MCP source tool finds no @webjsdev src under Bun zero-install (no node_modules)

[vivek7405]

Problem

The MCP source tool (packages/mcp/src/mcp-source.js) reads the framework's own no-build source from node_modules/@webjsdev/<pkg>/src. Its resolveFrameworkRoots(cwd, fsDeps) locates each package by walking the require.resolve.paths node_modules directories on disk for @webjsdev/<pkg>/package.json. That assumes a real node_modules install.

Under Bun ZERO-INSTALL (#675: bun run dev/start via the webjs-bun.mjs bootstrap, no node_modules), there is NO local node_modules. Verified in a Bun 1.3.14/1.3.11 sprite: an auto-install run creates no node_modules; the dependency (and @webjsdev/*) resolves from Bun's GLOBAL cache (~/.bun/install/cache/<name>@<version>@@@N/), which holds the full package including src/. So resolveFrameworkRoots finds nothing and the source tool returns an empty package list, even though the framework source IS on disk (in the cache). The AGENTS.md description ("reads the framework's OWN no-build source from node_modules/@webjsdev/*/src") is therefore inaccurate for a zero-install Bun app.

Design / approach

Make resolveFrameworkRoots locate each @webjsdev/* package via the RESOLVER rather than a node_modules-dir walk, so it works whether the package lives in node_modules (Node, or Bun after bun install) OR Bun's global cache (zero-install):

1. Resolve the package on-disk root via import.meta.resolve('@webjsdev/<pkg>/package.json') (or Bun.resolveSync / require.resolve), then derive the root from that path and read src/ (or lib/ for the cli) there. This is location-agnostic (node_modules vs cache).
2. Keep the existing node_modules-walk as a fallback (it is correct when node_modules exists and avoids a resolver edge case).
3. The cache only holds a package AFTER it has been resolved/fetched at least once; on a brand-new zero-install app the @webjsdev/* cache entries exist as soon as the server has booted (the bootstrap imports core/server), so the MCP, launched in the same app, should find them. Verify this ordering; if the cache can be cold, the tool should say so rather than silently return empty.

If it turns out the cache layout is not reliably readable (opaque/owned by Bun), then update the docs instead: state in AGENTS.md + packages/mcp/AGENTS.md + the MCP description that the source tool requires a materialized node_modules (run bun install), and is unavailable under pure zero-install.

Implementation notes (for the implementing agent)

• Where: packages/mcp/src/mcp-source.js resolveFrameworkRoots() (the node_modules-walk it documents at L41-60). The tool is exercised by packages/mcp/test/*.test.mjs.
• Verify the Bun global cache path via bun pm cache (returns the dir; in the sprite it was /.sprite/languages/bun/install/cache, normally ~/.bun/install/cache). Cache entries are named <name>@<version>@@@<n>/ and <name>/.
• Landmine: the resolver approach must stay traversal-guarded (the tool's security model is "cannot read outside resolved @webjsdev/* roots"); derive the root from the resolved path and keep the existing path-containment guard.
• This is Bun-zero-install-specific; Node and Bun-with-bun install already work. Cross-reference Zero-install dev/start on Bun via native auto-install (carve from #669) #675 (zero-install), feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685 (the pin rewrite), research: can Bun zero-install respect package.json versions (not fetch latest)? #684 (the zero-install research).
• Tests + docs: a packages/mcp/test case that resolves a package root from a cache-style layout (not just node_modules); update AGENTS.md "MCP server" wording + packages/mcp/AGENTS.md so the source-tool description is accurate for zero-install (either "works via the resolver/cache" once fixed, or "needs bun install" if not fixable).

Acceptance criteria

• Under Bun zero-install (no node_modules), the MCP source tool lists + reads @webjsdev/* source (from the resolver/cache), OR the docs accurately state it needs bun install.
• The node_modules path still works (Node + Bun-installed); traversal guard intact.
• A test covers the non-node_modules resolution path.
• AGENTS.md + packages/mcp wording match the actual behavior.