src/server-version.ts (1)

16-19: ⚡ Quick win

Harden version validation to reject whitespace-only values.

Line 16 accepts " " as valid because it only checks .length. Trimming before validation avoids emitting effectively empty server metadata.

Proposed diff

 export function parsePackageJsonVersion(raw: string, pathForErrors = 'package.json'): string {
   const parsed = JSON.parse(raw) as { version?: unknown };
-  if (typeof parsed.version !== 'string' || parsed.version.length === 0) {
+  if (typeof parsed.version !== 'string' || parsed.version.trim().length === 0) {
     throw new Error(`Invalid or missing "version" in ${pathForErrors}`);
   }
-  return parsed.version;
+  return parsed.version.trim();
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/server-version.ts` around lines 16 - 19, The current validation in
server-version.ts checks only parsed.version.length, which accepts
whitespace-only strings; update the validation in the code that reads
parsed.version to trim the value and reject empty/whitespace-only strings (e.g.,
check typeof parsed.version === 'string' and parsed.version.trim().length > 0),
and return the trimmed version instead of the original so downstream consumers
get a normalized version; reference parsed.version and pathForErrors in your
change.

src/server-version.test.ts (1)

28-35: ⚡ Quick win

Add parser negative-path tests to lock validation behavior.

Current tests validate happy paths only. Add cases for malformed JSON, missing version, and empty/whitespace version so parser guarantees are regression-safe.

Proposed diff

 describe('parsePackageJsonVersion', () => {
   it('extracts version from several package.json shapes', () => {
     expect(parsePackageJsonVersion(PACKAGE_JSON_FIXTURES[0])).toBe('0.1.0');
     expect(parsePackageJsonVersion(PACKAGE_JSON_FIXTURES[1])).toBe('1.0.0');
     expect(parsePackageJsonVersion(PACKAGE_JSON_FIXTURES[2])).toBe('0.1.6');
     expect(parsePackageJsonVersion(PACKAGE_JSON_FIXTURES[3])).toBe('2.3.4');
   });
+
+  it('throws on malformed or invalid version fields', () => {
+    expect(() => parsePackageJsonVersion('{')).toThrow();
+    expect(() => parsePackageJsonVersion(JSON.stringify({ name: 'x' }))).toThrow();
+    expect(() => parsePackageJsonVersion(JSON.stringify({ version: '' }))).toThrow();
+    expect(() => parsePackageJsonVersion(JSON.stringify({ version: '   ' }))).toThrow();
+  });
 });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/server-version.test.ts` around lines 28 - 35, Add negative-path unit
tests for parsePackageJsonVersion to cover malformed JSON, missing version
fields, and empty/whitespace version strings so behavior is regression-safe:
update the test suite in src/server-version.test.ts (the
describe('parsePackageJsonVersion') block) to include new it cases that call
parsePackageJsonVersion with fixtures representing (1) invalid JSON input
(should throw or return the defined error/undefined behavior your parser uses),
(2) an object missing the version property (should return undefined or throw per
current contract), and (3) version set to '' or '   ' (should be treated as
invalid); reuse PACKAGE_JSON_FIXTURES or add new fixture entries and assert the
expected error/return values consistent with parsePackageJsonVersion's specified
behavior.

src/server-version.test.ts (1)

29-59: ⚡ Quick win

Add explicit tests for malformed JSON and missing version.

Current coverage is good, but Line 20 (missing version) and Line 34 (JSON parse failure) in the production parser are still untested. Adding those two cases will lock in fallback behavior.

Suggested test additions

 describe('parsePackageJsonVersion', () => {
+  it('returns default when version field is missing', () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    try {
+      expect(parsePackageJsonVersion(JSON.stringify({ name: 'pkg' }))).toBe('0.0.1');
+      expect(logSpy).toHaveBeenCalled();
+    } finally {
+      logSpy.mockRestore();
+    }
+  });
+
+  it('returns default when package.json is malformed JSON', () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    try {
+      expect(parsePackageJsonVersion('{')).toBe('0.0.1');
+      expect(logSpy).toHaveBeenCalled();
+    } finally {
+      logSpy.mockRestore();
+    }
+  });
+
   it('extracts version from several package.json shapes', () => {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/server-version.test.ts` around lines 29 - 59, Add two tests for
parsePackageJsonVersion: one that passes malformed JSON (e.g. a non-JSON string)
and asserts it returns the default '0.0.1' and that console.log was called, and
another that passes JSON with the version property missing (e.g.
JSON.stringify({})) and asserts the same default return and a console.log call;
use vi.spyOn(console, 'log').mockImplementation(() => {}) around each assertion
and restore the spy in finally blocks to mirror the existing tests.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes