build-npx-tarball.cjs skips prepare-pack — dist-tarball ships workspace:* and cannot be npm install'ed

[debugmcpdev]

scripts/build-npx-tarball.cjs produces dist-tarball/mcp-debugger-latest.tgz by calling npm pack directly, without the prepare-pack.js prepare / restore pair. It therefore captures packages/mcp-debugger/package.json unrewritten, so the tarball ships pnpm-only workspace:* specifiers and cannot be installed by npm.

Repro

$ node scripts/build-npx-tarball.cjs
$ mkdir /tmp/iso && cd /tmp/iso && npm init -y
$ npm install /path/to/repo/dist-tarball/mcp-debugger-latest.tgz
npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "workspace:": workspace:*

The manifest inside the tarball:

"optionalDependencies": {
  "@debugmcp/codelldb-darwin-arm64": "workspace:*",
  "@debugmcp/codelldb-darwin-x64":   "workspace:*",
  "@debugmcp/codelldb-linux-arm64":  "workspace:*",
  "@debugmcp/codelldb-linux-x64":    "workspace:*",
  "@debugmcp/codelldb-win32-x64":    "workspace:*"
}

The two pack paths disagree

Path	Output	optionalDependencies
packages/mcp-debugger/scripts/bundle-cli.js (calls prepare-pack.js)	packages/mcp-debugger/package/*.tgz	1.11.8 ✅
scripts/build-npx-tarball.cjs (no prepare-pack)	dist-tarball/mcp-debugger-latest.tgz	workspace:* ❌

prepare-pack.js itself is fine — it already covers optionalDependencies and lists all five codelldb-* workspaces. It just isn't invoked on this path. Note bundle-cli.js runs prepare-pack during npm run build and then restores the original manifest, so by the time build-npx-tarball.cjs:43 runs npm pack, package.json is back to workspace:*.

Why it matters

The release path is unaffected — releases pack via bundle-cli.js. Two consequences that do bite:

1. dist-tarball/mcp-debugger-latest.tgz is what the documented npx dev-proxy config consumes, and it can't be npm installed outside the repo.
2. It makes the npx test arm not packaging-faithful. build-npx-tarball.cjs extracts to dist-tarball/extracted/ inside the repo, so CodeLLDB resolution finds the repo's own vendor tree (resolution order is vendor → CODELLDB_PATH → platform package). doctor --json consequently reports codelldbSource: "vendored" on npx where the packaging assertion expects platform-package — so the sweep's sharpest npx packaging check silently can't fail.

(Independently: @debugmcp/codelldb-win32-x64 is still E404 on the registry, so platform-package is unreachable until those publish — but that's the known v0.25.0 hold, not this bug.)

Fix

Wrap the pack in scripts/build-npx-tarball.cjs (~line 43):

run('node', ['scripts/prepare-pack.js', 'prepare']);
try {
  run('npm', ['pack', '--pack-destination', TARBALL_DIR], { cwd: PKG_DIR });
} finally {
  run('node', ['scripts/prepare-pack.js', 'restore']);
}

Worth a regression test that greps the packed manifest for workspace: and fails — it's a one-line assertion that would have caught this and would also guard the release path.

Found during a full /testdebugger sweep (9 servers × 3 backends).