[cliffhall]

Closes #2650

What changed

npm run pack:verify now covers the three things the v2.10.0 release checked on the installed mcpdo by hand:

1. skills/mcpdo/SKILL.md ships. It is added to the step-2b required-files list. Nothing reads it at run time, so before this a files edit that dropped it would have passed the gate.
2. Every bare import in the installed clients/mcpdo/build resolves, using ESM rules. The new scripts/lib/bundle-bare-imports.mjs scans the bundle for bare specifiers and resolves each one with import.meta.resolve from a probe module placed inside the installed package. It matches statements at the start of a line, so from "…" text inside bundle comments is ignored. ESM resolution matters here: @modelcontextprotocol/ext-tasks exports only an import condition, so require.resolve fails on it with ERR_PACKAGE_PATH_NOT_EXPORTED (I confirmed this locally).
3. A tool call goes through the packaged daemon. After connect, the script runs mcpdo @test tools/call echo message:=pack-verify --plain and checks for Echo: pack-verify. If the call fails, the daemon is stopped before the script exits.

The mcpdo daemon dir is now <work>/d instead of <work>/mcpdo-daemon. The socket lives in that directory, and macOS caps a socket path at 104 bytes. $TMPDIR is already long there, so the shorter name keeps the path under the limit.

docs/publishing.md describes the new checks.

Verification

• npm run pack:verify passes: tarball OK: 27 files … skills/mcpdo present, all 18 bare imports in the installed mcpdo bundle ESM-resolve from the consumer install, and the daemon flow connect/list/tools/call/disconnect passes.
• npm run local:gate passes, including the new node --test cases in scripts/lib/bundle-bare-imports.test.mjs. They cover import-only exports, a missing package, from text in comments, and checking that the probe file is cleaned up.

⚠️ v2/main does not typecheck right now (#2676), so this PR's CI will be red until that fix lands. To run both checks above, I applied #2676's one-line fix ([] as joinSnapshot's fallbacks) in my working tree and reverted it before committing. This PR does not include that fix.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The import scanner misclassifies import-like text in comments and strings as dependencies.

1 open finding

• Ignore imports in comments and strings during dependency scanning · New

What changed in this PR

Extends the published-tarball verification to cover the packaged mcpdo surface.

Changes:

• Verifies the shipped skill and all bundled bare imports.
• Adds an end-to-end daemon tool call.
• Documents and tests the new checks.

File	Description
scripts/​pack-and-verify.mjs	Expands packaged mcpdo verification.
scripts/​lib/​bundle-bare-imports.mjs	Adds bare-import scanning and ESM resolution.
scripts/​lib/​bundle-bare-imports.test.mjs	Tests scanning and resolution behavior.
docs/​publishing.md	Documents the expanded release check.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[cliffhall]

Copilot review closed after round 1. Its one finding (the scanner treating import-like text in comments or strings as an import) was declined in its thread: a false positive fails closed (red gate, specifier named, never a false green), the real bundle yields exactly its 18 real specifiers, and a tokenizing scanner is the #2334 trap AGENTS.md records. Nothing was pushed, so per the loop's exit rules this round ends the review.