Commitbcaa2b4unknown_key

docs(bible): lock MCP server + app-bot push-auth surfaces

docs(bible): lock MCP server + app-bot push-auth surfaces

§2.4 — adds two new ✅ rows:
  - Model Context Protocol server (move #9 from STRATEGY)
  - App-bot push auth via ghi_ install tokens (move #4)

§4.5 / §4.6 LOCKED — extends git-push-auth.ts entry to mention the
new ghi_ resolver, and adds three new locked entries:
  - src/lib/mcp.ts        (JSON-RPC router)
  - src/lib/mcp-tools.ts  (v1 read-only tool surface)
  - src/routes/mcp.ts     (HTTP transport)

§5.1 — bumps the test-count claim from 1185 → 1214.

Strictly additive, no existing entry deleted or renamed.

https://claude.ai/code/session_0163vJChUuZqqtBBznUW6xBU

Claude committed on April 30, 2026Parent: 7746dee

1 file changed+7−2bcaa2b4962209360a8a808ef7f4a915e9f9febc7

1 changed file+7−2

ModifiedBUILD_BIBLE.md+7−2View fileUnified Split

@@ -139,6 +139,8 @@ Legend: ✅ shipped · 🟡 partial · ❌ not built

139139| AI Issue triage | ✅ | 2026-04-30 — On every issue create the system fires `triggerIssueTriage` (`src/lib/issue-triage.ts`) which calls `triageIssue()` from `src/lib/ai-generators.ts`. Posts a "## AI Triage" issue comment with one-line summary, priority, suggested labels filtered against the repo's existing labels, and a "Possible duplicate of #N" callout when confidence is high. Idempotent via `ISSUE_TRIAGE_MARKER`. Suggestions only. The `triageIssue` helper was on disk but unused until 2026-04-30. |

140140| AI commit message suggestion | ✅ | 2026-04-30 — "Suggest with AI" button on the file-edit form. `POST /:owner/:repo/ai/commit-message` (write-access gated) reads the on-disk blob via `getBlob`, builds a minimal Old/New diff representation, calls `generateCommitMessage()` from `src/lib/ai-generators.ts`, caps to one line + 100 chars. The helper was on disk but unused until 2026-04-30. |

141141| Workflow secret substitution | ✅ | 2026-04-30 — `${{ secrets.NAME }}` references inside step `run:` are now substituted at execution time. Pure helper `substituteSecrets(template, secrets)` in `src/lib/workflow-secrets.ts` (strict `[A-Z_][A-Z0-9_]*` grammar; missing names left intact as a loud failure signal; uses `hasOwnProperty` to block prototype-pollution). The v1 runner (`src/lib/workflow-runner.ts`) loads the per-run secrets map once via `loadSecretsContext(repositoryId)` and passes it into every `runStep` call. Was a stub until 2026-04-30. |

142| Model Context Protocol server | ✅ | 2026-04-30 — `GET /mcp` discovery + `POST /mcp` JSON-RPC 2.0. Lets Claude Desktop / Code / Cursor drive Gluecron natively. v1 tools (read-only, public-only): `gluecron_repo_search`, `gluecron_repo_read_file`, `gluecron_repo_list_issues`, `gluecron_repo_explain_codebase`. Single + batched + notification envelopes supported. Move #9 from `docs/STRATEGY.md`. Implementation: `src/lib/mcp.ts` + `src/lib/mcp-tools.ts` + `src/routes/mcp.ts`. |

143| App-bot push auth (`ghi_` install tokens) | ✅ | 2026-04-30 — `git-receive-pack` Authorization header now resolves `ghi_*` install tokens to the synthetic `users` row that `marketplace.ts createApp` creates alongside the bot. Bots get identity for the audit log + protected-tag checks; authorisation (collaborator grants) is still separate. Legacy bots created before the back-fill landed remain anonymous. Move #4 from `docs/STRATEGY.md`. |

142144| Dependabot equivalent (AI dep bumper) | ✅ | D2 — `dep_update_runs` table, npm registry fetch, plan + apply bumps, creates `gluecron/dep-update-*` branch + PR row via git plumbing. `src/lib/dep-updater.ts`, `src/routes/dep-updater.tsx`, settings UI at `/:owner/:repo/settings/dep-updater`. |

143145| Code scanning UI | ✅ | I5 — `src/routes/code-scanning.tsx`, `GET /:owner/:repo/security`. Aggregates last-100 `gate_runs` matching `%scan%`/`%security%`, rolls up latest status per gate, shows failed/repaired/total cards + scanner status list + recent runs. |

144146| Copilot code completion | ✅ | D9 — `POST /api/copilot/completions` (PAT/OAuth/session), `GET /api/copilot/ping`. `src/lib/ai-completion.ts`, `src/routes/copilot.ts`. LRU-cached, rate-limited 60/min. |

@@ -451,7 +453,9 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

451453- `src/lib/cron.ts` — pure 5-field UNIX cron parser + matcher. Supports literals, ranges, steps (`a-b/n`, `*/n`), comma-lists, full POSIX OR semantics for dom + dow. Rejects @aliases and L/W/#/? with clear errors. Exports `parseCron`, `cronMatches`, `cronFiredBetween` (caps lookback at 1 day). Zero side effects.

