build(deps): update devframe to 1.3.1 and drop the last patches

apps/docs/src/content/agents/mcp-server.md

@@ -257,7 +257,7 @@ The prompts follow the same config as the tools. A prompt is left out when a too
 
 The argument is your own text. The server puts it on one line, cuts it at 200 characters and masks JWTs, bearer tokens and secret values in it, the same way it masks tool answers.
 
-The stdio server offers no prompts. The prompts need a devframe patch that devframe 1.3.0 does not ship, so an installed package offers none until devframe ships it.
+The stdio server offers no prompts. The prompts are part of devframe since 1.3.1.
 
 ### Resource templates
 

apps/docs/src/content/contributing/development.md

@@ -41,17 +41,18 @@ pnpm install
 | `pre-commit` | Formats the staged files with Prettier and stages the result. It skips a file that also has unstaged changes, so hunks you left out with `git add -p` stay out of the commit.                                         |
 | `commit-msg` | Checks the message against the [commit message guidelines](https://github.com/pangular-inspector/devtools/blob/main/docs/contributing/commit-message-guidelines.md). It prints a warning and never blocks the commit. |
 
-### Patched dependencies
+### Devframe versions
 
-`patches/` holds `pnpm patch` changes to the built files of `devframe`, `@devframes/agentic` and `@devframes/hub` 1.3.0, listed under `patchedDependencies` in `pnpm-workspace.yaml`. They add what devframe doesn't ship:
+Some MCP route options that `pangularMcp()` in `packages/devtools/src/agent-mcp.ts` sets need a minimum devframe version. The package depends on devframe 1.3.1, which has them all.
 
-| Patch     | What it adds                                                                                                                                                                                                                                                                            | Used by                                                                                     |
-| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
-| `prompts` | An MCP route option with prompt templates. `@devframes/agentic` declares the `prompts` capability and answers `prompts/list` and `prompts/get` (invalid params for an unknown prompt or a missing required argument). Patched in `devframe`, `@devframes/hub` and `@devframes/agentic`. | `pangularMcpPrompts()` in `packages/devtools/src/agent-prompts.ts`, through `pangularMcp()` |
+| Route option                                 | Used for                                                                                                                 | Devframe |
+| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | -------- |
+| `exposeSharedState`                          | Hiding the shared-state keys of an inspector with `agent.tools.<name>: false`                                            | 1.2.4    |
+| `instructions`                               | The server instructions                                                                                                  | 1.2.6    |
+| `resourceTemplates` and `onResourcesChanged` | The per-page resource templates and their `list_changed` notifications (`packages/devtools/src/agent-page-resources.ts`) | 1.3.0    |
+| `prompts`                                    | The workflow prompts (`packages/devtools/src/agent-prompts.ts`)                                                          | 1.3.1    |
 
-Some route options need no patch. The `exposeSharedState` filter, which hides the shared-state keys of an inspector with `agent.tools.<name>: false`, is part of devframe since 1.2.4. The server `instructions` and `withMcpContent`, which `screenshot-component` uses to send its image as its own MCP block, are part of devframe since 1.2.6. The `resourceTemplates` and `onResourcesChanged` route options, which `pangularMcpResourceTemplates()` and `pangularMcpPagesChanged()` in `packages/devtools/src/agent-page-resources.ts` use, are part of devframe since 1.3.0.
-
-The patches apply only inside this repository. An app that installs the published package gets no prompts until devframe ships them. `pnpm e2e:install` checks that the installed package lists resource templates over MCP. Each patch names an exact version and file names with build hashes, so a devframe upgrade needs the patches redone with `pnpm patch`, or removed once devframe has the feature.
+`withMcpContent`, which `screenshot-component` uses to send its image as its own MCP block, is part of devframe since 1.2.6. `pnpm e2e:install` checks that the installed package lists resource templates and prompts over MCP.
 
 ## Project structure
 

examples/angular-native/package.json

@@ -20,7 +20,7 @@
     "@ng-native/platform": "0.2.0",
     "@ngrx/signals": "^22.0.1",
     "@pangular-inspector/devtools": "file:pangular-inspector-devtools.tgz",
-    "devframe": "^1.3.0",
+    "devframe": "^1.3.1",
     "expo": "~57.0.26",
     "react": "19.2.3",
     "react-native": "0.86.3",

package.json

@@ -60,7 +60,7 @@
     "@angular/ssr": "^22.1.8",
     "@ngrx/signals": "^22.0.1",
     "@pangular-inspector/devtools": "workspace:*",
-    "devframe": "^1.3.0",
+    "devframe": "^1.3.1",
     "express": "^5.1.0",
     "rxjs": "~7.8.0",
     "tslib": "^2.3.0",
@@ -74,8 +74,8 @@
     "@angular/cli": "^22.1.8",
     "@angular/compiler-cli": "^22.1.0",
     "@axe-core/playwright": "^4.13.0",
-    "@devframes/agentic": "^1.3.0",
-    "@devframes/vite": "^1.3.0",
+    "@devframes/agentic": "^1.3.1",
+    "@devframes/vite": "^1.3.1",
     "@ngrx/store": "^22.0.1",
     "@ngrx/store-devtools": "^22.0.1",
     "@nx/angular": "23.2.1",

packages/devtools/CHANGELOG.md

@@ -31,7 +31,6 @@ These changes can break a 0.0.7 setup without an error.
 - **Analog on pnpm needs one setting.** `@analogjs/vite-plugin-nitro` imports `h3` without declaring it, so under pnpm it can resolve to the h3 2 that this package brings in, and `vite build` fails with "does not provide an export named 'createEvent'". Declare `h3@^1` for the plugin with pnpm `packageExtensions`, as the Analog guide shows.
 - **Agent tools, arguments and resource templates are renamed, and old names are refused.** Update prompts, scripts and client allowlists. See **Agent tools renamed** below.
 - **Most entry points export less.** See **Removed exports** below.
-- **MCP prompts need a devframe release after 1.3.0.** The package depends on devframe 1.3.0, which serves the per-page resource templates and their `list_changed` notifications. With devframe 1.3.0 from npm, the HTTP endpoint sends no prompts. The workspace runs a patched devframe, so this only affects installed packages.
 
 ### Agent tools renamed
 
@@ -161,7 +160,7 @@ What remains: `/config` exports `DEFAULT_POPUP_HOTKEY`, `PANGULAR_ACTIONS`, `PAN
 - Tool titles, inspector tags and safety tiers (`action` and `destructive`).
 - Every answer names the page it read, and one rule picks the default page for every tool.
 - Per-page resource templates and `list_changed` notifications (#417).
-- Five MCP prompts for common workflows: `inspect-page`, `debug-error`, `fix-form`, `performance-pass` and `verify-fix` (#416). Server instructions describe the tiers and the tools. Both need the patched devframe (see **Upgrading from 0.0.7**).
+- Five MCP prompts for common workflows: `inspect-page`, `debug-error`, `fix-form`, `performance-pass` and `verify-fix` (#416). Server instructions describe the tiers and the tools.
 - Agent skills shipped in the package, installed with `pangular skills install`.
 - Read-only tools for browser agents through WebMCP, off by default (`agent.browserTools`).
 - `pangular mcp --print-config` prints the client config for Claude Code, Cursor and VS Code.

