Closed across two layers.
Already shipped in gitea-mcp (present before this pass): /healthz reports the JWT validator state — disabled (DEX_ISSUER_URL unset) / enabled / degraded…
Done — the bearer auth now lives in the shared mcp-chassis (v0.3.0), adopted by gitea-mcp v0.5.0.
BearerMiddleware emits a structured slog line on every rejection:
reason— one of…
Done in gitea-mcp v0.5.0.
CallerMiddleware (internal/auth/caller.go) now:
- Documents the precedence in a doc comment:
X-Auth-Request-User(the verified OIDC identity oauth2-proxy sets)…
Done in v0.4.2 (commit on main).
Sequencing gate was already satisfied — mcp-chassis migrated to git.d-ma.be in 3329ff3 (go.mod requires git.d-ma.be/mathias/mcp-chassis v0.2.0). So the…
Resolved as of v0.4.2 — all three friction points are closed:
- Direct-to-main write —
file_write_branchalready commits directly to any existing branch:BranchExists→true skips…
Done in v0.4.2 (commit on main).
parseArgs now validates, via reflection, that repo/name string args are non-empty and returns a typed ErrValidation naming the field — before the…
index, not the canonical number — finish the #38 flip