2 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Sonnet 5	43714047be	fix(auth): owner allowlist trusts pass-through-authenticated callers (#59) ... Allowlist.Check now takes ctx: when the caller authenticated with their own Gitea PAT (pass-through, v0.12.0), it skips the static GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission model already gates that caller's access more precisely than a coarse owner-name list can. The static list still applies unchanged for the shared static-token/JWT path, where it's the only defense against the service token's blast radius. Mechanical: every tool call site already had ctx in scope, so this is a signature-only change at 41 call sites, no other tool behavior changes. Closes the "Deferred" item from #59. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-22 08:31:43 +02:00
mathiasandClaude Opus 4.8	82823aad1e	feat(labels): add label_list + issue_label tools (#52) ... Closes #52 — unblocks parallax#3 dispatch labeling, which needs to both discover a repo's label set and attach labels to an issue by name (the CAD pipeline doesn't track Gitea's internal numeric label IDs). - gitea.Client: ListLabels, AddIssueLabels (additive POST, matches Gitea's own semantics — no delete-then-post needed); extend the existing Label struct with Color for label_list's output. - tools.LabelList (read-only, allowlisted): lists a repo's labels. - tools.IssueLabel (allowlisted): resolves label names to IDs via ListLabels, so callers pass names (the primary interface) instead of hunting for numeric IDs; also accepts label_ids for callers that already have them. An unknown name fails closed, naming exactly which label wasn't found. - Bump TestRegisteredToolCount 39 -> 41 in the same commit (this project was bitten today by a locked count going stale silently). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:44:14 +02:00