chore: reconcile package metadata and declare only un-bundlable runner deps

[jithin23-kv]

What

Pre-release package-metadata hygiene across the workspace, in two parts.

1. Metadata reconciliation

• Node engines reconciled to >=20 (root was >=18.0.0 while all runners already require >=20; CI runs Node 22). Added an explicit engines field to core.
• Removed the unused consola dependency from core and mcp — it's only imported by the CLI (verified via grep).
• Browser extension: bumped manifest.json version 0.0.2 → 0.9.0 to match the package version.

2. Runner dependencies: declare only what can't be bundled

The cli, mcp, and sdk runners each ship a self-contained bundle (esbuild/tsup with only node:* external), so every third-party library is inlined into dist/. Declaring those inlined libraries as runtime dependencies made consumers npm install packages they never load at runtime.

Rule applied (matches how bundled packages like Prettier, @vercel/ncc, and Wrangler declare deps): keep in dependencies only what the bundle genuinely cannot inline and resolves from node_modules at runtime; move everything inlined to devDependencies.

Verified against the actual build output — the only un-inlinable runtime references are:

• ajv / ajv-formats — the MCP SDK's validators require() these by path at runtime; no bundler can inline them. Provided transitively by @modelcontextprotocol/sdk.
• @anthropic-ai/claude-agent-sdk (cli only) — spawns a native platform binary shipped via its optionalDependencies (8 platform variants); resolved from node_modules at runtime.
• supports-color (cli) — required inside a try {} (the debug library's optional color probe), so its absence is handled gracefully — left undeclared.

Package	dependencies before → after	Kept because
sdk	@modelcontextprotocol/sdk → unchanged	already correct
mcp	10 libs → 1 (@modelcontextprotocol/sdk)	brings ajv/ajv-formats
cli	17 libs → 2 (@anthropic-ai/claude-agent-sdk, @modelcontextprotocol/sdk)	native binary + ajv

Everything else (@ai-sdk/*, ai, @anthropic-ai/sdk, express, commander, @inquirer/prompts, dotenv, yaml, zod) moved to devDependencies (or dropped where already transitive via core).

This supersedes the earlier revision of this PR, which added @ai-sdk/azure and @ai-sdk/deepseek to mcp dependencies — under the bundle-hygiene rule those don't belong there at all.

Why

Pre-release metadata consistency: an accurate engine floor, no phantom dependencies, a coherent extension version, and published packages that install only the code they actually load at runtime instead of dragging in the entire (already-bundled) dependency tree.

Verified

• npm run typecheck, npm run lint, npm run format:check pass (full pre-commit hook incl. gitleaks, no --no-verify).
• Builds pass: core, mcp, sdk, and the cli esbuild bundle.
• Runtime resolution confirmed: ajv/ajv-formats reach all three runners via the MCP SDK; @anthropic-ai/claude-agent-sdk + its linux-x64 native binary resolve for cli.
• sdk bundle imports clean in Node (no MODULE_NOT_FOUND); mcp server binary boots without crashing.
• Lockfile synced via npm install --package-lock-only (no package downloads).

Note for reviewers

The cli change preserves @anthropic-ai/claude-agent-sdk exactly as it ships today (still a runtime dependency, still bundled the same way), so there is no behavioral change to opfor hunt. A clean-install opfor hunt smoke test is nonetheless the recommended final gate before release, since that's the path that spawns the native binary.

[coderabbitai]

Warning

Review limit reached

@jithin23-kv, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 498938ad-c4a6-4668-980b-821db8e3d6e7

📥 Commits

Reviewing files that changed from the base of the PR and between 9afbe34 and 57c4306.

📒 Files selected for processing (1)

• release-please-config.json

Walkthrough

This PR updates Node.js engine requirements to >=20 across package.json files, removes the consola dependency from core, reclassifies runtime dependencies into devDependencies in the CLI and MCP runner packages, and bumps the extension manifest version to 0.9.0.

Changes

Engine and Dependency Updates

Layer / File(s)	Summary
Node engine requirement bump package.json, core/package.json	engines.node is raised to >=20 in the workspace root and core package manifests.
Core dependency cleanup core/package.json	The consola dependency entry is removed from dependencies.
CLI dependency reclassification runners/cli/package.json	dependencies is reduced to @anthropic-ai/claude-agent-sdk and @modelcontextprotocol/sdk; the remaining packages (@ai-sdk/*, @anthropic-ai/sdk, commander, consola, express, yaml, zod, etc.) are moved into devDependencies.
MCP dependency reclassification runners/mcp/package.json	dependencies is reduced to @modelcontextprotocol/sdk, removing @ai-sdk/*, ai, consola, and yaml, while dotenv and zod are relocated to devDependencies.
Extension manifest version bump runners/extension/manifest.json	The version field is updated from 0.0.2 to 0.9.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• KeyValueSoftwareSystems/agent-opfor#134: Both PRs adjust dependency declarations around @modelcontextprotocol/sdk for MCP/bundled runners.

Suggested reviewers: achuvyas-kv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main metadata and dependency-scope changes in the PR.
Description check	✅ Passed	The description covers the problem, solution, changes, and verification, but it uses custom headings instead of the template's exact sections.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/package-metadata

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}