[kody-bot]

Summary

• Expose packages.check, packages.invoke, and packages.invokeChecked in authenticated ad hoc execute calls.
• Add execute-origin package invocation plumbing with source: "execute", unique auto idempotency, same-user package resolution, and normal target package runtime context.
• Keep static kody:@... imports as library/snapshot imports, and update docs/tool instructions to explain the distinction.
• Opened follow-up issue for codemode package invocation bridge cleanup: De-emphasize codemode package invocation bridge #470.

Testing

• npx vitest run --project node-unit packages/worker/src/mcp/tools/execute.node.test.ts packages/worker/src/package-invocations/service.node.test.ts -t "execute|package runtime checks and invokes|invokeChecked"
• npx vitest run --project workers-unit packages/worker/src/package-runtime/module-graph.workers.test.ts -t "packages"
• npm run validate

Summary by CodeRabbit

• New Features

  • Authenticated execute calls can dynamically invoke other packages via packages.check / packages.invoke / packages.invokeChecked (invokeChecked recommended for entering package runtime).

• Documentation

  • Clarified when packages runtime APIs are available, differences between authenticated execute vs static imports, and guidance for using invokeChecked for package runtime access.

• Tests

  • Added tests covering authenticated execute invocation behavior and ad-hoc runtime invoke scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d7468a06-5d7c-45b0-abe3-e6a4b91bfeb9

📥 Commits

Reviewing files that changed from the base of the PR and between d06b313 and 7d361f7.

📒 Files selected for processing (1)

• docs/use/execute.md

✅ Files skipped from review due to trivial changes (1)

• docs/use/execute.md

---

📝 Walkthrough

Walkthrough

This PR extends dynamic package invocation to authenticated ad-hoc execute calls by introducing an execute-runtime invocation path. The changes enable packages.check, packages.invoke, and packages.invokeChecked helpers in authenticated execute contexts alongside existing package runtime support, with documentation updates and tests.

Changes

Execute-runtime Package Invocation

Layer / File(s)	Summary
Documentation clarifications docs/contributing/packages-and-manifests.md, docs/use/execute.md, docs/use/packages.md, packages/worker/src/mcp/server-instructions.ts	All user-facing and internal docs updated to clarify that packages.* helpers are available in both saved package runtime contexts and authenticated ad-hoc execute calls for dynamic current-version invocation. Security guidance reiterates that static kody:@... imports remain snapshot/library imports; packages.invokeChecked is preferred for execute-time package runtime entry.
Execute-runtime service implementation packages/worker/src/package-invocations/service.ts	Introduces internal:execute-runtime token and createExecutePackageInvokeTools factory for building invoke tools scoped to execute callers. Updates createPackageRuntimeInvokeTools to accept nullable packageContext and branches invocation dispatch: when package context exists, calls package-runtime path; when null, calls new invokePackageExportForExecuteRuntime with execute-specific actor token, source literal 'execute', and idempotency key generation that handles null caller context.
Execute tool wiring and testing packages/worker/src/mcp/tools/execute.ts, packages/worker/src/mcp/tools/execute.node.test.ts	Execute handler now conditionally creates packageInvokeTools via dynamic import when callerContext.user?.userId is present and passes resulting tools into runModuleWithRegistry. Test setup mocks createExecutePackageInvokeTools and validates authenticated callers trigger tool creation with correct { env, baseUrl, callerContext } parameters and tool presence in downstream module invocation.
Integration validation packages/worker/src/package-invocations/service.node.test.ts, packages/worker/src/package-runtime/module-graph.workers.test.ts	Service test exercises execute-runtime invokeChecked path and asserts correct provenance (execute actor, user/caller context, storage context, runtime debug metadata with source: 'execute'). Module-graph integration test confirms ad-hoc execute bundles with packageInvokeTools and null packageContext successfully expose and invoke packages.invokeChecked with expected parameters.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• De-emphasize codemode package invocation bridge #470: Directly addresses the promotion of packages.invokeChecked as the preferred primitive and documents availability in authenticated execute calls.

Possibly related PRs

• kentcdodds/kody#429: Extends the dynamic packages.invoke machinery by adding execute-runtime invocation path with createExecutePackageInvokeTools.
• kentcdodds/kody#435: Adds the checked-invocation API and helpers that this PR builds on.
• kentcdodds/kody#434: Related docs/tests around packages availability and execute/runtime contracts.

