#1796 — mcp-server stale-deps drift 🔧

Why plugins/ork/mcp-server/server.mjs drifted from a fresh CI build, and the one-line root cause the fix removes.

The root cause (not what the issue first guessed)

The issue proposed 3 workarounds (auto-commit bot / exclude-from-drift / determinism hacks). The actual root cause is a single guard in build-plugins.sh:

// BEFORE — only installs when node_modules is ABSENT
if [[ ! -d "node_modules" ]]; then npm ci --ignore-scripts; fi
node esbuild.config.mjs

A Dependabot bump changes src/mcp-server/package-lock.json, but on a warm checkout node_modules already exists, so npm ci is skipped — esbuild bundles the old deps. The committed bundle then drifts from a fresh CI build (CI always installs into a clean tree) → the git diff --quiet plugins/ gate fails on the next rebuild-forcing PR.

Confirmed dormant on current main (a fresh-deps rebuild is byte-identical to the committed bundle today) — but the guard re-arms on the next bump. This PR is prevention.

The fix — gate on the lockfile, not on node_modules presence

lock_hash="$(sha256 package-lock.json)"
stamp="node_modules/.ork-lockhash"
if [[ ! -d node_modules ]] || [[ "$(cat $stamp)" != "$lock_hash" ]]; then
    npm ci --ignore-scripts        # errors now SURFACE (set -euo pipefail)
    printf '%s\n' "$lock_hash" > "$stamp"
fi
node esbuild.config.mjs

Try it — does the build reinstall?

node_modules/ present (warm checkout) lockfile bumped since last install (stamp stale)

OLD guard (node_modules-only):

—

NEW guard (lockfile-hash):

—

Truth table

node_modules	lockfile bumped	OLD	NEW (fixed)	bundle correct?

The one row OLD gets wrong — warm node_modules + bumped lockfile — is the #1796 drift. NEW reinstalls there.