fix(code_search): replace the fantasy REST endpoint with a real client-side grep

code_search was calling GET /api/v1/repos/{owner}/{repo}/search?type=code — an
endpoint that does not exist. Confirmed against a live Gitea 1.25.5 instance's
swagger spec: only /repos/search, /repos/issues/search, /topics/search etc are
real. Gitea's own web UI code search falls back to server-side `git grep`
because no Repository Indexer is enabled here, and that fallback is an
HTML-only route, not JSON API — so no REST endpoint exists to call, working or
not. Every call to code_search 404'd on the real server.

This went undetected because the existing tests mocked the fantasy endpoint
directly (asserting the request path was .../search?type=code and handing back
a canned JSON envelope) — a textbook case of tests validating a fake instead of
the real system, giving false confidence the tool worked.

SearchCode now does the search itself: resolves the default branch, walks the
tree (GetTree), and substring-matches q (case-insensitive, literal — not a
regex, to keep behavior predictable and avoid a ReDoS surface from
user-supplied input) against fetched file contents (GetFileContents) — the same
approach Gitea's own indexer-less fallback uses, just client-side. Bounded by:
- codeSearchMaxFiles (2000) — files scanned per call
- codeSearchMaxFileSize (512KB, checked via the tree listing's own Size field,
  before any fetch) — skip large blobs
- a binary-extension denylist checked before fetch, plus a null-byte content
  check after fetch, for extensions the denylist misses

Pagination is over the full sorted result set, recomputed each call (no
server-side index to page through incrementally) — acceptable for the repo
sizes this targets; documented as a known limitation, not a hidden footgun.

The tool layer (internal/tools/code_search.go) is UNCHANGED — SearchCode's
signature and the []CodeSearchHit contract are identical, so this is fully
isolated to the client layer + its tests.

Tests: match found in tree, case-insensitive matching, binary extension
skipped WITHOUT fetching (asserted via the fake's fetch log, not just absent
from results), oversized file skipped without fetching, null-byte content
skipped after fetching, pagination across a full sorted set, empty-query
validation — plus the tool-layer single-repo and fan-out tests rewritten
against the same real endpoints (GetRepo/GetTree/GetFileContents +
ListRepos), replacing their fantasy-endpoint fakes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -4,6 +4,10 @@ name: CD
   push:
     branches: [main]
     tags: ["v*"]
+    # Docs-only pushes don't change the image — skip the build/deploy roll.
+    # (Only applies to branch pushes; tag pushes always trigger.)
+    paths-ignore:
+      - 'docs/**'
 
 env:
   IMAGE: gitea-mcp

cmd/gitea-mcp/k8soidc.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+const (
+	saCAFile    = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+	saTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token" //nolint:gosec // path, not a secret
+)
+
+// k8sBearerRT adds this pod's ServiceAccount bearer to every request. k3s serves
+// its OIDC discovery/JWKS over the cluster CA and requires an AUTHENTICATED
+// request (anonymous is 401), so the JWKS fetch must carry a token — ADR-0011.
+type k8sBearerRT struct {
+	token string
+	base  http.RoundTripper
+}
+
+func (b k8sBearerRT) RoundTrip(r *http.Request) (*http.Response, error) {
+	r.Header.Set("Authorization", "Bearer "+b.token)
+	return b.base.RoundTrip(r)
+}
+
+// k8sOIDCClient builds an HTTP client that can reach the in-cluster k8s OIDC
+// discovery + JWKS: it trusts the cluster CA and carries this pod's SA bearer.
+// Returns an error (not running in a pod, files unreadable) so the caller can
+// skip the k8s issuer without disabling other auth.
+func k8sOIDCClient() (*http.Client, error) {
+	ca, err := os.ReadFile(saCAFile)
+	if err != nil {
+		return nil, fmt.Errorf("read cluster CA: %w", err)
+	}
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(ca) {
+		return nil, fmt.Errorf("parse cluster CA: no certs in %s", saCAFile)
+	}
+	tok, err := os.ReadFile(saTokenFile)
+	if err != nil {
+		return nil, fmt.Errorf("read SA token: %w", err)
+	}
+	return &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: k8sBearerRT{
+			token: strings.TrimSpace(string(tok)),
+			base:  &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS12}},
+		},
+	}, nil
+}

cmd/gitea-mcp/main.go

@@ -37,7 +37,36 @@ func main() {
 
 	ctx := context.Background()
 
-	jwtValidator, jwtInitErr := chassisauth.NewJWTValidator(ctx, cfg.DexIssuerURL, cfg.MCPAudience)
+	// Build the trusted-issuer list. Authentik (DEX_ISSUER_URL) for interactive/
+	// web clients; the in-cluster k8s OIDC issuer for ServiceAccount tokens
+	// (ADR-0011 D1). The k8s issuer is ADDITIVE and best-effort: if its client
+	// can't be built (not in a pod) or its discovery is unreachable at startup,
+	// it is dropped so existing Authentik/static auth is never taken down.
+	var issuers []chassisauth.IssuerConfig
+	if cfg.DexIssuerURL != "" {
+		issuers = append(issuers, chassisauth.IssuerConfig{IssuerURL: cfg.DexIssuerURL, Audience: cfg.MCPAudience})
+	}
+	if cfg.K8sIssuerURL != "" {
+		if client, cerr := k8sOIDCClient(); cerr != nil {
+			logger.Warn("k8s OIDC client init failed; SA-token auth disabled (other auth unaffected)", "err", cerr)
+		} else {
+			issuers = append(issuers, chassisauth.IssuerConfig{IssuerURL: cfg.K8sIssuerURL, Audience: cfg.K8sAudience, HTTPClient: client})
+		}
+	}
+
+	jwtValidator, jwtInitErr := chassisauth.NewMultiJWTValidator(ctx, issuers)
+	if jwtInitErr != nil && cfg.K8sIssuerURL != "" && len(issuers) > 1 {
+		// A configured issuer (likely the in-cluster k8s OIDC) was unreachable at
+		// startup. Don't let it take down Authentik JWT auth — retry without it.
+		logger.Warn("multi-issuer init failed; retrying without the k8s issuer", "err", jwtInitErr)
+		pub := make([]chassisauth.IssuerConfig, 0, len(issuers))
+		for _, ic := range issuers {
+			if ic.IssuerURL != cfg.K8sIssuerURL {
+				pub = append(pub, ic)
+			}
+		}
+		jwtValidator, jwtInitErr = chassisauth.NewMultiJWTValidator(ctx, pub)
+	}
 	if jwtInitErr != nil {
 		logger.Warn("jwt validator init failed; JWT auth degraded", "err", jwtInitErr)
 	}

docs/HOW_GITEA_MCP_WORKS.md

@@ -0,0 +1,200 @@
+# How gitea-mcp works
+
+`gitea-mcp` is a custom **MCP (Model Context Protocol) front door for Gitea** — a
+small Go HTTP service that exposes ~60 Gitea operations as MCP tools over
+Streamable HTTP, so a claude.ai connector (or any MCP client) can drive the
+homelab's Gitea (`https://git.d-ma.be`) with proper auth, an owner allowlist,
+caller attribution, and defensive input handling.
+
+It is **not** a generic Gitea proxy. It is an opinionated, allowlisted, single-
+tenant front door built on the shared **`mcp-chassis`** auth library.
+
+---
+
+## 1. Request lifecycle
+
+Everything is wired in `cmd/gitea-mcp/main.go` on a plain `http.ServeMux`:
+
+```
+POST /mcp
+  → OriginAllowlist        (internal/mcp/origin.go)     browser Origin gate
+  → BearerMiddleware       (mcp-chassis auth)           authN: static token OR JWT
+  → CallerMiddleware       (internal/auth/caller.go)    extract caller identity
+  → MCP server             (internal/mcp/server.go)     JSON-RPC dispatch → tools
+
+GET  /healthz                                            unauthenticated health JSON
+GET  /.well-known/oauth-protected-resource               RFC 9728 metadata (when Dex set)
+```
+
+The middleware order is deliberate: Origin first (cheap reject), then authN,
+then identity extraction, then the MCP handler. A tool call is a JSON-RPC
+`tools/call` that the registry dispatches to a `Tool` handler.
+
+---
+
+## 2. Authentication (`mcp-chassis` `BearerMiddleware`)
+
+`Authorization: Bearer <token>` is checked with this precedence (`auth/bearer.go`
+in `mcp-chassis`):
+
+1. **Static bearer** — constant-time compare against `GITEA_MCP_STATIC_TOKEN`.
+   Wins immediately, never emits a `WWW-Authenticate` challenge. This is the
+   service-to-service path (repo `.mcp.json` files carrying `GITEA_MCP_TOKEN`).
+2. **JWT validation** — against a **list of trusted OIDC issuers**
+   (`NewMultiJWTValidator`, ADR-0011):
+   - **Authentik** (`DEX_ISSUER_URL` + `MCP_AUDIENCE=claude-ai`) — the claude.ai
+     web connector after its OAuth handshake.
+   - **k3s cluster OIDC** (`K8S_ISSUER_URL` + `K8S_MCP_AUDIENCE=gitea-mcp`) — lets
+     in-cluster pods authenticate with audience-bound projected **ServiceAccount
+     tokens** instead of a static bearer. The k8s issuer is additive and
+     best-effort: if the in-cluster OIDC can't be reached at startup it is
+     dropped so Authentik auth is never taken down (see `cmd/gitea-mcp/main.go`
+     and `cmd/gitea-mcp/k8soidc.go`).
+3. Otherwise **401**. If `MCP_RESOURCE_URL` + `DEX_ISSUER_URL` are set, the 401
+   carries a `WWW-Authenticate: … resource_metadata=…` header (RFC 9728) so
+   claude.ai's OAuth discovery can find `/.well-known/oauth-protected-resource`.
+
+A JWKS/issuer outage yields **503** (`ErrUnavailable`), distinct from a
+present-but-invalid token's **401**, so a transient IdP blip is retried rather
+than treated as a hard auth failure.
+
+### The k8s SA-token wrinkle (ADR-0011)
+
+k3s serves its OIDC discovery/JWKS over the **cluster CA** and requires an
+**authenticated** request (anonymous → 401). So `k8sOIDCClient()` builds an HTTP
+client that trusts `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` and
+carries the pod's own SA bearer, passed to the chassis via
+`IssuerConfig.HTTPClient`. Proven live: a real `aud=gitea-mcp` SA token → the
+running server → HTTP 200.
+
+### Origin allowlist
+
+`OriginAllowlist` (`internal/mcp/origin.go`) rejects any request whose `Origin`
+header is not in `GITEA_MCP_ORIGIN_ALLOWLIST` (`https://claude.ai`,
+`https://api.anthropic.com`). An **empty** Origin (server-side callers) is
+allowed — Origin is a browser-only header.
+
+---
+
+## 3. Authorization, identity & attribution
+
+- **Owner allowlist** (`internal/allowlist`) — tools only operate on owners in
+  `GITEA_MCP_ALLOWED_OWNERS` (default `mathias`). A call for any other owner is
+  rejected before it reaches Gitea.
+- **Caller identity** (`internal/auth/caller.go`) — the authenticated username is
+  read from reverse-proxy identity headers, `X-Auth-Request-User` (the verified
+  OIDC identity, authoritative) preferred over `X-Forwarded-User`. Conflicts are
+  logged, not silently resolved.
+- **Identity footer** (`internal/identity/footer.go`) — mutating tools that write
+  a body (issue/PR comments, creates) append
+  `_Created via git-mcp on behalf of @<caller>_`, so actions taken through the
+  front door are attributable even though all upstream calls use one service PAT.
+
+---
+
+## 4. Upstream Gitea access
+
+`internal/gitea/Client` is a thin REST client over `GITEA_BASE_URL`
+(`https://git.d-ma.be`). Every upstream call carries a **single service PAT** —
+`GITEA_MCP_DEFAULT_TOKEN` — as `Authorization: token <PAT>` (`client.go`). So
+gitea-mcp is a *front door*, not a credential pass-through: the caller's identity
+is captured for attribution, but Gitea sees one service account. A 60s branch
+cache and a 30s HTTP timeout round it out.
+
+Defensive guard: paths with an empty owner/repo segment (`//`) are rejected
+locally (`hasEmptySegment`) so callers get a typed validation error instead of
+Gitea's opaque `/api/swagger` 404.
+
+---
+
+## 5. Tools
+
+Tools are registered in `internal/tools/registry.go` into a `registry.Registry`;
+each implements the `Tool` interface (name, JSON schema, handler). ~60 tools,
+by area:
+
+| Area | Tools |
+|------|-------|
+| Repos | list, get, search, status, create, delete, update, tree, topics_update, mirror_push |
+| Files | file_read, file_write_branch, file_delete, dir_list |
+| Branches | branch_list, branch_delete, branch_protection_get |
+| Issues | list, get, create, edit, close, reopen, comment, label, list_comments |
+| PRs | list, get, create, comment, merge, files_diff |
+| Labels / Releases / Tags | label_list, release_create, tag_create |
+| Workflows (Actions) | run_list, run_status, run_trigger |
+| Search / Templates | code_search, create_project_from_template |
+| Composite | tbd_ship (trunk-based ship helper) |
+
+Shared tool-layer hygiene (`internal/tools/tool.go`):
+- **Alias normalization** — `repo`↔`name` and `number`↔`index` are reconciled so
+  a tool works whichever spelling a caller sends (an explicit canonical wins).
+- **Required-identifier validation** — an empty `repo`/`name` is rejected at the
+  tool layer (avoids the bare-404 leak); `owner` is covered by the allowlist.
+- **Page-size cap** — limits are clamped to 50.
+
+---
+
+## 6. Configuration (env)
+
+| Var | Purpose | Example |
+|-----|---------|---------|
+| `GITEA_MCP_PORT` | listen port | `8080` |
+| `GITEA_BASE_URL` | upstream Gitea | `https://git.d-ma.be` |
+| `GITEA_MCP_DEFAULT_TOKEN` | **upstream** service PAT (all Gitea calls) | *(secret)* |
+| `GITEA_MCP_STATIC_TOKEN` | static bearer for service-to-service auth | *(secret)* |
+| `GITEA_MCP_ALLOWED_OWNERS` | owner allowlist | `mathias` |
+| `GITEA_MCP_ORIGIN_ALLOWLIST` | permitted browser Origins | `https://claude.ai,…` |
+| `DEX_ISSUER_URL` / `MCP_AUDIENCE` | Authentik issuer + audience | `…/o/claude-ai/`, `claude-ai` |
+| `K8S_ISSUER_URL` / `K8S_MCP_AUDIENCE` | k8s OIDC issuer + audience (SA tokens) | `https://kubernetes.default.svc.cluster.local`, `gitea-mcp` |
+| `MCP_RESOURCE_URL` | this server's public URL for `.well-known` metadata | `https://git-mcp.d-ma.be` |
+
+Secrets come from k8s Secrets (`gitea-mcp-secrets`, `gitea-mcp-static-token`);
+non-secret values are inlined in the Deployment.
+
+---
+
+## 7. Health & observability
+
+- `GET /healthz` → `{"ok":true,"jwt":{"status":"disabled|enabled|degraded","last_error":"…"}}`.
+  `degraded` = a JWT issuer was configured but init failed (static-token auth
+  still works) — distinguishes "IdP unreachable" from "JWT not configured".
+- Every auth rejection is audit-logged (`mcp-chassis` `deny`) with the reason,
+  client IP, token *type*, and a truncated SHA-256 **fingerprint** — never the
+  raw token, so nothing secret lands in logs.
+
+---
+
+## 8. Deployment & CI/CD
+
+- **Runs in** the `gitea-mcp` k3s namespace (`git.d-ma.be/mathias/infra`
+  `k3s/apps/gitea-mcp/`): a Deployment on `localhost:5000/gitea-mcp:<sha>`, an
+  ExternalSecret for tokens, and a **default-deny NetworkPolicy** + an
+  `allow-ingress-nginx` rule (this namespace is the P6.1 netpol pilot — the only
+  ingress allowed is from `ingress-nginx`).
+- **Public endpoint** `https://git-mcp.d-ma.be` (NPM → ingress-nginx → svc:8080).
+- **Pipeline** (`.gitea/workflows/cd.yml`, self-hosted koala runner): quality gate
+  (test/vet) → `buildah` image → `localhost:5000` → smoke test → the deploy job
+  clones infra over SSH, `sed`s the image tag in `k3s/apps/gitea-mcp/deployment.yaml`,
+  commits, and triggers a **Flux** reconcile. Push to `main` ⇒ new image ⇒ rolled.
+
+---
+
+## 9. Operational notes
+
+- **Rollback** = revert the image tag (or the env change) in the infra Deployment;
+  Flux rolls back. Auth changes are additive, so enabling/disabling the k8s issuer
+  never affects the Authentik/static paths.
+- **NetworkPolicy kill switch** — delete the `gitea-mcp` NetworkPolicies to
+  restore open ingress if the pilot ever locks something out.
+- **claude.ai connector flakiness** — the claude.ai→gitea-mcp MCP path
+  intermittently hits a Cloudflare "you have been blocked" page (the error names
+  `anthropic.com`). On the Claude Code CLI, prefer the direct Gitea REST API for
+  reliability; the MCP connector remains the claude.ai-web path. (brain:
+  `prefer-rest-api-skills-over-mcp-on-cli-cloudflare-waf`.)
+
+## References
+- Auth library: `git.d-ma.be/mathias/mcp-chassis` (`auth` package) — shared
+  `BearerMiddleware` + multi-issuer `JWTValidator` + RFC 9728 handler.
+- Multi-issuer / SA-token design: infra `docs/decisions/ADR-0011-service-to-service-auth.md`.
+- Source map: `cmd/gitea-mcp/{main,healthz,k8soidc}.go`,
+  `internal/{mcp,auth,gitea,tools,allowlist,identity,registry,config}`.

