Being signed in to teahub.xyz, or connected to Tea MCP in chat, is the gate,
as the operator put it. This takes out 9fece6d's browser sign-in: GET /domains
is open and bounded again (only teahub.xyz may read it, 8 searches a minute
per client and 20 in all, answers kept ten minutes), and the same search is
the tea_domains tool, behind the connector's sign-in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
/domains/sign-in and /domains/callback do Tea MCP's own Gitea OAuth (the
Green Tea MCP app) in the browser, keep only the name from Gitea, and leave a
signed, HttpOnly cookie on mcp.teahub.xyz for 30 days. GET /domains wants it
(401 with a sign-in link otherwise) and rate-limits per person. The Domains
tab sends that cookie, offers the sign-in on a 401, and runs the waiting
search on the way back. Tested end to end against a Gitea 28 and Cloudflare.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
gitea/custom: the old factory's home page and dashboard, ported to Gitea 28.
The signed-out home is Teahub = Git + Tea + Time beside the cup; the
dashboard keeps the feed and puts Domains | Repository | Organization above
the contribution heatmap. Green tea colours for Gitea's light, dark and auto
themes, and the 🍵 mark. gitea/sync-custom.sh puts it on green-tea's volume;
gitea/fly.toml names the site Teahub and sets the meta tags.
mcp 2.2: GET /domains, the old factory's Cloudflare Registrar search (a live
check of the exact names, suggestions, prices). Only GITEA_URL may read it
from a browser; 8 searches a minute per client and 20 in all; answers kept
ten minutes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
tea_actions lists runs from /actions/runs (ids, numbers, workflows, conclusions) and tea_action_logs reads one run's jobs, their steps and the last lines of each job's log. Gitea 1.24 had neither endpoint; 28 has both. Tried against a copy of prod's data on 28 before this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
green-tea's fly.toml was only on hb-5 (~/green-tea), on the floating
docker.gitea.com/gitea:1.24 tag. It moves here unchanged apart from the
image, which is now an exact release. Deploy from gitea/ after a volume
snapshot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
docs/lineage.md: "Operate it" replaces "Rehearse it" (Orgchain v1, the
verbs and Time); "Not built yet" names the key layer on branch `tree`.
docs/decisions.md: Orgchain v1, the lineage org, and the token receipt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh
One file, 29 tools, every one acting with the caller's own Gitea token.
Parameters are typed (patterns, ranges, enums), so FastMCP refuses a bad
argument before Gitea is asked anything and publishes the limits in each
tool's schema.
New: tea_pull_get/create/review/merge, tea_labels and tea_label,
tea_commit (up to 50 files, text or base64), tea_branch_create,
tea_repo_edit (including archived), tea_hook_create (one per URL),
tea_secret_set and tea_variable_set.
Fixed:
- unknown labels are refused instead of silently dropped
- a file update is chosen from a 404 on the path, not from matching "404"
in an error message; paths with spaces are percent-encoded
- tea_org_add_member names its team; there is no default
- org repositories are private by default, like user repositories
- "more" and "truncated" come from X-Total-Count, so they are true
- tea_issue_comments pages client-side: Gitea's endpoint is unpaged
- tea_actions reads /actions/tasks: 1.24 has no /actions/runs, so the
old tool always got a 404
- a Gitea that does not answer is named as such instead of a masked error
Tests run against a fake Gitea (27). The same code was run against
teahub.xyz with a temporary token in scratch repositories that were then
deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
The third root file next to AGENTS.md and DESIGN.md. Routes name 1–3 skills by path per task; the ledger
records upstream ref + tree, version and what each skill writes; belts gate trust on evidence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh
Fixes the shot of a venture whose subdomain is not ours (aicharts.yolopreneur.lol is a Worker) and the
NIP-05 path at the apex. Also: HEAD flag no longer shadowed by the path segment (that bug emptied every GET body).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
The earlier README said Claude Code reads .agents/skills/. Its docs list only .claude/skills/ locations
(symlinks followed). Adds the explicit-path rule for loops and known caveats on the vendored set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh
teahubxyzandClaude Opus 5.5