mathiasandClaude Opus 5.5 31a3dd3e0e fix(tools): fail closed when the key scan cannot read the input ...

PR #66 review: json.Decoder.Token() fails on a number outside float64
range (1e999), which json.Unmarshal ignores in an unknown key, so a
decoy key ended the scan and the #65 repro wrote to main. The decoder
now uses UseNumber, and any scan error is a validation error. The
duplicate check folds with strings.EqualFold (as encoding/json does)
instead of ToLower, so long s and the Kelvin sign are caught in nested
objects too.

Refs #65

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 07:02:27 +02:00

..

alias_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

branch_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

branch_protection_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_protection_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

code_search_test.go

fix(code_search): replace the fantasy REST endpoint with a real client-side grep

2026-07-07 11:29:05 +02:00

code_search.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

create_project_from_template_test.go

feat(create_project): dispatch_allow also registers the repo into dispatch's allowlist (#54)

2026-07-07 00:33:39 +02:00

create_project_from_template.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

create_project_internal_test.go

feat(create_project): resume=true makes substitution durable against infra#179 (#50, #51)

2026-07-04 13:49:38 +02:00

dir_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

dir_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

file_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_read_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

file_read.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_write_branch_test.go

chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

2026-09-05 14:42:59 +02:00

file_write_branch.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

issue_close_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_close.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_comment_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_comment.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_edit_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_edit.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_label_test.go

fix(issue_label): schema wrongly required labels, blocking label_ids-only callers (#52 review finding)

2026-07-04 13:57:05 +02:00

issue_label.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_list_comments_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_list_comments.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_reopen_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_reopen.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

label_list_test.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

label_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_comment_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_comment.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_create_test.go

feat(auth): document caller header precedence + warn on conflict (#10)

2026-07-03 22:57:24 +02:00

pr_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_files_diff_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_files_diff.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_merge_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_merge.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

registry_test.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

registry.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

release_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

release_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_mirror_push_test.go

fix(repo_mirror_push): resolve mirror credential from server env, not the payload (#49)

2026-07-04 09:00:07 +02:00

repo_mirror_push.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_search_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_search.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_status_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_status.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_topics_update_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_topics_update.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_tree_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_tree.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_update_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_update.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

strict_args_test.go

fix(tools): fail closed when the key scan cannot read the input

2026-10-05 07:02:27 +02:00

tag_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

tag_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

tbd_ship_internal_test.go

feat(tools): add tbd_ship — CI-gated trunk-based ship (#40)

2026-07-04 00:40:02 +02:00

tbd_ship_test.go

feat(tbd_ship): idempotent re-invoke — resume existing branch/PR (#48)

2026-07-04 08:30:30 +02:00

tbd_ship.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

tool.go

fix(tools): fail closed when the key scan cannot read the input

2026-10-05 07:02:27 +02:00

validate_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_list_test.go

style: apply gofmt

2026-09-05 12:40:34 +02:00

workflow_run_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

workflow_run_status_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_status.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

workflow_run_trigger_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_trigger.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00