go.mod

@@ -3,7 +3,7 @@ module git.d-ma.be/mathias/gitea-mcp
 go 1.26.2
 
 require (
-	git.d-ma.be/mathias/mcp-chassis v0.3.0
+	git.d-ma.be/mathias/mcp-chassis v0.5.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/stretchr/testify v1.11.1
 )

go.sum

@@ -1,5 +1,5 @@
-git.d-ma.be/mathias/mcp-chassis v0.3.0 h1:lV/vDsjrDeZojT7lhcwolM1lMZpsnEKEvf4kEHrxIa0=
-git.d-ma.be/mathias/mcp-chassis v0.3.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
+git.d-ma.be/mathias/mcp-chassis v0.5.0 h1:0w3dt4t4r8OtZBHIOoZkR6p6L3L6YDiqhMh9bTI/w/8=
+git.d-ma.be/mathias/mcp-chassis v0.5.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/config/config.go

@@ -15,6 +15,8 @@ type Config struct {
 	DexIssuerURL    string   // DEX_ISSUER_URL, e.g. https://auth.d-ma.be; empty disables JWT auth
 	MCPAudience     string   // MCP_AUDIENCE, JWT audience claim to validate, e.g. claude-ai
 	MCPResourceURL  string   // MCP_RESOURCE_URL, this server's public URL for /.well-known metadata
+	K8sIssuerURL    string   // K8S_ISSUER_URL, in-cluster OIDC issuer for ServiceAccount-token auth (ADR-0011 D1); empty disables
+	K8sAudience     string   // K8S_MCP_AUDIENCE, required audience claim for k8s SA tokens
 }
 
 func Load() (Config, error) {
@@ -28,6 +30,8 @@ func Load() (Config, error) {
 		DexIssuerURL:    os.Getenv("DEX_ISSUER_URL"),
 		MCPAudience:     os.Getenv("MCP_AUDIENCE"),
 		MCPResourceURL:  os.Getenv("MCP_RESOURCE_URL"),
+		K8sIssuerURL:    os.Getenv("K8S_ISSUER_URL"),
+		K8sAudience:     os.Getenv("K8S_MCP_AUDIENCE"),
 	}
 	return cfg, nil
 }

internal/gitea/code_search.go

@@ -1,10 +1,13 @@
 package gitea
 
 import (
+	"bytes"
 	"context"
-	"encoding/json"
+	"encoding/base64"
 	"fmt"
-	"net/url"
+	"path"
+	"sort"
+	"strings"
 )
 
 type CodeSearchHit struct {
@@ -14,30 +17,147 @@ type CodeSearchHit struct {
 	Score   float64 `json:"score,omitempty"`
 }
 
-type codeSearchEnvelope struct {
-	Data []CodeSearchHit `json:"data"`
-	OK   bool            `json:"ok"`
+// codeSearchMaxFiles bounds how many files a single SearchCode call will fetch
+// and scan, so one call against a huge repo can't run indefinitely.
+const codeSearchMaxFiles = 2000
+
+// codeSearchMaxFileSize skips blobs larger than this (per the tree listing,
+// before any fetch) — almost certainly binary/vendor/generated content, not
+// worth the cost of fetching just to reject.
+const codeSearchMaxFileSize = 512 * 1024
+
+// codeSearchBinaryExts are skipped WITHOUT fetching — a cheap pre-filter for
+// obviously-binary content by extension, checked against the tree listing.
+var codeSearchBinaryExts = map[string]bool{
+	".png": true, ".jpg": true, ".jpeg": true, ".gif": true, ".ico": true, ".webp": true, ".bmp": true,
+	".pdf": true, ".zip": true, ".tar": true, ".gz": true, ".bz2": true, ".xz": true, ".7z": true,
+	".exe": true, ".dll": true, ".so": true, ".dylib": true, ".bin": true, ".class": true, ".jar": true,
+	".woff": true, ".woff2": true, ".ttf": true, ".eot": true, ".otf": true,
+	".mp3": true, ".mp4": true, ".mov": true, ".avi": true, ".webm": true,
+	".pyc": true, ".o": true, ".a": true,
 }
 
+// SearchCode does a client-side "git grep"-equivalent search. Gitea's REST API
+// has no code-content-search endpoint — confirmed against a live 1.25.5
+// instance's swagger spec (only /repos/search, /repos/issues/search,
+// /topics/search etc exist). The web UI's OWN code search falls back to
+// server-side `git grep` because no Repository Indexer is enabled on that
+// instance, and that fallback is an HTML-only route, not JSON API. So this
+// walks the tree, fetches text-like blobs (bounded by codeSearchMaxFiles /
+// codeSearchMaxFileSize), and substring-matches q — case-insensitive, literal
+// (not a regex, to keep behavior predictable and avoid a ReDoS surface from
+// user-supplied input) — against file contents.
+//
+// Pagination is over the FULL sorted result set, recomputed on every call —
+// there is no server-side index to page through incrementally, so requesting
+// page 2 re-scans the tree. Acceptable for the repo sizes this targets; a real
+// indexer (bleve/elasticsearch) enabled server-side would be the long-term
+// fix, and is an infra decision, not something gitea-mcp controls.
 func (c *Client) SearchCode(ctx context.Context, owner, repo, q string, page, limit int) ([]CodeSearchHit, error) {
+	if q == "" {
+		return nil, fmt.Errorf("q is required: %w", ErrValidation)
+	}
 	if page < 1 {
 		page = 1
 	}
 	if limit < 1 {
 		limit = 30
 	}
-	path := fmt.Sprintf("/api/v1/repos/%s/%s/search?q=%s&type=code&page=%d&limit=%d",
-		owner, repo, url.QueryEscape(q), page, limit)
-	body, status, err := c.GetJSON(ctx, path)
+
+	r, err := c.GetRepo(ctx, owner, repo)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("resolve repo: %w", err)
 	}
-	if err := MapStatus(status, body); err != nil {
-		return nil, err
+	branch := r.DefaultBranch
+	if branch == "" {
+		branch = "main"
 	}
-	var env codeSearchEnvelope
-	if err := json.Unmarshal(body, &env); err != nil {
-		return nil, err
+
+	tree, err := c.GetTree(ctx, owner, repo, branch, true)
+	if err != nil {
+		return nil, fmt.Errorf("tree walk: %w", err)
 	}
-	return env.Data, nil
+
+	qLower := strings.ToLower(q)
+	all := make([]CodeSearchHit, 0)
+	scanned := 0
+	for _, e := range tree.Tree {
+		if ctx.Err() != nil {
+			break
+		}
+		if e.Type != "blob" {
+			continue
+		}
+		if codeSearchBinaryExts[strings.ToLower(path.Ext(e.Path))] {
+			continue
+		}
+		if e.Size > codeSearchMaxFileSize {
+			continue
+		}
+		if scanned >= codeSearchMaxFiles {
+			break
+		}
+		scanned++
+
+		fc, ferr := c.GetFileContents(ctx, owner, repo, e.Path, branch)
+		if ferr != nil {
+			continue // vanished/unreadable between tree walk and read — skip, don't fail the whole search
+		}
+		decoded, derr := base64.StdEncoding.DecodeString(fc.Content)
+		if derr != nil {
+			continue
+		}
+		if bytes.IndexByte(decoded, 0) >= 0 {
+			continue // binary content the extension filter missed
+		}
+
+		content := string(decoded)
+		contentLower := strings.ToLower(content)
+		count := strings.Count(contentLower, qLower)
+		if count == 0 {
+			continue
+		}
+
+		idx := strings.Index(contentLower, qLower)
+		all = append(all, CodeSearchHit{
+			Path:    e.Path,
+			Snippet: codeSearchSnippet(content, idx, len(q)),
+			HTMLURL: fmt.Sprintf("%s/%s/%s/src/branch/%s/%s", c.baseURL, owner, repo, branch, e.Path),
+			Score:   float64(count),
+		})
+	}
+
+	sort.Slice(all, func(i, j int) bool {
+		if all[i].Score != all[j].Score {
+			return all[i].Score > all[j].Score
+		}
+		return all[i].Path < all[j].Path
+	})
+
+	start := (page - 1) * limit
+	if start >= len(all) {
+		return []CodeSearchHit{}, nil
+	}
+	end := start + limit
+	if end > len(all) {
+		end = len(all)
+	}
+	return all[start:end], nil
+}
+
+// codeSearchSnippet returns a short window of text centered on a match,
+// trimmed to a single line-ish window so results read like a grep hit rather
+// than a content dump.
+func codeSearchSnippet(content string, idx, matchLen int) string {
+	const window = 60
+	start := idx - window
+	if start < 0 {
+		start = 0
+	}
+	end := idx + matchLen + window
+	if end > len(content) {
+		end = len(content)
+	}
+	snippet := strings.ReplaceAll(content[start:end], "\n", " ")
+	return strings.TrimSpace(snippet)
 }

