Conversation
✅ Deploy Preview for storybook-mcp-self-host-example ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
🦋 Changeset detectedLatest commit: 7155bd9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
Bundle ReportBundle size has no change ✅ |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #373 +/- ##
=======================================
Coverage 79.66% 79.66%
=======================================
Files 50 50
Lines 2095 2095
Branches 624 624
=======================================
Hits 1669 1669
Misses 220 220
Partials 206 206 ☔ View full report in Codecov by Harness. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe PR updates workspace dependencies and catalogs across agent evaluation, templates, MCP packages, and development tooling. It also updates the ChangesDependency and agent-eval updates
Possibly related PRs
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
agent-eval/patches/@vercel__agent-eval@1.4.0.patch (1)
48-53: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse the selected transcript source for observed-model extraction.
transcriptprefersstdoutTranscript, butobservedModelpreferssessionTranscript. When both exist, the stored transcript and observed model can describe different runs. Use the same stdout-first source, ideallytranscriptitself.Proposed fix
- const observedModel = extractObservedModelFromCodexSession(sessionTranscript ?? stdoutTranscript) ?? null; + const observedModel = extractObservedModelFromCodexSession(stdoutTranscript ?? sessionTranscript) ?? null;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agent-eval/patches/`@vercel__agent-eval@1.4.0.patch around lines 48 - 53, Update observed-model extraction to use the already selected stdout-first transcript source in transcript, rather than independently preferring sessionTranscript. Pass transcript to extractObservedModelFromCodexSession so the stored transcript and observed model always describe the same run.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@agent-eval/patches/`@vercel__agent-eval@1.4.0.patch:
- Around line 48-53: Update observed-model extraction to use the already
selected stdout-first transcript source in transcript, rather than independently
preferring sessionTranscript. Pass transcript to
extractObservedModelFromCodexSession so the stored transcript and observed model
always describe the same run.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d2c7021c-a703-41b0-883a-e16860ef7c01
⛔ Files ignored due to path filters (9)
agent-eval/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlapps/internal-storybook/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlapps/self-host-mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamleval/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/addon-mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/claude-plugin/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/codex-plugin/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
agent-eval/evals/812-first-story-empty-project/package.jsonagent-eval/package.jsonagent-eval/patches/@vercel__agent-eval@1.4.0.patchagent-eval/templates/monorepo/package.jsonagent-eval/templates/monorepo/packages/app/package.jsonagent-eval/templates/monorepo/packages/ui/package.jsonagent-eval/templates/reshaped-storybook/package.jsonagent-eval/templates/vite-app/package.jsonapps/self-host-mcp/package.jsoneval/package.jsonpackage.jsonpackages/mcp/package.jsonpnpm-workspace.yaml
1c24f98 to
9d4ef00
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
agent-eval/patches/@vercel__agent-eval@1.4.0.patch (2)
119-120: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDocument the existing OIDC fallback.
classifyWithAI()still supportsVERCEL_OIDC_TOKENthrough the gateway branch, but these JSDoc strings mention only Anthropic andAI_GATEWAY_API_KEY. IncludeVERCEL_OIDC_TOKENfor consistency.Also applies to: 163-163
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agent-eval/patches/`@vercel__agent-eval@1.4.0.patch around lines 119 - 120, Update the JSDoc for classifyWithAI() and its corresponding second documentation occurrence to mention VERCEL_OIDC_TOKEN as an accepted credential for the Vercel AI Gateway path, alongside ANTHROPIC_API_KEY and AI_GATEWAY_API_KEY.
68-69: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winSet
NO_COLORafter merging the caller environment.
{ NO_COLOR: '1', ...env }allowsenv.NO_COLORto override the forced value, so captured output may still contain ANSI codes. Mergeenvfirst and assignNO_COLORlast.Proposed fix
- const outputEnv = { NO_COLOR: '1', ...env }; + const outputEnv = { ...env, NO_COLOR: '1' };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agent-eval/patches/`@vercel__agent-eval@1.4.0.patch around lines 68 - 69, Update the outputEnv construction in the test execution flow to merge env first and assign NO_COLOR last, ensuring caller-provided values cannot override the forced "1" setting before passing it to sandbox.runCommand.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agent-eval/templates/vite-app/package.json`:
- Around line 25-26: Update the `@vercel/agent-eval` dependency pin from 1.2.0 to
1.4.0 in the vite-app package manifest and every other template manifest
containing the stale pin, ensuring all generated projects use version 1.4.0.
