Commit Graph

53 Commits

Author SHA1 Message Date
Mathias Bergqvist
923689afa5 feat: replace static API token with per-request Gitea PAT pass-through
Callers now supply their own Gitea PAT as a Bearer token; the server validates
it against GET /api/v1/user and threads it through context to all downstream
Gitea API calls. GITEA_API_TOKEN env var and the GiteaAPIToken config field are
removed.
2026-05-07 21:04:47 +02:00
Mathias Bergqvist
0c5903a196 feat(tools): repo_status 2026-05-06 22:59:51 +02:00
Mathias Bergqvist
839fc93dcd feat(tools): tag_create 2026-05-06 22:54:22 +02:00
Mathias Bergqvist
5dac4856bd feat(tools): file_delete 2026-05-06 22:51:21 +02:00
Mathias Bergqvist
0eb9ebcafd feat(tools): dir_list 2026-05-06 22:49:50 +02:00
Mathias Bergqvist
284d5e19f6 feat(tools): pr_merge 2026-05-06 22:48:02 +02:00
Mathias Bergqvist
388131c8cd feat(tools): pr_list 2026-05-06 22:46:11 +02:00
Mathias Bergqvist
ddfcc32afd feat(tools): branch_protection_get 2026-05-06 22:44:24 +02:00
Mathias Bergqvist
9e4251c1a7 feat(tools): branch_delete 2026-05-06 22:42:38 +02:00
Mathias Bergqvist
06882d185e fix(tools): branch_list schema constraints 2026-05-06 22:41:05 +02:00
Mathias Bergqvist
073d88b29a feat(tools): branch_list 2026-05-06 22:38:15 +02:00
Mathias Bergqvist
44c42fa636 feat(gitea): add DeleteJSONBody for delete-with-body requests 2026-05-06 22:36:37 +02:00
Mathias Bergqvist
9cbb564cd9 fix: add OAuth discovery endpoints for claude.ai handshake
All checks were successful
CD / Lint / Test / Vet (pull_request) Successful in 5s
CD / Build & Import (pull_request) Has been skipped
CD / Deploy via GitOps (pull_request) Has been skipped
Implements RFC 9728 protected resource metadata and HEAD probe so
claude.ai can complete its pre-handshake discovery without hitting 404.

- GET /.well-known/oauth-protected-resource → 200 {"authorization_servers":[]}
- GET /.well-known/oauth-authorization-server → 404 (no auth server)
- HEAD /mcp → 200 + MCP-Protocol-Version: 2025-06-18 header

Closes #2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-06 17:19:14 +02:00
d35ff9781c test(file_write_branch): assert branch and commit_sha on PUT path for parity
All checks were successful
CD / Lint / Test / Vet (pull_request) Successful in 5s
CD / Build & Import (pull_request) Has been skipped
CD / Deploy via GitOps (pull_request) Has been skipped
2026-05-06 14:35:20 +00:00
052827320a test(file_write_branch): cover POST-on-create and PUT-on-update routing
All checks were successful
CD / Lint / Test / Vet (pull_request) Successful in 6s
CD / Build & Import (pull_request) Has been skipped
CD / Deploy via GitOps (pull_request) Has been skipped
2026-05-06 14:05:23 +00:00
c85197ea5e fix(files): route UpsertFile to POST when sha is empty so new files can be created 2026-05-06 14:04:36 +00:00
Mathias Bergqvist
c345025221 fix(lint): staticcheck S1030, QF1002 and remove unused _ctx stub
All checks were successful
CD / Lint / Test / Vet (push) Successful in 4s
CD / Build & Import (push) Successful in 12s
CD / Deploy via GitOps (push) Has been skipped
2026-05-05 09:02:39 +02:00
Mathias Bergqvist
64559f0250 fix(lint): check Body.Close error return in http client
Some checks failed
CD / Lint / Test / Vet (push) Failing after 2s
CD / Build & Import (push) Has been skipped
CD / Deploy via GitOps (push) Has been skipped
2026-05-05 08:55:31 +02:00
Mathias Bergqvist
1f9934349b chore(tools): centralize pagination cap helper 2026-05-04 23:06:38 +02:00
Mathias Bergqvist
4274b48ea5 feat(gitea): default-branch lru cache
Shared LRU avoids repeated Gitea calls for default-branch resolution;
the simple stdlib map alternative would race on concurrent access without
a mutex per entry, which is more code than the LRU.
2026-05-04 23:06:06 +02:00
Mathias Bergqvist
fb473262ba feat(gitea): read retry once on 5xx GET 2026-05-04 23:04:55 +02:00
Mathias Bergqvist
39dc22ec3a feat(tools): create_project_from_template
Generates a new repo from mathias/template-go-web via Gitea's generate
API, then substitutes __PROJECT_NAME__ and __MODULE_PATH__ placeholders
in six known files (best-effort, partial failure surfaced in result).