internal/gitea/code_search_test.go

@@ -2,8 +2,12 @@ package gitea_test
 
 import (
 	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
@@ -11,22 +15,65 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestSearchCode(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/api/v1/repos/mathias/infra/search", r.URL.Path)
-		assert.Equal(t, "SearchCode", r.URL.Query().Get("q"))
-		assert.Equal(t, "code", r.URL.Query().Get("type"))
+func b64(s string) string { return base64.StdEncoding.EncodeToString([]byte(s)) }
+
+// codeSearchFake serves GetRepo + GetTree + GetFileContents off an in-memory
+// file map — the REAL endpoints SearchCode uses now that Gitea's REST API has
+// no code-content-search endpoint (confirmed against a live 1.25.5 instance's
+// swagger spec: only /repos/search, /repos/issues/search etc exist — the web
+// UI's own code search falls back to server-side `git grep`, an HTML-only
+// route, not JSON API). Records which paths were actually fetched, so tests
+// can assert a file was SKIPPED (binary ext, oversized) without ever being
+// read, not just absent from results.
+type codeSearchFake struct {
+	files   map[string]string // path -> content
+	sizes   map[string]int64  // path -> tree-entry size (defaults to len(content))
+	fetched []string
+}
+
+func (f *codeSearchFake) handler(t *testing.T, owner, repo, branch string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{
-			"data":[{
-				"path":"internal/gitea/code_search.go",
-				"snippet":"func (c *Client) SearchCode",
-				"html_url":"http://gitea.example.com/mathias/infra/src/branch/main/internal/gitea/code_search.go",
-				"score":2.5
-			}],
-			"ok":true
-		}`))
-	}))
+		p := r.URL.Path
+		switch {
+		case r.Method == http.MethodGet && p == "/api/v1/repos/"+owner+"/"+repo:
+			_, _ = fmt.Fprintf(w, `{"name":%q,"full_name":"%s/%s","default_branch":%q}`, repo, owner, repo, branch)
+
+		case r.Method == http.MethodGet && strings.HasPrefix(p, "/api/v1/repos/"+owner+"/"+repo+"/git/trees/"):
+			var entries []string
+			for path, content := range f.files {
+				size := int64(len(content))
+				if s, ok := f.sizes[path]; ok {
+					size = s
+				}
+				entries = append(entries, fmt.Sprintf(`{"path":%q,"type":"blob","sha":"s","size":%d}`, path, size))
+			}
+			_, _ = fmt.Fprintf(w, `{"sha":"root","tree":[%s],"truncated":false}`, strings.Join(entries, ","))
+
+		case r.Method == http.MethodGet && strings.HasPrefix(p, "/api/v1/repos/"+owner+"/"+repo+"/contents/"):
+			path := strings.TrimPrefix(p, "/api/v1/repos/"+owner+"/"+repo+"/contents/")
+			f.fetched = append(f.fetched, path)
+			content, ok := f.files[path]
+			if !ok {
+				w.WriteHeader(http.StatusNotFound)
+				_, _ = w.Write([]byte(`{"message":"not found"}`))
+				return
+			}
+			_, _ = fmt.Fprintf(w, `{"path":%q,"sha":"s","size":%d,"content":%q,"encoding":"base64"}`, path, len(content), b64(content))
+
+		default:
+			t.Errorf("unexpected request: %s %s", r.Method, p)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}
+}
+
+func TestSearchCode_FindsMatchInTree(t *testing.T) {
+	f := &codeSearchFake{files: map[string]string{
+		"internal/gitea/code_search.go": "func (c *Client) SearchCode(ctx context.Context) {}\n",
+		"internal/gitea/repos.go":       "func (c *Client) ListRepos() {}\n",
+	}}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
 	defer srv.Close()
 
 	c := gitea.NewClient(srv.URL, "tok")
@@ -34,6 +81,92 @@ func TestSearchCode(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, hits, 1)
 	assert.Equal(t, "internal/gitea/code_search.go", hits[0].Path)
-	assert.Equal(t, "func (c *Client) SearchCode", hits[0].Snippet)
-	assert.InDelta(t, 2.5, hits[0].Score, 0.001)
+	assert.Contains(t, hits[0].Snippet, "SearchCode")
+	assert.Contains(t, hits[0].HTMLURL, "internal/gitea/code_search.go")
+	assert.Equal(t, 1.0, hits[0].Score)
+}
+
+func TestSearchCode_CaseInsensitive(t *testing.T) {
+	f := &codeSearchFake{files: map[string]string{
+		"README.md": "# MyProject\n\nBuild instructions here.\n",
+	}}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	hits, err := c.SearchCode(context.Background(), "mathias", "infra", "myproject", 1, 30)
+	require.NoError(t, err)
+	require.Len(t, hits, 1)
+}
+
+func TestSearchCode_SkipsBinaryExtensionWithoutFetching(t *testing.T) {
+	f := &codeSearchFake{files: map[string]string{
+		"assets/logo.png": "SearchCode", // would match if fetched — must not be
+		"main.go":         "package main\n",
+	}}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	hits, err := c.SearchCode(context.Background(), "mathias", "infra", "SearchCode", 1, 30)
+	require.NoError(t, err)
+	assert.Empty(t, hits)
+	assert.NotContains(t, f.fetched, "assets/logo.png", "binary extension must be skipped before fetch")
+}
+
+func TestSearchCode_SkipsOversizedFileWithoutFetching(t *testing.T) {
+	f := &codeSearchFake{
+		files: map[string]string{"vendor/bundle.txt": "SearchCode"},
+		sizes: map[string]int64{"vendor/bundle.txt": 10 * 1024 * 1024}, // 10MB per the tree listing
+	}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	hits, err := c.SearchCode(context.Background(), "mathias", "infra", "SearchCode", 1, 30)
+	require.NoError(t, err)
+	assert.Empty(t, hits)
+	assert.NotContains(t, f.fetched, "vendor/bundle.txt", "oversized file must be skipped before fetch")
+}
+
+func TestSearchCode_SkipsBinaryContentNullByte(t *testing.T) {
+	f := &codeSearchFake{files: map[string]string{
+		"data.bin": "SearchCode\x00binary-marker",
+	}}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	hits, err := c.SearchCode(context.Background(), "mathias", "infra", "SearchCode", 1, 30)
+	require.NoError(t, err)
+	assert.Empty(t, hits, "content with a null byte must be treated as binary even past the extension filter")
+}
+
+func TestSearchCode_Pagination(t *testing.T) {
+	files := map[string]string{}
+	for i := 0; i < 5; i++ {
+		files[fmt.Sprintf("file%d.go", i)] = strings.Repeat("hit ", i+1) // increasing occurrence count => increasing score
+	}
+	f := &codeSearchFake{files: files}
+	srv := httptest.NewServer(f.handler(t, "mathias", "infra", "main"))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	page1, err := c.SearchCode(context.Background(), "mathias", "infra", "hit", 1, 2)
+	require.NoError(t, err)
+	require.Len(t, page1, 2)
+	page2, err := c.SearchCode(context.Background(), "mathias", "infra", "hit", 2, 2)
+	require.NoError(t, err)
+	require.Len(t, page2, 2)
+
+	assert.NotEqual(t, page1[0].Path, page2[0].Path, "pages must not overlap")
+	assert.True(t, page1[0].Score >= page1[1].Score, "page1 sorted desc by score")
+	assert.True(t, page1[1].Score >= page2[0].Score, "page1's worst must rank >= page2's best")
+}
+
+func TestSearchCode_EmptyQueryErrors(t *testing.T) {
+	c := gitea.NewClient("http://unused", "tok")
+	_, err := c.SearchCode(context.Background(), "mathias", "infra", "", 1, 30)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, gitea.ErrValidation))
 }

internal/gitea/issues.go

@@ -22,8 +22,9 @@ type Issue struct {
 }
 
 type Label struct {
-	ID   int64  `json:"id"`
-	Name string `json:"name"`
+	ID    int64  `json:"id"`
+	Name  string `json:"name"`
+	Color string `json:"color,omitempty"`
 }
 
 type User struct {

internal/gitea/labels.go

@@ -0,0 +1,48 @@
+package gitea
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+)
+
+// ListLabels fetches all labels defined on a repo.
+func (c *Client) ListLabels(ctx context.Context, owner, repo string) ([]Label, error) {
+	p := fmt.Sprintf("/api/v1/repos/%s/%s/labels", owner, repo)
+	body, status, err := c.GetJSON(ctx, p)
+	if err != nil {
+		return nil, err
+	}
+	if err := MapStatus(status, body); err != nil {
+		return nil, err
+	}
+	var labels []Label
+	if err := json.Unmarshal(body, &labels); err != nil {
+		return nil, err
+	}
+	return labels, nil
+}
+
+// AddIssueLabels adds labelIDs to an issue or pull request (PRs share index
+// space with issues, per Gitea). This is additive per Gitea's own POST
+// semantics — existing labels are left in place, no replace/delete needed.
+// Returns the issue's full label set after the add.
+func (c *Client) AddIssueLabels(ctx context.Context, owner, repo string, number int, labelIDs []int64) ([]Label, error) {
+	p := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/labels", owner, repo, number)
+	payload, err := json.Marshal(map[string][]int64{"labels": labelIDs})
+	if err != nil {
+		return nil, err
+	}
+	body, status, err := c.PostJSON(ctx, p, payload)
+	if err != nil {
+		return nil, err
+	}
+	if err := MapStatus(status, body); err != nil {
+		return nil, err
+	}
+	var labels []Label
+	if err := json.Unmarshal(body, &labels); err != nil {
+		return nil, err
+	}
+	return labels, nil
+}

internal/gitea/labels_test.go

@@ -0,0 +1,107 @@
+package gitea_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListLabels(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/api/v1/repos/o/r/labels", r.URL.Path)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[
+			{"id":1,"name":"bug","color":"ee0701"},
+			{"id":2,"name":"enhancement","color":"84b6eb"}
+		]`))
+	}))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	labels, err := c.ListLabels(context.Background(), "o", "r")
+	require.NoError(t, err)
+	require.Len(t, labels, 2)
+	assert.Equal(t, int64(1), labels[0].ID)
+	assert.Equal(t, "bug", labels[0].Name)
+	assert.Equal(t, "ee0701", labels[0].Color)
+	assert.Equal(t, "enhancement", labels[1].Name)
+}
+
+func TestListLabels_Empty(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	labels, err := c.ListLabels(context.Background(), "o", "r")
+	require.NoError(t, err)
+	assert.Empty(t, labels)
+}
+
+func TestListLabels_NotFound(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte(`{"message":"repo not found"}`))
+	}))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	_, err := c.ListLabels(context.Background(), "o", "r")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, gitea.ErrNotFound)
+}
+
+func TestAddIssueLabels(t *testing.T) {
+	var captured []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPost, r.Method)
+		assert.Equal(t, "/api/v1/repos/o/r/issues/42/labels", r.URL.Path)
+		var err error
+		captured, err = io.ReadAll(r.Body)
+		require.NoError(t, err)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[
+			{"id":1,"name":"bug","color":"ee0701"},
+			{"id":3,"name":"priority","color":"00ff00"}
+		]`))
+	}))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	labels, err := c.AddIssueLabels(context.Background(), "o", "r", 42, []int64{3})
+	require.NoError(t, err)
+
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal(captured, &payload))
+	ids, ok := payload["labels"].([]any)
+	require.True(t, ok)
+	require.Len(t, ids, 1)
+	assert.Equal(t, float64(3), ids[0])
+
+	require.Len(t, labels, 2)
+	assert.Equal(t, "bug", labels[0].Name)
+	assert.Equal(t, "priority", labels[1].Name)
+}
+
+func TestAddIssueLabels_NotFound(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte(`{"message":"issue not found"}`))
+	}))
+	defer srv.Close()
+
+	c := gitea.NewClient(srv.URL, "tok")
+	_, err := c.AddIssueLabels(context.Background(), "o", "r", 999, []int64{1})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, gitea.ErrNotFound)
+}

