2 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5	5c8341c797	fix(mcp): drop the gitea server — it was a redundant, silently stale copy ... Every gitea__* call from Claude Code on koala already resolves through the claude.ai connector, not through this env-var-authenticated HTTP server. The entry was a second path to the same service that nothing actually used. That redundancy is exactly why it rotted unnoticed. GITEA_MCP_TOKEN on koala resolves ~/.op-env -> op://HomeLab/GITEA_MCP_TOKEN, an item orphaned by the 2026-07-30 consolidation that moved gitea-mcp, agentsquad-serve and crush-runner onto a single shared item in the AgentSecrets vault. The host env-file was never migrated and cannot be: koala's 1Password service account has no access to AgentSecrets, while onepassword-connect in-cluster maps both vaults. So the host copy diverged and stayed diverged for five days. The cluster was never affected — zero 401s from the pod CIDR in 30 days, every rejection came from the gateway. Deleting the divergent copy beats maintaining a second source of truth for a token this host does not need. brain stays: it authenticates, and it is genuinely used from the plugin. infra stays but is currently unreachable for an unrelated reason — infra-mcp.d-ma.be fails TLS with "unrecognized name", an SNI/cert gap at the NPM edge, tracked separately. Bump-Type: patch Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-24 17:31:11 +02:00
mathiasandClaude Opus 5	747c6c7f4c	feat(plugin): ship the secret-guard and pre-task-ritual hooks + MCP servers ... The plugin now carries the two hooks Mathias owns and the brain/gitea/infra MCP server definitions, not just skills. Why this matters more than tidiness: both hooks existed ONLY in koala's ~/.claude/, which is host-local and unsynced. flamingo and iguana have been running with no secret-guard at all — that is the control which blocks the decrypt-and-print shape behind the 2026-08-05 ntfy-token leak, the op-item-get shape behind 2026-07-30, and the base64-bypass shape behind 2026-06-11. Its absence on two of three machines is a security gap, not a config gap. Shipping it in the plugin means installing the plugin installs the guard. .mcp.json references tokens as ${BRAIN_MCP_TOKEN} / ${GITEA_MCP_TOKEN} only — env indirection, never literal values, so the manifest is safe to commit. tests/secret_guard_test.sh pins 14 cases. It asserts on hookSpecificOutput.permissionDecision, NOT exit status: the guard always exits 0 by contract, so an exit-status assertion would pass vacuously while the guard silently allowed everything. Each deny case names the incident that produced it. gsd-* hooks are deliberately NOT migrated — GSD owns and updates those in place. Bump-Type: minor Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-23 14:31:04 +02:00