From 30f515520d6812f4327a138b58d114bacaa0558c Mon Sep 17 00:00:00 2001
From: GitHub Action <action@github.com>
Date: Fri, 1 May 2026 16:51:48 -0700
Subject: [PATCH] chore: list workspace members explicitly to prevent stub-dir
 blowup

packages/* glob matches any directory on the filesystem, including
leftover dirs from branch checkouts and half-bootstrapped stubs that
lack pyproject.toml. uv 0.11.7 silently skips them but other tooling
does not. Switch to an explicit member list so the workspace is a
closed set regardless of what exists under packages/.

Also updates DEVELOPER.md new-package checklist to reflect the
three-step registration process.
---
 DEVELOPER.md   | 11 +++++++----
 pyproject.toml | 11 ++++++++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/DEVELOPER.md b/DEVELOPER.md
index 6e6138b..deef361 100644
--- a/DEVELOPER.md
+++ b/DEVELOPER.md
@@ -94,10 +94,13 @@ just build
 
 ### Adding a new package
 
-1. Create a new directory in `packages/`
-2. Initialize the package: `uv init packages/your-package-name`
-3. Update the package's `pyproject.toml` with appropriate metadata
-4. The package will automatically be included in the workspace
+1. Create the package directory in `packages/` and write its `pyproject.toml` before any source files.
+2. Register the package in the root `pyproject.toml`:
+   - Add `"packages/your-package-name"` to `[tool.uv.workspace] members`.
+   - Add `keycardai-your-package-name = { workspace = true }` under `[tool.uv.sources]`.
+3. Run `uv lock` to update the workspace lockfile.
+
+Workspace members are listed explicitly (no `packages/*` glob) so a half-bootstrapped or stray directory under `packages/` cannot accidentally enter the workspace.
 
 ## Package Structure
 
diff --git a/pyproject.toml b/pyproject.toml
index ba75b7b..9034cfe 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -49,12 +49,17 @@ Repository = "https://github.com/keycardai/python-sdk"
 Issues = "https://github.com/keycardai/python-sdk/issues"
 
 [tool.uv.workspace]
+# Listed explicitly so stray or half-bootstrapped dirs under packages/ cannot leak in.
 members = [
     ".",
-    "packages/*",
-    "packages/*/examples/*"
+    "packages/oauth",
+    "packages/starlette",
+    "packages/mcp",
+    "packages/mcp-fastmcp",
+    "packages/fastmcp",
+    "packages/a2a",
+    "packages/*/examples/*",
 ]
-# Exclude any packages that shouldn't be part of the workspace
 exclude = []
 
 [tool.uv.sources]