internal/tools/code_search_test.go

@@ -2,8 +2,10 @@ package tools_test
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -16,22 +18,76 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestCodeSearchSingleRepo(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/api/v1/repos/mathias/infra/search", r.URL.Path)
-		assert.Equal(t, "ListRepos", r.URL.Query().Get("q"))
-		assert.Equal(t, "code", r.URL.Query().Get("type"))
+// multiRepoSearchFake serves ListRepos + per-repo GetRepo/GetTree/GetFileContents
+// for a set of repos — the real endpoints code_search's underlying SearchCode
+// now uses (Gitea's REST API has no code-content-search endpoint; see
+// internal/gitea/code_search.go's doc comment).
+type multiRepoSearchFake struct {
+	owner string
+	repos []string                     // ListRepos response, in this order
+	files map[string]map[string]string // repo -> path -> content
+	fail  map[string]bool              // repo -> GetRepo 500s for this repo (simulates a per-repo failure)
+}
+
+func (f *multiRepoSearchFake) handler(t *testing.T) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{
-			"data":[{
-				"path":"internal/gitea/repos.go",
-				"snippet":"func (c *Client) ListRepos",
-				"html_url":"http://gitea.example.com/mathias/infra/src/branch/main/internal/gitea/repos.go",
-				"score":3.0
-			}],
-			"ok":true
-		}`))
-	}))
+		p := r.URL.Path
+
+		for _, repo := range f.repos {
+			base := "/api/v1/repos/" + f.owner + "/" + repo
+			switch {
+			case p == base && f.fail[repo]:
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = w.Write([]byte(`{"message":"internal error"}`))
+				return
+			case p == base:
+				_, _ = fmt.Fprintf(w, `{"name":%q,"full_name":"%s/%s","default_branch":"main"}`, repo, f.owner, repo)
+				return
+			case strings.HasPrefix(p, base+"/git/trees/"):
+				var entries []string
+				for path := range f.files[repo] {
+					entries = append(entries, fmt.Sprintf(`{"path":%q,"type":"blob","sha":"s","size":100}`, path))
+				}
+				_, _ = fmt.Fprintf(w, `{"sha":"root","tree":[%s],"truncated":false}`, strings.Join(entries, ","))
+				return
+			case strings.HasPrefix(p, base+"/contents/"):
+				path := strings.TrimPrefix(p, base+"/contents/")
+				content, ok := f.files[repo][path]
+				if !ok {
+					w.WriteHeader(http.StatusNotFound)
+					_, _ = w.Write([]byte(`{"message":"not found"}`))
+					return
+				}
+				enc := base64.StdEncoding.EncodeToString([]byte(content))
+				_, _ = fmt.Fprintf(w, `{"path":%q,"sha":"s","size":%d,"content":%q,"encoding":"base64"}`, path, len(content), enc)
+				return
+			}
+		}
+
+		if p == "/api/v1/users/"+f.owner+"/repos" {
+			var entries []string
+			for _, repo := range f.repos {
+				entries = append(entries, fmt.Sprintf(`{"name":%q,"full_name":"%s/%s","default_branch":"main"}`, repo, f.owner, repo))
+			}
+			_, _ = fmt.Fprintf(w, `[%s]`, strings.Join(entries, ","))
+			return
+		}
+
+		t.Errorf("unexpected request: %s %s", r.Method, p)
+		w.WriteHeader(http.StatusNotFound)
+	}
+}
+
+func TestCodeSearchSingleRepo(t *testing.T) {
+	f := &multiRepoSearchFake{
+		owner: "mathias",
+		repos: []string{"infra"},
+		files: map[string]map[string]string{
+			"infra": {"internal/gitea/repos.go": "func (c *Client) ListRepos() {}\n"},
+		},
+	}
+	srv := httptest.NewServer(f.handler(t))
 	defer srv.Close()
 
 	tool := tools.NewCodeSearch(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"mathias"}))
@@ -50,7 +106,7 @@ func TestCodeSearchSingleRepo(t *testing.T) {
 	require.Len(t, result.Results, 1)
 	assert.Equal(t, "mathias/infra", result.Results[0].Repo)
 	assert.Equal(t, "internal/gitea/repos.go", result.Results[0].Path)
-	assert.Equal(t, "func (c *Client) ListRepos", result.Results[0].Snippet)
+	assert.Contains(t, result.Results[0].Snippet, "ListRepos")
 }
 
 func TestCodeSearchAllowlistRejects(t *testing.T) {
@@ -67,22 +123,15 @@ func TestCodeSearchRequiresQ(t *testing.T) {
 }
 
 func TestCodeSearchFanOutHappyPath(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		case "/api/v1/users/mathias/repos":
-			_, _ = w.Write([]byte(`[
-				{"name":"infra","full_name":"mathias/infra","default_branch":"main"},
-				{"name":"gitea-mcp","full_name":"mathias/gitea-mcp","default_branch":"main"}
-			]`))
-		case "/api/v1/repos/mathias/infra/search":
-			_, _ = w.Write([]byte(`{"data":[{"path":"main.go","snippet":"infra hit","html_url":"http://x/infra/main.go","score":2.0}],"ok":true}`))
-		case "/api/v1/repos/mathias/gitea-mcp/search":
-			_, _ = w.Write([]byte(`{"data":[{"path":"cmd/main.go","snippet":"gitea-mcp hit","html_url":"http://x/gitea-mcp/main.go","score":1.0}],"ok":true}`))
-		default:
-			http.NotFound(w, r)
-		}
-	}))
+	f := &multiRepoSearchFake{
+		owner: "mathias",
+		repos: []string{"infra", "gitea-mcp"},
+		files: map[string]map[string]string{
+			"infra":     {"main.go": "this is an infra hit\n"},
+			"gitea-mcp": {"cmd/main.go": "this is a gitea-mcp hit\n"},
+		},
+	}
+	srv := httptest.NewServer(f.handler(t))
 	defer srv.Close()
 
 	tool := tools.NewCodeSearch(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"mathias"}))
@@ -110,23 +159,15 @@ func TestCodeSearchFanOutHappyPath(t *testing.T) {
 }
 
 func TestCodeSearchFanOutPartialFailure(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		case "/api/v1/users/mathias/repos":
-			_, _ = w.Write([]byte(`[
-				{"name":"infra","full_name":"mathias/infra","default_branch":"main"},
-				{"name":"broken","full_name":"mathias/broken","default_branch":"main"}
-			]`))
-		case "/api/v1/repos/mathias/infra/search":
-			_, _ = w.Write([]byte(`{"data":[{"path":"main.go","snippet":"infra hit","html_url":"http://x/infra/main.go","score":1.0}],"ok":true}`))
-		case "/api/v1/repos/mathias/broken/search":
-			w.WriteHeader(http.StatusInternalServerError)
-			_, _ = w.Write([]byte(`{"message":"internal error"}`))
-		default:
-			http.NotFound(w, r)
-		}
-	}))
+	f := &multiRepoSearchFake{
+		owner: "mathias",
+		repos: []string{"infra", "broken"},
+		files: map[string]map[string]string{
+			"infra": {"main.go": "this is an infra hit\n"},
+		},
+		fail: map[string]bool{"broken": true},
+	}
+	srv := httptest.NewServer(f.handler(t))
 	defer srv.Close()
 
 	tool := tools.NewCodeSearch(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"mathias"}))
@@ -134,9 +175,11 @@ func TestCodeSearchFanOutPartialFailure(t *testing.T) {
 	require.NoError(t, err)
 
 	var result struct {
-		Results      []struct{ Repo string `json:"repo"` } `json:"results"`
-		Partial      bool                                  `json:"partial"`
-		PartialRepos []string                              `json:"partial_repos"`
+		Results []struct {
+			Repo string `json:"repo"`
+		} `json:"results"`
+		Partial      bool     `json:"partial"`
+		PartialRepos []string `json:"partial_repos"`
 	}
 	require.NoError(t, json.Unmarshal(out, &result))
 	assert.True(t, result.Partial)
@@ -147,41 +190,31 @@ func TestCodeSearchFanOutPartialFailure(t *testing.T) {
 }
 
 func TestCodeSearchFanOutSortsByScore(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		case "/api/v1/users/mathias/repos":
-			_, _ = w.Write([]byte(`[
-				{"name":"alpha","full_name":"mathias/alpha","default_branch":"main"},
-				{"name":"beta","full_name":"mathias/beta","default_branch":"main"}
-			]`))
-		case "/api/v1/repos/mathias/alpha/search":
-			// low score
-			_, _ = w.Write([]byte(`{"data":[{"path":"a.go","snippet":"low","html_url":"http://x/alpha/a.go","score":1.0}],"ok":true}`))
-		case "/api/v1/repos/mathias/beta/search":
-			// high score
-			_, _ = w.Write([]byte(`{"data":[{"path":"b.go","snippet":"high","html_url":"http://x/beta/b.go","score":5.0}],"ok":true}`))
-		default:
-			http.NotFound(w, r)
-		}
-	}))
+	f := &multiRepoSearchFake{
+		owner: "mathias",
+		repos: []string{"alpha", "beta"},
+		files: map[string]map[string]string{
+			"alpha": {"a.go": "one high here"},            // 1 occurrence => score 1
+			"beta":  {"b.go": "high high high high high"}, // 5 occurrences => score 5
+		},
+	}
+	srv := httptest.NewServer(f.handler(t))
 	defer srv.Close()
 
 	tool := tools.NewCodeSearch(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"mathias"}))
-	out, err := tool.Call(context.Background(), json.RawMessage(`{"q":"something","owner":"mathias"}`))
+	out, err := tool.Call(context.Background(), json.RawMessage(`{"q":"high","owner":"mathias"}`))
 	require.NoError(t, err)
 
 	var result struct {
 		Results []struct {
+			Repo    string  `json:"repo"`
 			Snippet string  `json:"snippet"`
 			Score   float64 `json:"score"`
 		} `json:"results"`
 	}
 	require.NoError(t, json.Unmarshal(out, &result))
 	require.Len(t, result.Results, 2)
-	// First result must be the high-score one
+	assert.Equal(t, "mathias/beta", result.Results[0].Repo, "higher-score repo (5 occurrences) must sort first")
 	assert.True(t, result.Results[0].Score > result.Results[1].Score,
-		"expected results sorted by score desc, got %v then %v",
-		result.Results[0].Score, result.Results[1].Score)
-	assert.True(t, strings.Contains(result.Results[0].Snippet, "high"))
+		"expected results sorted by score desc, got %v then %v", result.Results[0].Score, result.Results[1].Score)
 }

internal/tools/create_project_from_template.go

@@ -48,7 +48,7 @@ func NewCreateProjectFromTemplate(c *gitea.Client, a *allowlist.Allowlist, tmplO
 func (t *CreateProjectFromTemplate) Descriptor() registry.ToolDescriptor {
 	return registry.ToolDescriptor{
 		Name:        "create_project_from_template",
-		Description: "Create a new project repo from a template. Best-effort substitution of placeholders (__PROJECT_NAME__, __MODULE_PATH__) in every file's content AND path (e.g. renaming cmd/__PROJECT_NAME__/): it completes only if the generated branch is promptly writable. If gitea's async generate is slow (infra#179) the repo is still created and partial_failure explains how to finish substituting the placeholders manually. Check files_substituted and partial_failure. Defaults to the server-configured template; pass template_name to override (e.g. template-go-agent). Pass dispatch_allow=true to also inject a .dispatch-allow file so the project is immediately dispatch-eligible (dispatch#3).",
+		Description: "Create a new project repo from a template. Best-effort substitution of placeholders (__PROJECT_NAME__, __MODULE_PATH__) in every file's content AND path (e.g. renaming cmd/__PROJECT_NAME__/): it completes only if the generated branch is promptly writable. If gitea's async generate is slow (infra#179) the repo is still created and partial_failure explains the shortfall — call this tool again with resume=true (same owner/name) once the branch settles to safely continue where it left off; already-correct files/renames are left untouched. Check files_substituted, partial_failure, and dispatch_allow_failure. Defaults to the server-configured template; pass template_name to override (e.g. template-go-agent) — ignored when resume=true. Pass dispatch_allow=true to also inject a .dispatch-allow file so the project is dispatch-eligible (dispatch#3); safe to re-request on resume.",
 		InputSchema: json.RawMessage(`{
 			"type":"object",
 			"properties":{
@@ -56,8 +56,9 @@ func (t *CreateProjectFromTemplate) Descriptor() registry.ToolDescriptor {
 				"name":{"type":"string","pattern":"^[a-z][a-z0-9-]{1,38}[a-z0-9]$"},
 				"description":{"type":"string"},
 				"private":{"type":"boolean"},
-				"template_name":{"type":"string","description":"Template repo name to generate from. Defaults to the server-configured template."},
-				"dispatch_allow":{"type":"boolean","description":"When true, inject a .dispatch-allow file so the new project is immediately opt-in for headless dispatch (dispatch#3). Default false."}
+				"template_name":{"type":"string","description":"Template repo name to generate from. Defaults to the server-configured template. Ignored when resume=true."},
+				"dispatch_allow":{"type":"boolean","description":"When true, inject a .dispatch-allow file (dispatch#3) AND register owner/name into mathias/dispatch's git-tracked allowlist (dispatch-repos.txt, dispatch#19) — both gates are required for the watcher to actually pick the repo up; each is applied independently and idempotently. Default false. Safe to re-request on resume."},
+				"resume":{"type":"boolean","description":"Resume substitution on an ALREADY-CREATED repo from a prior call that hit infra#179's branch-writability race (its partial_failure names this). Skips template lookup and repo generation entirely; the destination must already exist. Safe to call repeatedly — files/renames already correct are left untouched. Default false."}
 			},
 			"required":["owner","name"]
 		}`),
@@ -71,6 +72,7 @@ type createProjectArgs struct {
 	Private       bool   `json:"private"`
 	TemplateName  string `json:"template_name"`
 	DispatchAllow bool   `json:"dispatch_allow"`
+	Resume        bool   `json:"resume"`
 }
 
