mathiasandClaude Opus 5.5 ae50501ba3 fix(tools): reject case-variant arg keys and ref-shaped branch names ...

parseArgs now refuses, before any request: two keys equal under
strings.EqualFold in any object (exact duplicates included), and a
top-level key that differs from a schema field only in case. Without
this, encoding/json's case-insensitive last-wins match let
{"branch":"feat/x","Branch":"main"} write to main while a client-side
hook read feat/x.

file_write_branch (branch) and tbd_ship (branch and base) validate the
branch name: ^[A-Za-z0-9][A-Za-z0-9._/-]*$ plus no refs/ prefix, HEAD,
"..", "//", "/.", trailing "/" or ".", or ".lock". refs/heads/main
otherwise created refs/heads/refs/heads/main and wedged API writes to
main. tbd_ship's base is the protection-probe key, so a refs/-prefixed
base would also have read as unprotected.

Closes #65

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 06:58:31 +02:00

..

alias_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

branch_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

branch_protection_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

branch_protection_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

code_search_test.go

fix(code_search): replace the fantasy REST endpoint with a real client-side grep

2026-07-07 11:29:05 +02:00

code_search.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

create_project_from_template_test.go

feat(create_project): dispatch_allow also registers the repo into dispatch's allowlist (#54)

2026-07-07 00:33:39 +02:00

create_project_from_template.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

create_project_internal_test.go

feat(create_project): resume=true makes substitution durable against infra#179 (#50, #51)

2026-07-04 13:49:38 +02:00

dir_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

dir_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

file_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_read_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

file_read.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

file_write_branch_test.go

chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

2026-09-05 14:42:59 +02:00

file_write_branch.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

issue_close_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_close.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_comment_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_comment.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_edit_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_edit.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_label_test.go

fix(issue_label): schema wrongly required labels, blocking label_ids-only callers (#52 review finding)

2026-07-04 13:57:05 +02:00

issue_label.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_list_comments_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_list_comments.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

issue_reopen_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

issue_reopen.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

label_list_test.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

label_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_comment_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_comment.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_create_test.go

feat(auth): document caller header precedence + warn on conflict (#10)

2026-07-03 22:57:24 +02:00

pr_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_files_diff_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_files_diff.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

pr_merge_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

pr_merge.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

registry_test.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

registry.go

feat(labels): add label_list + issue_label tools (#52)

2026-07-04 13:44:14 +02:00

release_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

release_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_delete_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_delete.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_get_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_get.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_list_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_mirror_push_test.go

fix(repo_mirror_push): resolve mirror credential from server env, not the payload (#49)

2026-07-04 09:00:07 +02:00

repo_mirror_push.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_search_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_search.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_status_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_status.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_topics_update_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_topics_update.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_tree_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_tree.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

repo_update_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

repo_update.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

strict_args_test.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

tag_create_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

tag_create.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

tbd_ship_internal_test.go

feat(tools): add tbd_ship — CI-gated trunk-based ship (#40)

2026-07-04 00:40:02 +02:00

tbd_ship_test.go

feat(tbd_ship): idempotent re-invoke — resume existing branch/PR (#48)

2026-07-04 08:30:30 +02:00

tbd_ship.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

tool.go

fix(tools): reject case-variant arg keys and ref-shaped branch names

2026-10-05 06:58:31 +02:00

validate_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_list_test.go

style: apply gofmt

2026-09-05 12:40:34 +02:00

workflow_run_list.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

workflow_run_status_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_status.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00

workflow_run_trigger_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

workflow_run_trigger.go

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59)

2026-07-22 08:31:43 +02:00