packages/devtools/package.json

@@ -160,17 +160,17 @@
     "nativescript"
   ],
   "dependencies": {
-    "@devframes/agentic": "^1.3.0",
-    "@devframes/hub": "^1.3.0",
-    "@devframes/hub-ui": "^1.3.0",
-    "@devframes/plugin-messages": "^1.3.0",
-    "@devframes/plugin-messages--assets": "^1.3.0",
-    "@devframes/plugin-terminals": "^1.3.0",
-    "@devframes/plugin-terminals--assets": "^1.3.0",
+    "@devframes/agentic": "^1.3.1",
+    "@devframes/hub": "^1.3.1",
+    "@devframes/hub-ui": "^1.3.1",
+    "@devframes/plugin-messages": "^1.3.1",
+    "@devframes/plugin-messages--assets": "^1.3.1",
+    "@devframes/plugin-terminals": "^1.3.1",
+    "@devframes/plugin-terminals--assets": "^1.3.1",
     "@valibot/to-json-schema": "^1.8.0",
     "axe-core": "^4.13.0",
     "cac": "^7.1.0",
-    "devframe": "^1.3.0",
+    "devframe": "^1.3.1",
     "valibot": "^1.5.0"
   },
   "peerDependencies": {

packages/devtools/src/__tests__/agent-mcp.test.ts

@@ -1,4 +1,4 @@
-import { readFileSync, readdirSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { createDevServer } from 'devframe/adapters/dev';
 import { afterEach, describe, expect, it, vi } from 'vitest';
@@ -252,23 +252,12 @@ describe('pangular dev MCP route', () => {
 describe('shared-state filter source', () => {
   const repo = fileURLToPath(new URL('../../../../', import.meta.url));
 
-  // The filter must come from published devframe, not from `patches/`, which
-  // apply only inside this repository: an app that installs the package would
-  // otherwise get every key again (issue #238).
-  it('needs no local patch', () => {
-    for (const file of readdirSync(`${repo}patches`)) {
-      const lines = readFileSync(`${repo}patches/${file}`, 'utf8').split('\n');
-      // A line a hunk only touches (to add a comma) is removed and added again.
-      const removed = new Set(
-        lines
-          .filter((line) => /^-(?!--)/.test(line))
-          .map((line) => line.slice(1).replace(/,$/, '')),
-      );
-      const added = lines
-        .filter((line) => /^\+(?!\+\+)/.test(line))
-        .filter((line) => !removed.has(line.slice(1).replace(/,$/, '')));
-      expect(added.join('\n'), file).not.toContain('exposeSharedState');
-    }
+  // The route options must come from published devframe, not from pnpm
+  // patches, which apply only inside this repository: an app that installs
+  // the package would otherwise miss them (issues #238 and #428).
+  it('needs no local patch of devframe', () => {
+    const workspace = readFileSync(`${repo}pnpm-workspace.yaml`, 'utf8');
+    expect(workspace).not.toMatch(/^\s*'?(?:devframe|@devframes\/[\w-]+)@[^:]*'?:\s*patches\//m);
   });
 
   it('requires a devframe release that has the route option', () => {

packages/devtools/src/agent-mcp.ts

@@ -37,9 +37,8 @@ export function pangularMcpInstructions(config: ResolvedPangularConfig): string
  * dependency, and Pangular always registers agent tools.
  *
  * `exposeSharedState` (1.2.4 and later), `instructions` (1.2.6 and later),
- * `resourceTemplates` and `onResourcesChanged` (1.3.0 and later) are devframe
- * route options, so they also hold for the published package. `prompts` still
- * comes from the patches in `patches/`; without them devframe ignores it.
+ * `resourceTemplates` and `onResourcesChanged` (1.3.0 and later) and `prompts`
+ * (1.3.1 and later) are devframe route options.
  */
 export function pangularMcp(
   setting: McpSetting | undefined,

packages/devtools/src/agent-prompts.ts

@@ -3,7 +3,7 @@ import { agentToolOffered, type ResolvedPangularConfig } from './config.ts';
 import { redactText } from './serialize.ts';
 import { clip } from './text.ts';
 
-/** One MCP prompt, as the patched `@devframes/agentic` server takes it. */
+/** One MCP prompt, as `@devframes/agentic` takes it. */
 export type PangularMcpPrompt = NonNullable<McpRouteOptions['prompts']>[number];
 
 /** Whether a built-in agent tool is offered, by its name without `pangular:`. */