[BestNathan]

Problem

build-mcp-images filtered on crates/vol-mcp-servers/** only — but vol-mcp-servers depends on 14 other workspace crates:

# crates/vol-mcp-servers/Cargo.toml:37
vol-llm-sandbox = { path = "../vol-llm-sandbox", features = ["ssh"] }

build-vol-agent-server uses crates/**, so it catches dependency changes. build-mcp-images did not. A fix in a shared crate therefore shipped to agent-server and silently did not rebuild the MCP images, leaving them linked against old code until someone happened to touch crates/vol-mcp-servers/.

This just happened

PR #70's SandboxManager::default() fix:

Deployment	Image
agent-server ×4	cp-5fd87dd / dp-5fd87dd	✅ rebuilt
cli-tools-mcp	6c07707	❌ never triggered

build-mcp-images did not run for 5fd87dd3 at all.

Harmless in that instance — default() is only called by vol-agent-server's SandboxHandler; cli-tools-mcp uses preload() / acquire_by_name() / build_inline(). But the same gap would silently drop a change to preload(), which cli-tools-mcp calls at startup. That's a known pending follow-up, so this needed fixing first.

(The reason #69 looked fine is that it also modified crates/vol-mcp-servers/, coincidentally matching the filter.)

Fix

Listed the full local dependency closure — 15 crates — rather than widening to crates/**:

md-frontmatter          vol-llm-observability
vol-llm-agent           vol-llm-provider
vol-llm-cli-tool        vol-llm-sandbox
vol-llm-context         vol-llm-skill
vol-llm-core            vol-llm-tool
vol-llm-mcp             vol-llm-tracing
vol-llm-memory          vol-mcp-servers
                        vol-session

This keeps 22 crates excluded — vol-agent-server, vol-llm-runtime, vol-llm-tui, vol-llm-ui, ppt-agent, vol-llm-wiki, vol-llm-yaml-agent, vol-llm-agents, vol-llm-fs, vol-llm-task, vol-llm-agent-protocol, vol-llm-agent-tool, and all nine vol-llm-tools-builtin/* subcrates — so MCP images do not rebuild on unrelated work.

The list is computed from cargo metadata, not hand-written, and the regenerating command is recorded in a comment directly above it.

Verification

• YAML parses; 23 path entries total
• The documented regenerate command was run, and its output diffed byte-identical against the committed list
• All 15 crate directories confirmed to exist on disk
• Audited every other workflow for the same bug: only build-vol-agent-server filters on crates, and it uses crates/**

Why build-vol-agent-server is left alone

Its closure is 30 of 37 local crates — only the TUI, web UI, ppt-agent, wiki, yaml-agent, agents and mcp-servers fall outside. Enumerating that would add maintenance drift for almost no saved builds.

The asymmetry that matters: agent-server's filter errs toward over-building, which is safe. The MCP filter erred toward under-building, which ships stale binaries.

Note

Path-filter changes only take effect for pushes after this merges, so this PR's own CI will not exercise the new filter. The first real check is the next change to a dependency crate — at which point build-mcp-images should appear in the run list for that SHA.

🤖 Generated with Claude Code