452454- `src/lib/scheduled-workflows.ts` — `runScheduledWorkflowsTick(now)` scans non-disabled workflows whose parsed JSON includes `schedules`, computes `since` from the latest schedule-triggered run (fallback now-6min), enqueues at most one schedule run per workflow per tick. `MAX_RUNS_PER_TICK=50` safety cap. Pure helpers `schedulesFromParsedJson` + `firstCronToFire` exported. Wired into `src/lib/autopilot.ts` as the `scheduled-workflows` task.

453455- `src/lib/push-policy.ts` — pre-receive enforcement at the HTTP layer. Exports `evaluatePushPolicy({repositoryId, refs, pusherUserId})` returning `{allowed, violations}`; combines `matchProtectedTag` + `canBypassProtectedTag` (E7) and `evaluatePush` (J6) over the ref list. Only "active" enforcement blocks; "evaluate" enforcement remains dry-run. `formatPolicyError(violations)` builds the 403 body. Fail-open on any DB hiccup so a Postgres blip cannot wedge legitimate pushes. `ZERO_SHA` exported.

454- `src/lib/git-push-auth.ts` — Authorization-header → User resolver for `git-receive-pack`. Accepts Basic (user:secret) and Bearer schemes; secrets matching `glc_` (PAT) or `glct_` (OAuth) prefixes are looked up. Decoders `decodeBasicAuth` / `decodeBearerAuth` exported. Returns `null` on any failure → caller treats as anonymous.

456- `src/lib/git-push-auth.ts` — Authorization-header → User resolver for `git-receive-pack`. Accepts Basic (user:secret) and Bearer schemes; secrets matching `glc_` (PAT), `glct_` (OAuth), or `ghi_` (Block H2 app-bot installation token) prefixes are looked up. Decoders `decodeBasicAuth` / `decodeBearerAuth` exported. Returns `null` on any failure → caller treats as anonymous. App-bot path (2026-04-30): joins `app_install_tokens` + `app_installations` + `app_bots` and resolves to the synthetic `users` row that `marketplace.ts createApp` creates alongside the bot.

457- `src/lib/mcp.ts` (move #9 from STRATEGY) — Model Context Protocol JSON-RPC 2.0 router. `routeMcpRequest({jsonrpc, id?, method, params?}, {ctx, tools})`. Supported methods: `initialize`, `notifications/initialized`, `ping`, `tools/list`, `tools/call`. Standard JSON-RPC error codes exported (`ERR_PARSE`, `ERR_INVALID_REQUEST`, `ERR_METHOD_NOT_FOUND`, `ERR_INVALID_PARAMS`, `ERR_INTERNAL`). `McpError` class for typed throws from tool handlers. Notifications return null. Never throws.

458- `src/lib/mcp-tools.ts` (move #9) — read-only v1 tool surface: `gluecron_repo_search`, `gluecron_repo_read_file`, `gluecron_repo_list_issues`, `gluecron_repo_explain_codebase`. Public-only visibility check; private repos return `-32601 not found`. `argString` / `argNumber` helpers throw `McpError(-32602)` on missing or wrong-typed args. Default registry exposed via `defaultTools()`.

455459

456460### 4.6 Routes (locked endpoints — behaviour must be preserved)

457461- `src/routes/git.ts` — Smart HTTP (clone/push)

@@ -539,6 +543,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

539543- `src/lib/commit-statuses.ts` (Block J8) — pure helpers: `isValidSha`, `isValidState`, `sanitiseContext`, `reduceCombined`. DB helpers: `setStatus` (delete-then-insert upsert on `(repo, sha, context)`, SHA lowercased, description/url clamped to 1000/2048 chars), `listStatuses` (newest first), `combinedStatus` (latest per context, reduces to worst state, returns counts + context pills). `STATUS_STATES` exported array. Never throws on clamping; null/empty description returns null.

540544- `src/routes/commit-statuses.ts` (Block J8) — `POST /api/v1/repos/:owner/:repo/statuses/:sha` (requireAuth — accepts session/OAuth/PAT; owner-only), `GET /api/v1/repos/:owner/:repo/commits/:sha/statuses` (softAuth, private-repo visibility enforced), `GET /api/v1/repos/:owner/:repo/commits/:sha/status` (combined rollup, same visibility rules).

541545- `src/routes/api-v2.ts` — Comprehensive REST API v2 (full CRUD across resources). Authoritative integration surface alongside the v1 endpoints in this section.

546- `src/routes/mcp.ts` (move #9) — `GET /mcp` discovery (server info + tool count) + `POST /mcp` JSON-RPC 2.0 endpoint. Single requests + batched arrays both supported; notifications return 204. softAuth for the `userId` context; v1 tools are public-only so anonymous works. Mounted at root in `src/app.tsx` alongside graphql + live-events.

542547- `src/routes/api-docs.tsx` — interactive in-app API documentation page.

543548- `src/routes/collaborators.tsx` — repo collaborator add / list / remove. Owner-or-admin only. Audit-logged. (See §4.3.1.)

544549- `src/routes/team-collaborators.tsx` — bulk team-to-repo collaborator grant. (See §4.3.1.)

@@ -595,7 +600,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

595600```bash

596601bun install

597602bun dev # hot reload

598bun test # 1185 tests currently pass (8 skipped, 0 failed) as of 2026-04-30 — run `bun install` first

603bun test # 1214 tests currently pass (8 skipped, 0 failed) as of 2026-04-30 — run `bun install` first

599604bun run db:migrate

600605```

601606

602607