 // dispatchAllowContent is the body injected when dispatch_allow=true. Mirrors the
@@ -80,14 +82,28 @@ const dispatchAllowContent = "# Presence of this file marks this repo as opt-in
 	"# See dispatch#3.\n"
 
 type createProjectResult struct {
-	FullName         string   `json:"full_name"`
-	HTMLURL          string   `json:"html_url"`
-	CloneURL         string   `json:"clone_url"`
-	DefaultBranch    string   `json:"default_branch"`
-	FilesSubstituted []string `json:"files_substituted"`
-	PartialFailure   string   `json:"partial_failure,omitempty"`
+	FullName                 string   `json:"full_name"`
+	HTMLURL                  string   `json:"html_url"`
+	CloneURL                 string   `json:"clone_url"`
+	DefaultBranch            string   `json:"default_branch"`
+	FilesSubstituted         []string `json:"files_substituted"`
+	PartialFailure           string   `json:"partial_failure,omitempty"`
+	DispatchAllowFailure     string   `json:"dispatch_allow_failure,omitempty"`
+	DispatchAllowlisted      bool     `json:"dispatch_allowlisted,omitempty"`
+	DispatchAllowlistFailure string   `json:"dispatch_allowlist_failure,omitempty"`
 }
 
+// The dispatch allowlist (dispatch#19) is a fixed integration point — a
+// specific file in a specific repo the mathias/dispatch watcher reads at the
+// start of every cycle. Hardcoded to match its own DISPATCH_ALLOWLIST_OWNER/
+// _REPO/_PATH defaults (unconfigured in the live CronJob, confirmed 2026-07-06).
+const (
+	dispatchAllowlistOwner  = "mathias"
+	dispatchAllowlistRepo   = "dispatch"
+	dispatchAllowlistPath   = "dispatch-repos.txt"
+	dispatchAllowlistBranch = "main"
+)
+
 func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, error) {
 	var args createProjectArgs
 	if err := parseArgs(raw, &args); err != nil {
@@ -104,6 +120,94 @@ func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessag
 		return nil, fmt.Errorf("name %q does not match pattern %s: %w", args.Name, nameRe.String(), gitea.ErrValidation)
 	}
 
+	var result createProjectResult
+	var branch string
+	var err error
+	if args.Resume {
+		result, branch, err = t.resumeDestination(ctx, args.Owner, args.Name)
+	} else {
+		result, branch, err = t.createDestination(ctx, args)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	// Substitute across the WHOLE tree: content in every blob, plus a path rename
+	// for any file whose path carries a placeholder (e.g. cmd/__PROJECT_NAME__/main.go).
+	// A fixed known-files list can't rename directories or cover every templated
+	// file, which is why the old scaffold didn't build. GetTree reflects the
+	// branch's CURRENT state, which is what makes this loop safe to re-run on
+	// resume: a file already fixed in a prior partial pass shows up already-correct
+	// (or already-renamed) and substituteEntry is a no-op for it.
+	repls := substitutions(args.Owner, args.Name)
+	tree, terr := t.c.GetTree(ctx, args.Owner, args.Name, branch, true)
+	if terr != nil {
+		result.PartialFailure = fmt.Sprintf("tree walk (%s@%s): %v", args.Name, branch, terr)
+		return textOK(result)
+	}
+
+	for _, e := range tree.Tree {
+		if e.Type != "blob" {
+			continue
+		}
+		substituted, fail := t.substituteEntry(ctx, args.Owner, args.Name, branch, e.Path, repls)
+		if fail != "" {
+			result.PartialFailure = fail
+			break
+		}
+		if substituted != "" {
+			result.FilesSubstituted = append(result.FilesSubstituted, substituted)
+		}
+	}
+
+	// Opt the new project into headless dispatch if asked. Two INDEPENDENT gates,
+	// both required (dispatch#3 + dispatch#19): the .dispatch-allow marker on this
+	// repo, and this repo's owner/name listed in mathias/dispatch's git-tracked
+	// allowlist. Skip both if substitution itself already stalled — don't mark an
+	// incomplete repo dispatch-eligible. Each failure is reported in its OWN field
+	// (gitea-mcp#51/#54) — never conflated with each other or with substitution,
+	// since any one of the three can fail independently of the other two.
+	if args.DispatchAllow && result.PartialFailure == "" {
+		if didWrite, fail := t.injectDispatchAllow(ctx, args.Owner, args.Name, branch); fail != "" {
+			result.DispatchAllowFailure = fail
+		} else if didWrite {
+			result.FilesSubstituted = append(result.FilesSubstituted, ".dispatch-allow")
+		}
+
+		ownerName := args.Owner + "/" + args.Name
+		if didRegister, fail := t.registerDispatchAllowlist(ctx, ownerName); fail != "" {
+			result.DispatchAllowlistFailure = fail
+		} else if didRegister {
+			result.DispatchAllowlisted = true
+		}
+	}
+
+	// If substitution stalled because the generated branch wasn't writable in time,
+	// the repo IS created — say so clearly and point to the concrete recovery step
+	// (resume=true), rather than leaking the raw "branch does not exist" (infra#179:
+	// gitea's template-generate is slow-async on this instance, so tool-side
+	// substitution is best-effort).
+	if strings.Contains(result.PartialFailure, "branch does not exist") ||
+		strings.Contains(result.PartialFailure, "not found") {
+		result.PartialFailure = infra179FinalizeMessage(
+			branch, substitutionBudget, len(result.FilesSubstituted), result.PartialFailure)
+	}
+
+	// Fail loud on a FRESH create with nothing substituted: a real template
+	// should have placeholders, so finding none is suspicious. On resume, nothing
+	// left to substitute is the expected steady state once a prior partial run is
+	// fully caught up — success, not a loud failure.
+	if !args.Resume && result.PartialFailure == "" && len(result.FilesSubstituted) == 0 {
+		result.PartialFailure = fmt.Sprintf("no placeholders substituted in %s@%s — verify the scaffold is not left templated", args.Name, branch)
+	}
+
+	return textOK(result)
+}
+
+// createDestination generates a new repo from the template: verifies the
+// template exists and the destination doesn't already exist, then calls
+// gitea's /generate and resolves the default branch.
+func (t *CreateProjectFromTemplate) createDestination(ctx context.Context, args createProjectArgs) (createProjectResult, string, error) {
 	// Resolve template: per-call override takes precedence over the
 	// server-configured default. Owner stays server-configured.
 	tmplName := args.TemplateName
@@ -114,17 +218,19 @@ func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessag
 	// Verify template exists and is marked as a template repo.
 	tmpl, err := t.c.GetRepo(ctx, t.templateOwner, tmplName)
 	if err != nil {
-		return nil, fmt.Errorf("template lookup: %w", err)
+		return createProjectResult{}, "", fmt.Errorf("template lookup: %w", err)
 	}
 	if !tmpl.Template {
-		return nil, fmt.Errorf("repo %s/%s is not marked as template: %w", t.templateOwner, tmplName, gitea.ErrValidation)
+		return createProjectResult{}, "", fmt.Errorf("repo %s/%s is not marked as template: %w", t.templateOwner, tmplName, gitea.ErrValidation)
 	}
 
 	// Verify destination doesn't already exist.
 	if _, err := t.c.GetRepo(ctx, args.Owner, args.Name); err == nil {
-		return nil, fmt.Errorf("destination %s/%s already exists: %w", args.Owner, args.Name, gitea.ErrConflict)
+		return createProjectResult{}, "", fmt.Errorf(
+			"destination %s/%s already exists: %w (pass resume:true to continue a prior partial create)",
+			args.Owner, args.Name, gitea.ErrConflict)
 	} else if !errors.Is(err, gitea.ErrNotFound) {
-		return nil, fmt.Errorf("destination check: %w", err)
+		return createProjectResult{}, "", fmt.Errorf("destination check: %w", err)
 	}
 
 	// Generate repo from template.
@@ -136,7 +242,7 @@ func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessag
 		GitContent:  true,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("generate: %w", err)
+		return createProjectResult{}, "", fmt.Errorf("generate: %w", err)
 	}
 
 	result := createProjectResult{
@@ -158,83 +264,112 @@ func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessag
 		}
 	}
 	result.DefaultBranch = branch
+	return result, branch, nil
+}
 
-	// Substitute across the WHOLE tree: content in every blob, plus a path rename
-	// for any file whose path carries a placeholder (e.g. cmd/__PROJECT_NAME__/main.go).
-	// A fixed known-files list can't rename directories or cover every templated
-	// file, which is why the old scaffold didn't build.
-	repls := substitutions(args.Owner, args.Name)
-	tree, err := t.c.GetTree(ctx, args.Owner, args.Name, branch, true)
+// resumeDestination looks up an ALREADY-CREATED repo to continue substitution
+// on (gitea-mcp#50). It errors if the destination doesn't exist — resume has
+// nothing to resume without it. Template lookup and generation are skipped
+// entirely: resume only ever operates on the destination.
+func (t *CreateProjectFromTemplate) resumeDestination(ctx context.Context, owner, name string) (createProjectResult, string, error) {
+	repo, err := t.c.GetRepo(ctx, owner, name)
 	if err != nil {
-		result.PartialFailure = fmt.Sprintf("tree walk (%s@%s): %v", args.Name, branch, err)
-		return textOK(result)
+		if errors.Is(err, gitea.ErrNotFound) {
+			return createProjectResult{}, "", fmt.Errorf(
+				"resume:true but %s/%s does not exist — nothing to resume; omit resume to create it: %w",
+				owner, name, gitea.ErrValidation)
+		}
+		return createProjectResult{}, "", fmt.Errorf("resume destination check: %w", err)
+	}
+	branch := repo.DefaultBranch
+	if branch == "" {
+		branch = "main"
+	}
+	return createProjectResult{
+		FullName:      repo.FullName,
+		HTMLURL:       repo.HTMLURL,
+		CloneURL:      repo.CloneURL,
+		DefaultBranch: branch,
+	}, branch, nil
+}
+
+// injectDispatchAllow makes .dispatch-allow's presence idempotent (safe to call
+// on every resume, not just the first attempt): creates it if absent, updates
+// it if present but different, leaves it untouched if already correct. Without
+// this, a naive create-only write would error on a re-invoke (gitea rejects a
+// create at a path that already exists) — that was the reported failure in
+// gitea-mcp#51. Returns whether a write actually happened.
+func (t *CreateProjectFromTemplate) injectDispatchAllow(ctx context.Context, owner, name, branch string) (didWrite bool, failure string) {
+	const path = ".dispatch-allow"
+	sha := ""
+	if fc, err := t.c.GetFileContents(ctx, owner, name, path, branch); err == nil {
+		if decoded, derr := base64.StdEncoding.DecodeString(fc.Content); derr == nil && string(decoded) == dispatchAllowContent {
+			return false, "" // already present and correct — idempotent no-op
+		}
+		sha = fc.Sha // exists but differs (unexpected) — update it, don't blind-create
+	} else if !errors.Is(err, gitea.ErrNotFound) {
+		return false, fmt.Sprintf("read %s: %v", path, err)
 	}
 
