The description includes all required sections and clearly documents intent, changes, testing evidence, and system impact.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/kody-fr-execute-invoke-0de1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1309.kody-a99.workers.dev

Worker: kody-pr-1309
D1: kody-pr-1309-db
KV: kody-pr-1309-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1309-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1309-mock-cloudflare)