Validates name regex, allowlist, template flag, and destination
non-existence before generating. Adds Template field to gitea.Repo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 23:02:21 +02:00
Mathias Bergqvist
e95e87e8e3 feat(tools): pr_files_diff with caps
Returns per-file unified diff for a PR, capped at 20KB/file and 200KB
total response. Files exceeding per-file cap report truncated+omitted_lines;
files that would push the response over 200KB go to omitted_files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:57:11 +02:00
Mathias Bergqvist
d3d0fed6b1 feat(tools): pr_comment with identity footer
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:53:14 +02:00
Mathias Bergqvist
c8a353aa35 feat(tools): issue_comment with identity footer
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:52:24 +02:00
Mathias Bergqvist
6f43ff216f feat(tools): issue_create with identity footer
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:51:40 +02:00
Mathias Bergqvist
2c6b9986e4 feat(tools): code_search (org-wide fan-out)
When repo is omitted, lists owner's repos then concurrently searches
each one (semaphore cap 5, 5s per-repo timeout). Merges and sorts
hits by score desc with deterministic tiebreak. Partial failures
tracked in partial_repos without aborting the whole fan-out.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:48:39 +02:00
Mathias Bergqvist
e4a9d058f0 feat(tools): code_search (single-repo)
Adds SearchCode to gitea.Client and code_search MCP tool for single-repo
code search via GET /api/v1/repos/{owner}/{repo}/search?type=code.
Fan-out placeholder returns ErrValidation (lands in 7.3).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:47:33 +02:00
Mathias Bergqvist
61cce37ff5 feat(tools): repo_search with allowlist post-filter
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:44:44 +02:00
Mathias Bergqvist
43e016e8fa feat(tools): workflow_run_status 2026-05-04 22:25:23 +02:00
Mathias Bergqvist
ba172e3db8 feat(tools): workflow_run_trigger 2026-05-04 22:25:10 +02:00
Mathias Bergqvist
c4874ae8d1 feat(tools): pr_get 2026-05-04 22:21:20 +02:00
Mathias Bergqvist
9972dcd94e feat(tools): pr_create with identity footer 2026-05-04 22:20:33 +02:00
Mathias Bergqvist
5af8addc26 feat(tools): file_write_branch
Add BranchExists/CreateBranch/UpsertFile gitea client methods and the
file_write_branch MCP tool. Branch is auto-created from base (or repo
default_branch) when it doesn't exist; file is upserted via PUT contents.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:15:39 +02:00
Mathias Bergqvist
044086b067 feat(tools): file_read with default-branch resolution
Adds GetFileContents to the gitea client and a file_read MCP tool.
When ref is omitted, the tool resolves the repo default_branch via
GetRepo before fetching contents. Decoded content capped at 1 MiB.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 22:11:50 +02:00
Mathias Bergqvist
f10cc9ac4b feat(tools): repo_get 2026-05-04 22:08:24 +02:00
Mathias Bergqvist
33ad02d369 feat(tools): repo_list 2026-05-04 22:07:44 +02:00
Mathias Bergqvist
18eadc0ae9 feat(tools): tool interface + helpers 2026-05-04 21:27:50 +02:00
Mathias Bergqvist
4ebb1eef6d feat(allowlist): owner allowlist enforcement 2026-05-04 21:26:50 +02:00
Mathias Bergqvist
d564cdcae3 feat(gitea): typed error mapping from http status 2026-05-04 21:26:29 +02:00
Mathias Bergqvist
2ecffd1b7a feat(gitea): base http client with token auth 2026-05-04 21:26:03 +02:00
Mathias Bergqvist
3613c36afb feat(identity): created-content footer 2026-05-04 21:05:42 +02:00
Mathias Bergqvist
0b5daca198 feat(auth): X-Auth-Request-User context middleware 2026-05-04 21:05:16 +02:00
Mathias Bergqvist
c6c328e517 fix(mcp): map tool-not-found to CodeNotFound via registry sentinel
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:59:15 +02:00
Mathias Bergqvist
93c5a6934b feat(mcp): cap inbound request body at 1 MiB
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:58:36 +02:00
Mathias Bergqvist
ba5068648b refactor(mcp): compose origin allowlist as middleware, remove duplication
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:58:08 +02:00
Mathias Bergqvist
36765b8360 feat(mcp): streamable HTTP transport with session, init, and dispatch
Implements the Streamable HTTP transport: POST routing handles initialize
(issues session ID), tools/list, tools/call, and unknown methods; GET SSE
emits a keepalive comment then blocks on context cancellation. A minimal
registry stub is introduced so the server compiles and tools/list returns
an empty array until Phase 6+ registers real tools.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:49:54 +02:00
Mathias Bergqvist
50a3b27825 test(mcp): pin session concurrency, document error codes, assert id round-trip
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:46:07 +02:00
Mathias Bergqvist
ea19516109 feat(mcp): origin allowlist middleware 2026-05-04 20:41:21 +02:00
Mathias Bergqvist
cf2017e687 feat(mcp): session id store 2026-05-04 20:40:53 +02:00