-	for _, e := range tree.Tree {
-		if e.Type != "blob" {
-			continue
-		}
-		substituted, fail := t.substituteEntry(ctx, args.Owner, args.Name, branch, e.Path, repls)
-		if fail != "" {
-			result.PartialFailure = fail
-			break
-		}
-		if substituted != "" {
-			result.FilesSubstituted = append(result.FilesSubstituted, substituted)
+	if err := t.upsertRetry(ctx, owner, name, path, gitea.UpsertFileArgs{
+		Branch:  branch,
+		Content: base64.StdEncoding.EncodeToString([]byte(dispatchAllowContent)),
+		Message: "dispatch: mark project dispatch-eligible (dispatch#3)",
+		Sha:     sha,
+	}); err != nil {
+		return false, fmt.Sprintf("write %s: %v", path, err)
+	}
+	return true, ""
+}
+
+// registerDispatchAllowlist appends ownerName ("owner/name") to
+// mathias/dispatch's git-tracked dispatch-repos.txt if not already listed
+// (gitea-mcp#54) — idempotent, safe to call on every resume. This is the
+// SECOND of the two required dispatch gates: being listed here is necessary
+// but not sufficient on its own (the repo also needs its own .dispatch-allow
+// marker, injectDispatchAllow's job) — dispatch#3's structural trust-zone
+// design requires both independently. Returns whether a write actually
+// happened, so the caller only reports a fresh registration, not a no-op.
+func (t *CreateProjectFromTemplate) registerDispatchAllowlist(ctx context.Context, ownerName string) (didRegister bool, failure string) {
+	fc, err := t.c.GetFileContents(ctx, dispatchAllowlistOwner, dispatchAllowlistRepo, dispatchAllowlistPath, dispatchAllowlistBranch)
+	if err != nil {
+		return false, fmt.Sprintf("read %s/%s:%s: %v", dispatchAllowlistOwner, dispatchAllowlistRepo, dispatchAllowlistPath, err)
+	}
+	decoded, err := base64.StdEncoding.DecodeString(fc.Content)
+	if err != nil {
+		return false, fmt.Sprintf("decode %s: %v", dispatchAllowlistPath, err)
+	}
+	content := string(decoded)
+	for _, line := range strings.Split(content, "\n") {
+		if strings.TrimSpace(line) == ownerName {
+			return false, "" // already listed — idempotent no-op
 		}
 	}
 
-	// Opt the new project into headless dispatch if asked: presence of a
-	// .dispatch-allow file on the default branch marks it dispatch-eligible
-	// (dispatch#3). Ride the same upsertRetry path as substitution so it inherits
-	// the infra#179 branch-readiness / partial-failure handling below. Skip if the
-	// loop already stalled — a failed injection then degrades identically.
-	if args.DispatchAllow && result.PartialFailure == "" {
-		const dispatchAllowPath = ".dispatch-allow"
-		if err := t.upsertRetry(ctx, args.Owner, args.Name, dispatchAllowPath, gitea.UpsertFileArgs{
-			Branch:  branch,
-			Content: base64.StdEncoding.EncodeToString([]byte(dispatchAllowContent)),
-			Message: "dispatch: mark project dispatch-eligible (dispatch#3)",
-		}); err != nil {
-			result.PartialFailure = fmt.Sprintf("write %s: %v", dispatchAllowPath, err)
-		} else {
-			result.FilesSubstituted = append(result.FilesSubstituted, dispatchAllowPath)
-		}
+	newContent := strings.TrimRight(content, "\n") + "\n" + ownerName + "\n"
+	if _, err := t.c.UpsertFile(ctx, dispatchAllowlistOwner, dispatchAllowlistRepo, dispatchAllowlistPath, gitea.UpsertFileArgs{
+		Branch:  dispatchAllowlistBranch,
+		Content: base64.StdEncoding.EncodeToString([]byte(newContent)),
+		Message: fmt.Sprintf("chore(allowlist): opt in %s for headless dispatch", ownerName),
+		Sha:     fc.Sha,
+	}); err != nil {
+		return false, fmt.Sprintf("append to %s/%s:%s: %v", dispatchAllowlistOwner, dispatchAllowlistRepo, dispatchAllowlistPath, err)
 	}
-
-	// If substitution stalled because the generated branch wasn't writable in time,
-	// the repo IS created — say so clearly and point to the local finalize step,
-	// rather than leaking the raw "branch does not exist" (infra#179: gitea's
-	// template-generate is slow-async on this instance, so tool-side substitution
-	// is best-effort).
-	if strings.Contains(result.PartialFailure, "branch does not exist") ||
-		strings.Contains(result.PartialFailure, "not found") {
-		result.PartialFailure = infra179FinalizeMessage(
-			branch, substitutionBudget, len(result.FilesSubstituted), result.PartialFailure)
-	}
-
-	// Fail loud: a scaffold that still holds placeholders does not build. Nothing
-	// substituted (with no explicit failure) means the walk found no placeholders —
-	// suspicious for a real template. Surface it instead of returning silent success.
-	if result.PartialFailure == "" && len(result.FilesSubstituted) == 0 {
-		result.PartialFailure = fmt.Sprintf("no placeholders substituted in %s@%s — verify the scaffold is not left templated", args.Name, branch)
-	}
-
-	return textOK(result)
+	return true, ""
 }
 
 // infra179FinalizeMessage explains the best-effort outcome when gitea's slow
 // async template-generate (infra#179) leaves the branch unwritable within the
-// budget. It names the concrete remaining work — substituting the two
-// placeholders — rather than pointing at a specific tool, so the guidance stays
-// correct regardless of scaffolding-CLI state (gitea-mcp#46).
+// budget. It points at the concrete recovery step — re-invoking this same tool
+// with resume=true (gitea-mcp#50) — rather than a manual clone/sed/push, since
+// resume safely continues from wherever substitution stalled.
 func infra179FinalizeMessage(branch string, budget, done int, underlying string) string {
 	return fmt.Sprintf(
 		"repo created, but its branch (%s) was not writable within %ds — gitea's "+
 			"template-generate is slow-async on this instance (infra#179), so substitution "+
-			"is incomplete (%d file(s) done). Finish it by cloning the repo and replacing the "+
-			"remaining __PROJECT_NAME__ / __MODULE_PATH__ placeholders (in file contents and "+
-			"paths), then pushing; or retry create once the branch settles. Underlying: %s",
+			"is incomplete (%d file(s) done). Retry by calling this tool again with resume=true "+
+			"(same owner/name) once the branch is writable — it safely continues where this left "+
+			"off, skipping anything already correct. Underlying: %s",
 		branch, budget, done, underlying)
 }
 
@@ -243,7 +378,8 @@ func infra179FinalizeMessage(branch string, budget, done int, underlying string)
 // before the branch ref is committed, so writes 404 "branch does not exist" for a
 // window. We keep the budget SHORT so the MCP call stays responsive: a healthy
 // gitea commits in ~1s and this catches it; a slow one (infra#179, observed >40s)
-// fails fast and we defer substitution with clear guidance rather than hang.
+// fails fast with partial_failure naming resume=true as the recovery path
+// (gitea-mcp#50), rather than blocking the call for a minute-plus.
 const substitutionBudget = 5
 
 // upsertRetry retries UpsertFile on the transient post-generate "branch does not
@@ -294,21 +430,7 @@ func (t *CreateProjectFromTemplate) substituteEntry(ctx context.Context, owner,
 	enc := base64.StdEncoding.EncodeToString([]byte(newContent))
 
 	if renamed {
-		if err := t.upsertRetry(ctx, owner, name, newPath, gitea.UpsertFileArgs{
-			Branch:  branch,
-			Content: enc,
-			Message: fmt.Sprintf("template: substitute + rename %s -> %s", path, newPath),
-		}); err != nil {
-			return "", fmt.Sprintf("write %s: %v", newPath, err)
-		}
-		if _, err := t.c.DeleteFile(ctx, owner, name, path, gitea.DeleteFileArgs{
-			Branch:  branch,
-			Sha:     fc.Sha,
-			Message: fmt.Sprintf("template: drop placeholder path %s", path),
-		}); err != nil {
-			return "", fmt.Sprintf("delete %s: %v", path, err)
-		}
-		return path + " -> " + newPath, ""
+		return t.renameEntry(ctx, owner, name, branch, path, newPath, enc, newContent, fc.Sha)
 	}
 
 	if err := t.upsertRetry(ctx, owner, name, path, gitea.UpsertFileArgs{
@@ -321,3 +443,45 @@ func (t *CreateProjectFromTemplate) substituteEntry(ctx context.Context, owner,
 	}
 	return path, ""
 }
+
+// renameEntry writes newPath then deletes oldPath. Both halves are idempotent
+// so a resume that hits a prior write-succeeded/delete-failed rename (the two
+// are separate, non-atomic API calls) completes cleanly instead of erroring on
+// a blind re-create at a path that already exists (gitea-mcp#53): if newPath
+// already holds the correct content, the write is skipped and only the
+// outstanding delete of oldPath runs; if oldPath is already gone, the delete
+// is a no-op too.
+func (t *CreateProjectFromTemplate) renameEntry(ctx context.Context, owner, name, branch, oldPath, newPath, enc, newContent, oldSha string) (substituted, failure string) {
+	existing, err := t.c.GetFileContents(ctx, owner, name, newPath, branch)
+	switch {
+	case err == nil:
+		decoded, derr := base64.StdEncoding.DecodeString(existing.Content)
+		if derr == nil && string(decoded) == newContent {
+			break // already correct from a prior partial run — skip the write
+		}
+		if writeErr := t.upsertRetry(ctx, owner, name, newPath, gitea.UpsertFileArgs{
+			Branch: branch, Content: enc, Sha: existing.Sha,
+			Message: fmt.Sprintf("template: substitute + rename %s -> %s", oldPath, newPath),
+		}); writeErr != nil {
+			return "", fmt.Sprintf("write %s: %v", newPath, writeErr)
+		}
+	case errors.Is(err, gitea.ErrNotFound):
+		if writeErr := t.upsertRetry(ctx, owner, name, newPath, gitea.UpsertFileArgs{
+			Branch: branch, Content: enc,
+			Message: fmt.Sprintf("template: substitute + rename %s -> %s", oldPath, newPath),
+		}); writeErr != nil {
+			return "", fmt.Sprintf("write %s: %v", newPath, writeErr)
+		}
+	default:
+		return "", fmt.Sprintf("read %s: %v", newPath, err)
+	}
+
+	if _, err := t.c.DeleteFile(ctx, owner, name, oldPath, gitea.DeleteFileArgs{
+		Branch:  branch,
+		Sha:     oldSha,
+		Message: fmt.Sprintf("template: drop placeholder path %s", oldPath),
+	}); err != nil && !errors.Is(err, gitea.ErrNotFound) {
+		return "", fmt.Sprintf("delete %s: %v", oldPath, err)
+	}
+	return oldPath + " -> " + newPath, ""
+}

internal/tools/create_project_from_template_test.go

@@ -29,20 +29,36 @@ func templateRepoJSON(name string, isTemplate bool) string {
 // fakeTemplateServer serves the whole create-from-template flow off an in-memory
 // file map, driving the tool's tree-walk. Records writes/deletes/put-bodies.
 type fakeTemplateServer struct {
-	mu           sync.Mutex
-	files        map[string]string // path -> raw (un-substituted) content
-	genBranch    string            // default_branch returned by /generate ("" to force fallback)
-	generated    bool
-	puts         []string
-	deletes      []string
-	putBodies    map[string]string // path -> decoded written content
-	repoGetsPost int               // GET dest after generate (branch fallback)
+	mu            sync.Mutex
+	files         map[string]string // path -> raw (un-substituted) content
+	genBranch     string            // default_branch returned by /generate ("" to force fallback)
+	generated     bool
+	generateCalls int // # times POST .../generate was hit — resume must never increment this
+	puts          []string
+	deletes       []string
+	putBodies     map[string]string // path -> decoded written content
+	repoGetsPost  int               // GET dest after generate (branch fallback)
+
+	// dispatchRepos simulates mathias/dispatch:dispatch-repos.txt (gitea-mcp#54).
+	// "" (default) 404s the read, matching a repo that hasn't seeded the file
+	// (a distinct error path); tests that care set it explicitly.
+	dispatchRepos     string
+	dispatchReposPuts int
 }
 
 func newFakeTemplateServer(files map[string]string, genBranch string) *fakeTemplateServer {
 	return &fakeTemplateServer{files: files, genBranch: genBranch, putBodies: map[string]string{}}
 }
 
+// newFakeTemplateServerResumed simulates a repo that already exists from a
+// prior (real) generate call — GET dest succeeds immediately, without a
+// /generate call first. Used for resume:true tests.
+func newFakeTemplateServerResumed(files map[string]string, genBranch string) *fakeTemplateServer {
+	f := newFakeTemplateServer(files, genBranch)
+	f.generated = true
+	return f
+}
+
 func (f *fakeTemplateServer) handler(t *testing.T, tmpl, dest string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		f.mu.Lock()
@@ -50,7 +66,28 @@ func (f *fakeTemplateServer) handler(t *testing.T, tmpl, dest string) http.Handl
 		w.Header().Set("Content-Type", "application/json")
 		p := r.URL.Path
 