Poem

🐰 A rabbit hops through execute's door,
With packages unlocked like never before!
Authenticated callers now invoke with care,
Dynamic runtime tools floating in the air.
Runtime and execute, dancing hand in hand!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main objective: enabling package invocation from execute contexts, which is the primary feature across all changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch investigate-package-invocation-runtime-context

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔎 Preview deployed: https://kody-pr-471.kentcdodds.workers.dev

Worker: kody-pr-471
D1: kody-pr-471-db
KV: kody-pr-471-oauth-kv

Mocks:

• cloudflare: https://kody-pr-471-mock-cloudflare.kentcdodds.workers.dev/__mocks (kody-pr-471-mock-cloudflare)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/use/execute.md`:
- Around line 39-43: The docs are inconsistent about whether the runtime
`packages` API is available in authenticated ad hoc execute flows; update the
later section that currently claims `packages` is null in ad hoc static-import
flows to match the earlier statement that authenticated ad hoc execute exposes
`packages.*`. Edit the paragraph(s) referencing "ad hoc execute static-import
flows" and clarify that when the execute is authenticated you can import and use
`packages` (e.g. `packages.check`, `packages.invoke`, `packages.invokeChecked`),
and keep the guidance to prefer `packages.invokeChecked` unless you already
called `check` and are passing `check.invoke`; ensure both mentions use the same
wording so behavior is documented consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1384ade5-103d-444a-a8aa-f0f61cce97fb

📥 Commits

Reviewing files that changed from the base of the PR and between f8d8328 and d06b313.

📒 Files selected for processing (9)

• docs/contributing/packages-and-manifests.md
• docs/use/execute.md
• docs/use/packages.md
• packages/worker/src/mcp/server-instructions.ts
• packages/worker/src/mcp/tools/execute.node.test.ts
• packages/worker/src/mcp/tools/execute.ts
• packages/worker/src/package-invocations/service.node.test.ts
• packages/worker/src/package-invocations/service.ts
• packages/worker/src/package-runtime/module-graph.workers.test.ts

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

📝 Walkthrough

Walkthrough

This PR extends dynamic package invocation to authenticated ad-hoc execute calls by introducing an execute-runtime invocation path. The changes enable packages.check, packages.invoke, and packages.invokeChecked helpers in authenticated execute contexts alongside existing package runtime support, with comprehensive documentation updates and test coverage.

Changes

Execute-runtime Package Invocation

Layer / File(s)	Summary
Documentation clarifications docs/contributing/packages-and-manifests.md, docs/use/execute.md, docs/use/packages.md, packages/worker/src/mcp/server-instructions.ts	All user-facing and internal docs updated to clarify that packages.* helpers are available in both saved package runtime contexts and authenticated ad-hoc execute calls for dynamic current-version invocation. Security guidance reiterates that static kody:@... imports remain snapshot/library imports; packages.invokeChecked is preferred for execute-time package runtime entry.
Execute-runtime service implementation packages/worker/src/package-invocations/service.ts	Introduces internal:execute-runtime token and createExecutePackageInvokeTools factory for building invoke tools scoped to execute callers. Updates createPackageRuntimeInvokeTools to accept nullable packageContext and branches invocation dispatch: when package context exists, calls package-runtime path; when null, calls new invokePackageExportForExecuteRuntime with execute-specific actor token, source literal 'execute', and idempotency key generation. Idempotency key logic updated to generate random UUID when no caller package context.
Execute tool wiring and testing packages/worker/src/mcp/tools/execute.ts, packages/worker/src/mcp/tools/execute.node.test.ts	Execute handler now conditionally creates packageInvokeTools via dynamic import when callerContext.user?.userId is present and passes resulting tools into runModuleWithRegistry. Test setup mocks createExecutePackageInvokeTools and validates authenticated callers trigger tool creation with correct { env, baseUrl, callerContext } parameters and tool presence in downstream module invocation.
Integration validation packages/worker/src/package-invocations/service.node.test.ts, packages/worker/src/package-runtime/module-graph.workers.test.ts	Service test exercises execute-runtime invokeChecked path and asserts correct provenance (execute actor, user/caller context, storage context, runtime debug metadata with source: 'execute'). Module-graph integration test confirms ad-hoc execute bundles with packageInvokeTools and null packageContext successfully expose and invoke packages.invokeChecked with expected parameters.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• kentcdodds/kody#470: Directly addresses the promotion of packages.invokeChecked as the preferred public primitive and updates docs and instructions to clarify availability in authenticated execute calls.

Possibly related PRs

• kentcdodds/kody#429: Extends the dynamic packages.invoke machinery by adding execute-runtime invocation path with createExecutePackageInvokeTools as a direct addition to the dynamic package invocation capability.

• kentcdodds/kody#435: Touches the same package invocation and checked-invocation implementation in packages/worker/src/package-invocations/service.ts, with this PR extending that capability into authenticated execute runtime contexts.

• kentcdodds/kody#434: Updates the same packages availability contract in docs/use/execute.md and packages/worker/src/mcp/tools/execute.ts, but this PR extends packages.invoke* to authenticated ad-hoc execute while the retrieved PR documents it as null—directly related semantic change.

Poem

🐰 A rabbit hops through execute's door,
With packages unlocked like never before!
Authenticated callers now invoke with care,
Dynamic runtime tools floating in the air.
Runtime and execute, dancing hand in hand!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Enable package invocation from execute' accurately and concisely describes the primary change: adding the ability to invoke packages from authenticated ad hoc execute calls.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch investigate-package-invocation-runtime-context

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}