gebhardtr · Sep 30, 2026 · Sep 30, 2026 · Oct 1, 2026
@@ -1,9 +1,10 @@
 *
-!package.json
-!package-lock.json
 !buf.gen.yaml
 !proto/
 !proto/runner.proto
+!runner/
+!runner/package.json
+!runner/package-lock.json
 !src/
 !src/grpc.ts
 !src/protocol.ts

@@ -1,9 +1,13 @@
 # Changelog
 
-## Unreleased
+## 0.2.0
 
 ### Fixed
 
+- Select OCI session-token authentication using SDK profile inheritance and
+  keep profile diagnostics off MCP stdout.
+- Keep `isolated-vm` out of host runtime dependencies and install the runner's
+  dependencies from a separate manifest, pruning code generators from the image.
 - Preserve OCI status codes, service codes, operation details, and request IDs in
   uncaught `run_javascript` errors so callers can assess failures and retry decisions.
 

@@ -10,33 +10,21 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends g++ make python3 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY package.json package-lock.json ./
-RUN npm ci --include=dev \
-    && npm cache clean --force
+COPY runner/package.json runner/package-lock.json ./
+RUN npm ci --include=dev
 
 COPY buf.gen.yaml ./
 COPY proto/ ./proto/
-RUN npx --no-install buf generate
+RUN npx --no-install buf generate \
+    && npm prune --omit=dev \
+    && npm cache clean --force
 
 FROM node:26-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341
 
 WORKDIR /app
 
 COPY --from=dependencies --chown=65532:65532 \
-    /app/node_modules/isolated-vm \
-    ./node_modules/isolated-vm
-COPY --from=dependencies --chown=65532:65532 \
-    /app/node_modules/node-gyp-build \
-    ./node_modules/node-gyp-build
-COPY --from=dependencies --chown=65532:65532 \
-    /app/node_modules/@grpc/grpc-js \
-    ./node_modules/@grpc/grpc-js
-COPY --from=dependencies --chown=65532:65532 \
-    /app/node_modules/@js-sdsl/ordered-map \
-    ./node_modules/@js-sdsl/ordered-map
-COPY --from=dependencies --chown=65532:65532 \
-    /app/node_modules/@bufbuild/protobuf \
-    ./node_modules/@bufbuild/protobuf
+    /app/node_modules ./node_modules
 COPY --from=dependencies --chown=65532:65532 /app/src/generated/runner.ts ./src/generated/runner.ts
 COPY --chown=65532:65532 \
     src/grpc.ts \

@@ -13,8 +13,10 @@ access, environment variables, or a network API.
 
 ## Quick start
 
-Requires Node.js 26 or newer, rootless Podman, and an OCI SDK configuration. A
-native build toolchain is also needed when installing `isolated-vm` on the host.
+Requires Node.js 26 or newer, rootless Podman, and an OCI SDK configuration.
+Production host installs omit `isolated-vm`; the container build installs it for
+the runner. Building and testing from source also installs the addon and may
+require a native build toolchain.
 
 From this directory:
 
@@ -155,6 +157,23 @@ conservative mounts and network policy.
 
 ## Development
 
+Run `npm ci --include=dev` to install test and development dependencies, including
+`isolated-vm`. This requires a native build toolchain when no prebuilt addon is
+available. The container build supplies its own build toolchain.
+
+The root manifest includes host runtime dependencies and development dependencies
+for the combined host and runner tests. `runner/package.json` and its lockfile
+define the container's runtime dependencies and development dependencies for
+protobuf generation. The Containerfile installs both, generates the bindings,
+and prunes development dependencies before copying modules into the final image.
+Both runner build files are included in the published package so the image can
+also be built from the package contents.
+
+When updating dependencies shared by the root and runner manifests, update both
+declarations and regenerate both lockfiles. Keep the resolved versions aligned
+so local tests exercise the same addon, gRPC libraries, and generators as the
+container.
+
 ```bash
 moon run oci-javascript-mcp-server:compile # generate bindings and compile the npm entry point
 moon run oci-javascript-mcp-server:test   # unit and MCP stdio integration tests; 90% line minimum

@@ -31,6 +31,7 @@ tasks:
       - 'test/**/*'
       - 'package.json'
       - 'package-lock.json'
+      - 'runner/*.json'
 
   check:
     description: 'Checks TypeScript types'
@@ -61,6 +62,7 @@ tasks:
       - '.dockerignore'
       - 'package.json'
       - 'package-lock.json'
+      - 'runner/*.json'
     outputs:
       - 'dist/*.tgz'
     options:

@@ -1,6 +1,6 @@
 {
   "name": "oci-javascript-mcp-server",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Podman-isolated OCI JavaScript code execution MCP server",
   "type": "module",
   "keywords": [
@@ -25,6 +25,8 @@
     "src/generated/runner.ts",
     "proto/",
     "buf.gen.yaml",
+    "runner/package.json",
+    "runner/package-lock.json",
     ".dockerignore",
     "Containerfile",
     "CHANGELOG.md",
@@ -41,7 +43,6 @@
     "@bufbuild/protobuf": "2.15.0",
     "@grpc/grpc-js": "^1.14.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "isolated-vm": "^7.0.0",
     "oci-common": "^2.132.0",
     "oci-sdk": "^2.132.0",
     "selfsigned": "^3.0.1",
@@ -54,6 +55,7 @@
     "@bufbuild/buf": "1.73.0",
     "@types/node": "^25.9.1",
     "c8": "^12.0.0",
+    "isolated-vm": "^7.0.0",
     "ts-proto": "2.12.4",
     "typescript": "^5.9.3"
   },