+		const dispatchReposPath = "/api/v1/repos/mathias/dispatch/contents/dispatch-repos.txt"
 		switch {
+		case r.Method == http.MethodGet && p == dispatchReposPath:
+			if f.dispatchRepos == "" {
+				w.WriteHeader(http.StatusNotFound)
+				_, _ = w.Write([]byte(`{"message":"not found"}`))
+				return
+			}
+			_, _ = fmt.Fprintf(w, `{"path":"dispatch-repos.txt","sha":"repos-sha","content":%q,"encoding":"base64"}`, encb64(f.dispatchRepos))
+
+		case r.Method == http.MethodPut && p == dispatchReposPath:
+			raw, _ := io.ReadAll(r.Body)
+			var args struct {
+				Content string `json:"content"`
+			}
+			_ = json.Unmarshal(raw, &args)
+			dec, _ := base64.StdEncoding.DecodeString(args.Content)
+			f.dispatchRepos = string(dec)
+			f.dispatchReposPuts++
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"content":{"path":"dispatch-repos.txt","sha":"repos-sha2"},"commit":{"sha":"c"}}`))
+
 		case r.Method == http.MethodGet && p == "/api/v1/repos/mathias/"+tmpl:
 			_, _ = w.Write([]byte(templateRepoJSON(tmpl, true)))
 
@@ -65,6 +102,7 @@ func (f *fakeTemplateServer) handler(t *testing.T, tmpl, dest string) http.Handl
 
 		case r.Method == http.MethodPost && p == "/api/v1/repos/mathias/"+tmpl+"/generate":
 			f.generated = true
+			f.generateCalls++
 			w.WriteHeader(http.StatusCreated)
 			_, _ = fmt.Fprintf(w, `{"name":%q,"full_name":"mathias/%s","default_branch":%q,"clone_url":"http://gitea.example.com/mathias/%s.git","html_url":"http://gitea.example.com/mathias/%s","template":false}`,
 				dest, dest, f.genBranch, dest, dest)
@@ -135,10 +173,13 @@ func callTool(t *testing.T, srvURL, tmpl, argsJSON string) createOut {
 }
 
 type createOut struct {
-	FullName         string   `json:"full_name"`
-	DefaultBranch    string   `json:"default_branch"`
-	FilesSubstituted []string `json:"files_substituted"`
-	PartialFailure   string   `json:"partial_failure,omitempty"`
+	FullName                 string   `json:"full_name"`
+	DefaultBranch            string   `json:"default_branch"`
+	FilesSubstituted         []string `json:"files_substituted"`
+	PartialFailure           string   `json:"partial_failure,omitempty"`
+	DispatchAllowFailure     string   `json:"dispatch_allow_failure,omitempty"`
+	DispatchAllowlisted      bool     `json:"dispatch_allowlisted,omitempty"`
+	DispatchAllowlistFailure string   `json:"dispatch_allowlist_failure,omitempty"`
 }
 
 // Happy path: whole-tree substitution, content + path rename, correct module host.
@@ -258,6 +299,229 @@ func TestCreateProject_DispatchAllow(t *testing.T) {
 	}
 }
 
+// ── resume: durable substitution against infra#179 (gitea-mcp#50) ───────────
+
+// resume:true requires an ALREADY-CREATED destination — there is nothing to
+// resume otherwise.
+func TestCreateProject_Resume_NoDestination_Errors(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte(`{"message":"not found"}`))
+	}))
+	defer srv.Close()
+
+	_, err := newTool(srv.URL, "template-go-agent").Call(context.Background(),
+		json.RawMessage(`{"owner":"mathias","name":"new-svc","resume":true}`))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, gitea.ErrValidation)
+	assert.Contains(t, err.Error(), "nothing to resume")
+}
+
+// resume:true on an existing repo continues substitution — fixes only what's
+// still wrong, leaves already-correct files untouched, and never calls
+// /generate again (the whole point: no re-creation, just continuation).
+func TestCreateProject_Resume_ContinuesPartialSubstitution(t *testing.T) {
+	files := map[string]string{
+		"go.mod":    "module git.d-ma.be/mathias/new-svc\n", // already correct from a prior partial run
+		"README.md": "# __PROJECT_NAME__\n",                 // still needs substitution
+	}
+	f := newFakeTemplateServerResumed(files, "main")
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","resume":true}`)
+
+	assert.Empty(t, out.PartialFailure)
+	assert.Equal(t, 0, f.generateCalls, "resume must never call /generate")
+	assert.Contains(t, out.FilesSubstituted, "README.md")
+	assert.NotContains(t, out.FilesSubstituted, "go.mod", "already-correct file must not be re-reported")
+	assert.NotContains(t, f.puts, "go.mod", "already-correct file must not be rewritten")
+	assert.Contains(t, f.puts, "README.md")
+}
+
+// resume:true when everything is already substituted is the expected steady
+// state (a prior resume already finished the job, or this is a redundant
+// re-invoke) — success, NOT the "no placeholders substituted" loud failure
+// that a fresh (non-resume) create would trigger.
+func TestCreateProject_Resume_AlreadyFullyDone_IsSuccess(t *testing.T) {
+	files := map[string]string{
+		"go.mod":    "module git.d-ma.be/mathias/new-svc\n",
+		"README.md": "# new-svc\n",
+	}
+	f := newFakeTemplateServerResumed(files, "main")
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","resume":true}`)
+
+	assert.Empty(t, out.FilesSubstituted)
+	assert.Empty(t, out.PartialFailure, "nothing left to do on resume must be success, not a loud failure")
+}
+
+// A resume where a prior partial run's rename write SUCCEEDED but its paired
+// delete FAILED (both are separate, non-atomic API calls) must complete
+// cleanly: recognize the new path is already correct, skip re-writing it, and
+// just finish the outstanding delete of the stray old path (gitea-mcp#53).
+func TestCreateProject_Resume_StrayRenamedOldPath_CompletesCleanly(t *testing.T) {
+	files := map[string]string{
+		// stray: delete never completed in the prior run
+		"cmd/__PROJECT_NAME__/main.go": "package main\nimport \"__MODULE_PATH__/pkg/litellm\"\nconst n = \"__PROJECT_NAME__\"\n",
+		// already correct: the write half of the same prior rename DID complete
+		"cmd/new-svc/main.go": "package main\nimport \"git.d-ma.be/mathias/new-svc/pkg/litellm\"\nconst n = \"new-svc\"\n",
+	}
+	f := newFakeTemplateServerResumed(files, "main")
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","resume":true}`)
+
+	assert.Empty(t, out.PartialFailure)
+	assert.Contains(t, out.FilesSubstituted, "cmd/__PROJECT_NAME__/main.go -> cmd/new-svc/main.go")
+	assert.NotContains(t, f.puts, "cmd/new-svc/main.go", "already-correct new path must not be rewritten")
+	assert.Contains(t, f.deletes, "cmd/__PROJECT_NAME__/main.go", "the outstanding delete must still happen")
+}
+
+// dispatch_allow injection is idempotent on resume: if .dispatch-allow already
+// has the correct content (from an earlier successful injection), re-invoking
+// must not attempt another write — and must not error the way a naive
+// create-only write would (gitea 409/422 on an existing path with no sha).
+func TestCreateProject_Resume_DispatchAllowIdempotent(t *testing.T) {
+	// Phase 1: a normal (non-resume) call captures the REAL content the tool
+	// writes for .dispatch-allow, without the test needing to know the exact
+	// unexported constant.
+	seedFiles := map[string]string{"go.mod": "module __MODULE_PATH__\n"}
+	seedSrv := newFakeTemplateServer(seedFiles, "main")
+	srv1 := httptest.NewServer(seedSrv.handler(t, "template-go-agent", "new-svc"))
+	out1 := callTool(t, srv1.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","dispatch_allow":true}`)
+	srv1.Close()
+	require.Empty(t, out1.PartialFailure)
+	realContent := seedSrv.putBodies[".dispatch-allow"]
+	require.NotEmpty(t, realContent, "phase 1 must have written .dispatch-allow")
+
+	// Phase 2: resume with .dispatch-allow ALREADY at that exact content, plus
+	// one file still needing substitution.
+	files := map[string]string{
+		".dispatch-allow": realContent,
+		"README.md":       "# __PROJECT_NAME__\n",
+	}
+	f := newFakeTemplateServerResumed(files, "main")
+	srv2 := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv2.Close()
+
+	out2 := callTool(t, srv2.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","resume":true,"dispatch_allow":true}`)
+
+	assert.Empty(t, out2.PartialFailure)
+	assert.Empty(t, out2.DispatchAllowFailure)
+	assert.NotContains(t, f.puts, ".dispatch-allow", "already-correct .dispatch-allow must not be rewritten")
+	assert.NotContains(t, out2.FilesSubstituted, ".dispatch-allow", "unchanged file must not be reported as substituted")
+	assert.Contains(t, out2.FilesSubstituted, "README.md")
+}
+
+// dispatch_allow injection failing is reported in its OWN field, distinct from
+// PartialFailure (gitea-mcp#51) — substitution can succeed while dispatch
+// eligibility still fails, and the caller must be able to tell them apart.
+func TestCreateProject_DispatchAllowFailure_IsDistinctField(t *testing.T) {
+	files := map[string]string{"go.mod": "module __MODULE_PATH__\n"}
+	f := newFakeTemplateServer(files, "main")
+	base := f.handler(t, "template-go-agent", "new-svc")
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.Contains(r.URL.Path, "/contents/.dispatch-allow") {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"message":"boom"}`))
+			return
+		}
+		base(w, r)
+	}))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","dispatch_allow":true}`)
+
+	assert.Empty(t, out.PartialFailure, "substitution itself succeeded — must not be conflated with the dispatch failure")
+	assert.NotEmpty(t, out.DispatchAllowFailure)
+	assert.Contains(t, out.DispatchAllowFailure, ".dispatch-allow")
+	assert.Contains(t, out.FilesSubstituted, "go.mod", "substitution must still be reported despite the separate dispatch failure")
+}
+
+// dispatch_allow now ALSO registers the new repo into mathias/dispatch's
+// git-tracked allowlist (dispatch-repos.txt) — the second of the two required
+// dispatch gates, independent of the .dispatch-allow marker (gitea-mcp#54).
+func TestCreateProject_DispatchAllow_RegistersAllowlist(t *testing.T) {
+	files := map[string]string{"go.mod": "module __MODULE_PATH__\n"}
+	f := newFakeTemplateServer(files, "main")
+	f.dispatchRepos = "# comment\nmathias/dispatch-sandbox\nmathias/cobalt-dingo\n"
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","dispatch_allow":true}`)
+
+	assert.Empty(t, out.PartialFailure)
+	assert.Empty(t, out.DispatchAllowlistFailure)
+	assert.True(t, out.DispatchAllowlisted)
+	assert.Equal(t, 1, f.dispatchReposPuts)
+	assert.Contains(t, f.dispatchRepos, "mathias/new-svc")
+	// existing entries preserved, not clobbered
+	assert.Contains(t, f.dispatchRepos, "mathias/dispatch-sandbox")
+	assert.Contains(t, f.dispatchRepos, "mathias/cobalt-dingo")
+}
+
+// Registering is idempotent: a repo already listed (e.g. a resume re-running
+// with dispatch_allow:true) must not produce a duplicate line or a redundant write.
+func TestCreateProject_DispatchAllow_RegistersAllowlist_AlreadyListedIsNoop(t *testing.T) {
+	files := map[string]string{"go.mod": "module git.d-ma.be/mathias/new-svc\n"} // already substituted
+	f := newFakeTemplateServerResumed(files, "main")
+	f.dispatchRepos = "mathias/dispatch-sandbox\nmathias/new-svc\n"
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","resume":true,"dispatch_allow":true}`)
+
+	assert.Empty(t, out.PartialFailure)
+	assert.Empty(t, out.DispatchAllowlistFailure)
+	assert.False(t, out.DispatchAllowlisted, "already-listed must not be reported as a fresh registration")
+	assert.Equal(t, 0, f.dispatchReposPuts, "already-listed repo must not trigger a write")
+}
+
+// A failure registering the allowlist is reported in its OWN field — distinct
+// from PartialFailure (substitution) AND DispatchAllowFailure (the marker
+// file) — since all three are independent gates that can fail independently.
+func TestCreateProject_DispatchAllowlistFailure_IsDistinctField(t *testing.T) {
+	files := map[string]string{"go.mod": "module __MODULE_PATH__\n"}
+	f := newFakeTemplateServer(files, "main")
+	f.dispatchRepos = "mathias/dispatch-sandbox\n"
+	base := f.handler(t, "template-go-agent", "new-svc")
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPut && r.URL.Path == "/api/v1/repos/mathias/dispatch/contents/dispatch-repos.txt" {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"message":"boom"}`))
+			return
+		}
+		base(w, r)
+	}))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc","dispatch_allow":true}`)
+
+	assert.Empty(t, out.PartialFailure, "substitution succeeded — must not be conflated")
+	assert.Empty(t, out.DispatchAllowFailure, ".dispatch-allow marker succeeded — must not be conflated")
+	assert.NotEmpty(t, out.DispatchAllowlistFailure)
+	assert.Contains(t, out.DispatchAllowlistFailure, "dispatch-repos.txt")
+	assert.Contains(t, out.FilesSubstituted, "go.mod", "substitution must still be reported despite the separate allowlist failure")
+}
+
+// dispatch_allow=false/omitted must never touch the allowlist file at all.
+func TestCreateProject_DispatchAllowFalse_DoesNotTouchAllowlist(t *testing.T) {
+	files := map[string]string{"go.mod": "module __MODULE_PATH__\n"}
+	f := newFakeTemplateServer(files, "main")
+	srv := httptest.NewServer(f.handler(t, "template-go-agent", "new-svc"))
+	defer srv.Close()
+
+	out := callTool(t, srv.URL, "template-go-agent", `{"owner":"mathias","name":"new-svc"}`)
+
+	assert.Empty(t, out.PartialFailure)
+	assert.False(t, out.DispatchAllowlisted)
+	assert.Equal(t, 0, f.dispatchReposPuts)
+}
+
 // ── guardrails unchanged by the rewrite ──────────────────────────────────────
 
 func TestCreateProject_NameRegexFailure(t *testing.T) {

internal/tools/create_project_internal_test.go

@@ -6,12 +6,13 @@ import (
 )
 
