feat: harden local stdio MCP, CI package smoke, CLAUDE.md conventions #64

Merged
Latte merged 4 commits from feat/local-mcp-hardening-and-ci into dev 2026-06-27 13:29:11 +00:00

4 Commits

Author SHA1 Message Date
Latte 4db37d200e ci: stop artifact upload from failing the build on Gitea runners
docker / test (push) Successful in 34s
docker / lint (push) Successful in 40s
lint / lint (push) Successful in 43s
docker / lint (pull_request) Successful in 43s
docker / test (pull_request) Successful in 34s
test / test (push) Successful in 44s
lint / lint (pull_request) Successful in 44s
test / package (push) Successful in 1m8s
test / test (pull_request) Successful in 44s
test / package (pull_request) Successful in 53s
docker / docker (push) Successful in 1m5s
docker / docker (pull_request) Successful in 43s
Gitea's act_runner does not reliably support the actions/upload-artifact@v4
backend. Drop the artifact upload from the test workflow (the package job's
purpose is to build and smoke-test, not to store wheels) and make the publish
workflow's upload best-effort (continue-on-error) so a flaky artifact backend
cannot block a release — the package is still published to the registry.
2026-06-27 15:26:56 +02:00
Latte 3d527f8690 ci: build the package and smoke-test both install profiles
docker / test (pull_request) Successful in 34s
docker / test (push) Successful in 36s
docker / lint (pull_request) Successful in 39s
docker / lint (push) Successful in 40s
test / test (push) Successful in 42s
test / package (pull_request) Failing after 2m27s
lint / lint (pull_request) Successful in 43s
lint / lint (push) Successful in 43s
test / test (pull_request) Successful in 44s
docker / docker (pull_request) Successful in 1m10s
docker / docker (push) Successful in 34s
test / package (push) Failing after 2m5s
Add a package job to the test workflow: uv build, then verify a clean core
install excludes the web stack and the aegis-gitea-mcp stdio entry exits 2 with
an actionable message, and that the [server] extra pulls in fastapi/uvicorn and
imports the server entry. Catches packaging/console-script regressions in CI.
2026-06-27 15:19:43 +02:00
Latte d79ff2d476 docs: forbid AI attribution and document the stdio transport in CLAUDE.md
Record that no 'Generated with Claude Code' / Co-Authored-By / 'made by Claude'
attribution may appear in commits, PRs, releases, comments or docs. Add stdio
transport notes (stdout reserved for JSON-RPC, build_server vs _serve).
2026-06-27 15:19:42 +02:00
Latte 5d4a98d06e feat(stdio): harden local MCP transport and add end-to-end tests
Reserve stdout for the JSON-RPC stream: _configure_stderr_logging() pins all
logging to stderr (and rewrites any stray stdout handler) so a log line can
never corrupt the stdio protocol. Extract a pure, testable build_server() from
_serve(). Add end-to-end tests over the mcp in-memory transport (initialize +
tools/list + tools/call), covering a successful round trip and a policy denial
surfaced as an MCP error.
2026-06-27 15:19:42 +02:00