---
Outside diff comments:
In `@agent-eval/patches/`@vercel__agent-eval@1.4.0.patch:
- Around line 119-120: Update the JSDoc for classifyWithAI() and its
corresponding second documentation occurrence to mention VERCEL_OIDC_TOKEN as an
accepted credential for the Vercel AI Gateway path, alongside ANTHROPIC_API_KEY
and AI_GATEWAY_API_KEY.
- Around line 68-69: Update the outputEnv construction in the test execution
flow to merge env first and assign NO_COLOR last, ensuring caller-provided
values cannot override the forced "1" setting before passing it to
sandbox.runCommand.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8981fb39-5597-486b-ac0e-da413b886217
⛔ Files ignored due to path filters (9)
agent-eval/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlapps/internal-storybook/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlapps/self-host-mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamleval/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/addon-mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/claude-plugin/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/codex-plugin/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackages/mcp/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
agent-eval/evals/812-first-story-empty-project/package.jsonagent-eval/package.jsonagent-eval/patches/@vercel__agent-eval@1.4.0.patchagent-eval/templates/monorepo/package.jsonagent-eval/templates/monorepo/packages/app/package.jsonagent-eval/templates/monorepo/packages/ui/package.jsonagent-eval/templates/reshaped-storybook/package.jsonagent-eval/templates/vite-app/package.jsonapps/self-host-mcp/package.jsoneval/package.jsonpackage.jsonpackages/mcp/package.jsonpnpm-workspace.yaml
🚧 Files skipped from review as they are similar to previous changes (10)
- agent-eval/templates/monorepo/packages/app/package.json
- packages/mcp/package.json
- apps/self-host-mcp/package.json
- agent-eval/templates/monorepo/packages/ui/package.json
- agent-eval/templates/reshaped-storybook/package.json
- package.json
- agent-eval/templates/monorepo/package.json
- pnpm-workspace.yaml
- eval/package.json
- agent-eval/package.json
Generated eval projects were still referencing @vercel/agent-eval 1.2.0 while the workspace and patch migrated to 1.4.0. Co-authored-by: Cursor <cursoragent@cursor.com>
Ensure NO_COLOR cannot be overridden by caller env, and document VERCEL_OIDC_TOKEN alongside the other classifier credential options. Co-authored-by: Cursor <cursoragent@cursor.com>
|
I think so, i could do a quick check. My first time contributing on the repo so i might miss something im not familiar with tho |
|
I think you may want to hold off spending any more time on this repo @dannyhw |
2 participants
What changed
mainchanges and preserve the follow-up template pin and CodeRabbit review fixes already pushed to this branchbrace-expansion,fast-uri,hono, and@hono/node-serverreleasesmain'sNO_COLORbehavior to it@storybook/mcppatch changesetWhy
Dependabot and
pnpm auditreported vulnerable direct and transitive dependencies across the repository's independent lockfiles. This updates owning packages wherever releases are available and uses compatible lockfile bumps for patched transitive releases instead of forcing versions through overrides.Eight of the repository's nine independent lockfiles now audit clean, including the root, internal Storybook, eval, self-host example, and every published package graph.
Impact
There are no application behavior changes intended. The notable dependency upgrades are covered by the repository's full build, typecheck, lint, package, Storybook, and test suites. The self-host MCP endpoint and evaluation tooling also received direct smoke validation.
Validation
pnpm run formatpnpm run check— 14/14 tasks, 54 test files, 757 testspnpm auditacross all nine independent lockfilesNot resolved
agent-eval/pnpm-lock.yamlretains 35 findings: 6 low, 16 moderate, 12 high, and 1 critical. They remain visible rather than being masked with overrides and are isolated from the published MCP package graphs.undici,tar,minimatch,ajv,smol-toml,path-to-regexp,js-yaml, and@tootallnate/once). The current Vercel CLI release metadata still pins the affected dependency lines, so resolving them needs upstream Vercel package updates.@vercel/agent-eval1.4.0 and its AI SDK/docker dependencies, plus one low-severityesbuildfinding selected through Vite's optionaltsxpeer. There is no newer agent-eval release, and resolving the Vite path without steering the transitive version would require a broader Vite 8 upgrade.Summary by CodeRabbit