 // #46: the infra#179 finalize guidance must not point at a non-existent command
-// (`hyperguild new-project` was never built). It should name the real remaining
-// work — substituting the placeholders — so the caller isn't sent to a dead end.
+// (`hyperguild new-project` was never built). #50 superseded the original
+// manual-editing guidance with a concrete, real recovery: re-invoke this same
+// tool with resume=true.
 func TestInfra179FinalizeMessage(t *testing.T) {
 	msg := infra179FinalizeMessage("main", 5, 2, "branch does not exist")
 
-	for _, want := range []string{"infra#179", "__PROJECT_NAME__", "__MODULE_PATH__", "branch does not exist"} {
+	for _, want := range []string{"infra#179", "resume=true", "branch does not exist"} {
 		if !strings.Contains(msg, want) {
 			t.Errorf("message missing %q\ngot: %s", want, msg)
 		}

internal/tools/issue_label.go

@@ -0,0 +1,87 @@
+package tools
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
+	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
+	"git.d-ma.be/mathias/gitea-mcp/internal/registry"
+)
+
+type IssueLabel struct {
+	c *gitea.Client
+	a *allowlist.Allowlist
+}
+
+func NewIssueLabel(c *gitea.Client, a *allowlist.Allowlist) *IssueLabel {
+	return &IssueLabel{c: c, a: a}
+}
+
+func (t *IssueLabel) Descriptor() registry.ToolDescriptor {
+	return registry.ToolDescriptor{
+		Name:        "issue_label",
+		Description: "Add labels to an issue or pull request. Resolves label names to IDs via the repo's label list. Additive — existing labels are left in place.",
+		InputSchema: json.RawMessage(`{
+			"type":"object",
+			"properties":{
+				"owner":{"type":"string"},
+				"repo":{"type":"string"},
+				"number":{"type":"integer","minimum":1},
+				"labels":{"type":"array","items":{"type":"string"},"description":"Label names to resolve and apply. Either labels or label_ids is required."},
+				"label_ids":{"type":"array","items":{"type":"integer"},"description":"Label IDs to apply directly, skipping name resolution. Either labels or label_ids is required."}
+			},
+			"required":["owner","repo","number"]
+		}`),
+	}
+}
+
+type issueLabelArgs struct {
+	Owner    string   `json:"owner"`
+	Repo     string   `json:"repo"`
+	Number   int      `json:"number"`
+	Labels   []string `json:"labels,omitempty"`
+	LabelIDs []int64  `json:"label_ids,omitempty"`
+}
+
+func (t *IssueLabel) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, error) {
+	var args issueLabelArgs
+	if err := parseArgs(raw, &args); err != nil {
+		return nil, err
+	}
+	if err := t.a.Check(args.Owner); err != nil {
+		return nil, err
+	}
+	if args.Number < 1 {
+		return nil, fmt.Errorf("number must be >= 1: %w", gitea.ErrValidation)
+	}
+	if len(args.Labels) == 0 && len(args.LabelIDs) == 0 {
+		return nil, fmt.Errorf("labels is required: %w", gitea.ErrValidation)
+	}
+
+	ids := append([]int64{}, args.LabelIDs...)
+	if len(args.Labels) > 0 {
+		existing, err := t.c.ListLabels(ctx, args.Owner, args.Repo)
+		if err != nil {
+			return nil, err
+		}
+		byName := make(map[string]int64, len(existing))
+		for _, l := range existing {
+			byName[l.Name] = l.ID
+		}
+		for _, name := range args.Labels {
+			id, ok := byName[name]
+			if !ok {
+				return nil, fmt.Errorf("label %q not found in %s/%s: %w", name, args.Owner, args.Repo, gitea.ErrValidation)
+			}
+			ids = append(ids, id)
+		}
+	}
+
+	labels, err := t.c.AddIssueLabels(ctx, args.Owner, args.Repo, args.Number, ids)
+	if err != nil {
+		return nil, err
+	}
+	return textOK(labels)
+}

internal/tools/issue_label_test.go

@@ -0,0 +1,128 @@
+package tools_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
+	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
+	"git.d-ma.be/mathias/gitea-mcp/internal/tools"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const labelListFixture = `[
+	{"id":1,"name":"bug","color":"ee0701"},
+	{"id":2,"name":"enhancement","color":"84b6eb"}
+]`
+
+func TestIssueLabelAppliesByName(t *testing.T) {
+	var captured []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/repos/o/r/labels":
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(labelListFixture))
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/repos/o/r/issues/42/labels":
+			var err error
+			captured, err = io.ReadAll(r.Body)
+			require.NoError(t, err)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(labelListFixture))
+		default:
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	tool := tools.NewIssueLabel(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"o"}))
+	out, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"o","repo":"r","number":42,"labels":["bug","enhancement"]}`))
+	require.NoError(t, err)
+
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal(captured, &payload))
+	ids, ok := payload["labels"].([]any)
+	require.True(t, ok)
+	assert.ElementsMatch(t, []any{float64(1), float64(2)}, ids)
+
+	assert.Contains(t, string(out), `"name":"bug"`)
+	assert.Contains(t, string(out), `"name":"enhancement"`)
+}
+
+// label_ids alone (no labels) must work end-to-end without hitting ListLabels
+// at all — this is the schema-level "either labels or label_ids" contract, and
+// it must never require a GET to the label list when the caller already has IDs.
+func TestIssueLabelAppliesByIDOnly(t *testing.T) {
+	var captured []byte
+	var listCalled bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/repos/o/r/labels":
+			listCalled = true
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(labelListFixture))
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/repos/o/r/issues/42/labels":
+			var err error
+			captured, err = io.ReadAll(r.Body)
+			require.NoError(t, err)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(labelListFixture))
+		default:
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	tool := tools.NewIssueLabel(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"o"}))
+	out, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"o","repo":"r","number":42,"label_ids":[1,2]}`))
+	require.NoError(t, err)
+
+	assert.False(t, listCalled, "label_ids-only must not call ListLabels")
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal(captured, &payload))
+	ids, ok := payload["labels"].([]any)
+	require.True(t, ok)
+	assert.ElementsMatch(t, []any{float64(1), float64(2)}, ids)
+	assert.Contains(t, string(out), `"name":"bug"`)
+}
+
+// #52 review finding: the advertised schema wrongly required "labels", making
+// label_ids-only calls fail JSON-Schema validation before reaching Call at all.
+// Lock the fixed contract: neither is individually required.
+func TestIssueLabelSchema_NeitherLabelsNorLabelIDsRequired(t *testing.T) {
+	sch := string(tools.NewIssueLabel(gitea.NewClient("http://unused", ""), allowlist.New([]string{"o"})).Descriptor().InputSchema)
+	assert.NotContains(t, sch, `"required":["owner","repo","number","labels"]`)
+	assert.Contains(t, sch, `"required":["owner","repo","number"]`)
+}
+
+func TestIssueLabelUnknownNameNamesTheMissingLabel(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(labelListFixture))
+	}))
+	defer srv.Close()
+
+	tool := tools.NewIssueLabel(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"o"}))
+	_, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"o","repo":"r","number":42,"labels":["bug","does-not-exist"]}`))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, gitea.ErrValidation)
+	assert.Contains(t, err.Error(), `"does-not-exist"`)
+	assert.Contains(t, err.Error(), "o/r")
+}
+
+func TestIssueLabelAllowlistRejects(t *testing.T) {
+	tool := tools.NewIssueLabel(gitea.NewClient("http://unused", ""), allowlist.New([]string{"allowed"}))
+	_, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"evil","repo":"r","number":1,"labels":["bug"]}`))
+	require.Error(t, err)
+}
+
+func TestIssueLabelRequiresValidNumber(t *testing.T) {
+	tool := tools.NewIssueLabel(gitea.NewClient("http://unused", ""), allowlist.New([]string{"o"}))
+	_, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"o","repo":"r","number":0,"labels":["bug"]}`))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, gitea.ErrValidation)
+}

internal/tools/label_list.go

@@ -0,0 +1,54 @@
+package tools
+
+import (
+	"context"
+	"encoding/json"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
+	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
+	"git.d-ma.be/mathias/gitea-mcp/internal/registry"
+)
+
+type LabelList struct {
+	c *gitea.Client
+	a *allowlist.Allowlist
+}
+
+func NewLabelList(c *gitea.Client, a *allowlist.Allowlist) *LabelList {
+	return &LabelList{c: c, a: a}
+}
+
+func (t *LabelList) Descriptor() registry.ToolDescriptor {
+	return registry.ToolDescriptor{
+		Name:        "label_list",
+		Description: "List all labels defined on a repo. Returns id, name, and color for each label.",
+		InputSchema: json.RawMessage(`{
+			"type":"object",
+			"properties":{
+				"owner":{"type":"string"},
+				"repo":{"type":"string"}
+			},
+			"required":["owner","repo"]
+		}`),
+	}
+}
+
+type labelListArgs struct {
+	Owner string `json:"owner"`
+	Repo  string `json:"repo"`
+}
+
+func (t *LabelList) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, error) {
+	var args labelListArgs
+	if err := parseArgs(raw, &args); err != nil {
+		return nil, err
+	}
+	if err := t.a.Check(args.Owner); err != nil {
+		return nil, err
+	}
+	labels, err := t.c.ListLabels(ctx, args.Owner, args.Repo)
+	if err != nil {
+		return nil, err
+	}
+	return textOK(labels)
+}

internal/tools/label_list_test.go

@@ -0,0 +1,42 @@
+package tools_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
+	"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
+	"git.d-ma.be/mathias/gitea-mcp/internal/tools"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLabelListTool(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/api/v1/repos/mathias/infra/labels", r.URL.Path)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[
+			{"id":1,"name":"bug","color":"ee0701"},
+			{"id":2,"name":"enhancement","color":"84b6eb"}
+		]`))
+	}))
+	defer srv.Close()
+
+	tool := tools.NewLabelList(gitea.NewClient(srv.URL, "tok"), allowlist.New([]string{"mathias"}))
+	out, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"mathias","repo":"infra"}`))
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `"id":1`)
+	assert.Contains(t, string(out), `"name":"bug"`)
+	assert.Contains(t, string(out), `"color":"ee0701"`)
+	assert.Contains(t, string(out), `"name":"enhancement"`)
+}
+
+func TestLabelListAllowlistRejects(t *testing.T) {
+	tool := tools.NewLabelList(gitea.NewClient("http://unused", ""), allowlist.New([]string{"mathias"}))
+	_, err := tool.Call(context.Background(), json.RawMessage(`{"owner":"evil","repo":"x"}`))
+	require.Error(t, err)
+}

internal/tools/registry.go

@@ -54,6 +54,8 @@ func RegisterAll(
 	reg.Register(NewIssueListComments(c, a))
 	reg.Register(NewIssueClose(c, a))
 	reg.Register(NewIssueReopen(c, a))
+	reg.Register(NewLabelList(c, a))
+	reg.Register(NewIssueLabel(c, a))
 	reg.Register(NewWorkflowRunList(c, a))
 	reg.Register(NewReleaseCreate(c, a))
 	reg.Register(NewRepoDelete(c, a))

internal/tools/registry_test.go

@@ -54,5 +54,5 @@ func TestEveryRegisteredToolIsDispatchable(t *testing.T) {
 // Lock the tool count so an accidental drop of a registration in RegisterAll
 // (the single source main.go and this test share) fails loudly.
 func TestRegisteredToolCount(t *testing.T) {
-	assert.Len(t, buildRegistry().Tools(), 39)
+	assert.Len(t, buildRegistry().Tools(), 41)
 }