feat(loader): inject package.json version into manifest via optional BrickSource hook

[samuelds]

Problem

Every brick load via the CLI threw `INVALID_VERSION` at `parseManifest()`. Cause: published `@focus-mcp/brick-*` packages don't carry a `version` field in `mcp-brick.json` — the version lives in their `package.json`. The manifest validator was correctly rejecting them, but the validation was over-strict given the npm publishing reality.

Fix

Add an optional hook `readPackageVersion(name)` to the `BrickSource` interface. When a source implements it, the loader injects the returned value into both raw manifests (disk + module export) before they reach `parseManifest()`.

```ts
export interface BrickSource {
list(): Promise<readonly string[]>;
readManifest(name: string): Promise;
loadModule(name: string): Promise;
// NEW (optional):
readPackageVersion?(name: string): Promise<string | undefined>;
}
```

Helper:

```ts
function injectVersion(raw: unknown, pkgVersion: string | undefined): unknown {
if (pkgVersion === undefined) return raw;
if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return raw;
const obj = raw as Record<string, unknown>;
if (obj['version'] !== undefined) return raw; // preserve existing
return { ...obj, version: pkgVersion };
}
```

Loader change: just two call sites in `loadBricks()` now pass through `injectVersion()`.

Backwards compatibility

The hook is optional. Sources that don't implement it behave exactly as before (the INVALID_VERSION error still surfaces when the manifest legitimately has no version and no fallback is available). Existing manifests with an explicit `version` are never overwritten.

Tests (387/387 pass)

4 new unit tests:

• ✅ injection on missing version when hook returns a string
• ✅ existing `version` is preserved (hook value ignored)
• ✅ INVALID_VERSION when hook is absent AND manifest has no version (existing behaviour)
• ✅ INVALID_VERSION when hook returns `undefined` AND manifest has no version

Pair with CLI

Already shipped in `@focus-mcp/cli@2.4.1` (cli#144, cli#145): `FilesystemBrickSource.readPackageVersion()` resolves `@focus-mcp/brick-/package.json` (with walk-up fallback + symlink containment check).

Once this core PR is published, the bug is fully resolved end-to-end: `focus add ` will no longer throw INVALID_VERSION for any of the `@focus-mcp/brick-*` packages.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the brick loader to optionally source a missing manifest version from the brick package’s package.json, via a new optional BrickSource.readPackageVersion(name) hook. This aligns core’s manifest validation with the publishing shape of @focus-mcp/brick-* packages and prevents spurious INVALID_VERSION failures when loading bricks via the CLI.

Changes:

• Extend BrickSource with optional readPackageVersion(name): Promise<string | undefined>.
• Inject the package version into disk and module manifests (when missing) prior to calling parseManifest().
• Add unit tests covering version injection and fallback behavior, plus a changeset for a minor bump.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
packages/core/src/loader/brick-loader.ts	Adds optional version fallback hook and injects version prior to manifest validation.
packages/core/src/loader/brick-loader.test.ts	Adds tests for version injection and existing fallback behavior.
.changeset/feat-brick-loader-inject-package-version.md	Documents the new loader behavior and publishes a minor version bump.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.