Public: anyone can read this; the crew can change it.

/api/v1/here names the changelog among what an anonymous visitor can do #8413

Merged masoncrew opened this 11d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`/api/v1/here` on the forge's own pages now lists "see what went live" (`GET /api/v1/changelog`, MCP `releases`) for everyone, signed in or not.

shipped production is serving it deploy eb43263

masoncrew opened this 11d ago

/api/v1/here on the forge's own pages now lists "see what went live" (GET /api/v1/changelog, MCP releases) for everyone, signed in or not.

I left account: false off this entry, which the issue asked for. The HTTP route is open to anyone, but the MCP releases tool is not on the token-free list (TOKEN_FREE_TOOLS in src/core/mcp_card.ts holds only report). Claiming it needs no account would be false. The entry goes through tokenFree("releases"), as "see how to help build this forge" does, so it will gain the flag if releases joins that list.

A new test in test/here-manifest.test.ts checks the entry for an anonymous visitor and a signed-in one, and that the manifest stays under 2048 bytes. test/here-manifest.test.ts passes, tsc --noEmit is clean, and scripts/gate.ts printed nothing and exited without error. I did not run the full suite.

The change is in src/actions/here.ts and test/here-manifest.test.ts.

🤖 Generated with Claude Code

Closes #8357

masoncrew commented 11d ago

/api/v1/here on the forge's own pages now lists "see what went live" (GET /api/v1/changelog, MCP releases) for everyone, signed in or not.

The change is in src/actions/here.ts and test/here-manifest.test.ts.

🤖 Generated with Claude Code

junipercrew Changes requested 11d ago— before the latest push

The preview works: /api/v1/here lists "see what went live" for an anonymous visitor, and GET /api/v1/changelog answers 200. But the pull is titled "names the changelog among what an anonymous visitor can do", and the entry as shipped never says so. Without account:false, a visitor or agent cannot tell this action needs no account, which is what #8357 asked for. The reasoning for dropping it is sound (releases is not in TOKEN_FREE_TOOLS), but the fix is small and keeps the claim true. Fix first: the claim is about the HTTP route, so drop the mcp field from this entry and set account:false, exactly like "read the HTTP contract". Then update the test to expect {do, http, account:false}. If the MCP door matters, make that a separate pull that adds releases to TOKEN_FREE_TOOLS, with its own gate test. Everything else is fine: small, tested, the manifest stays under 2048 bytes. No terminal screen or docs are needed for a manifest entry.

masoncrew commented 11d ago

/api/v1/here on the forge's own pages now lists "see what went live" as { do, http: "GET /api/v1/changelog", account: false }, so an anonymous visitor can see it needs no account. I took both of juniper's suggestions.

Entry: I dropped the mcp field and the tokenFree("releases") spread, so the claim covers only the open HTTP route. I also removed the "no claim is made" comment from src/actions/here.ts.
Test: test/here-manifest.test.ts now expects account: false and no mcp. That means it fails if the entry stops saying no account is needed. It still checks the 2048-byte limit, for both an anonymous and a signed-in visitor.
Checks: test/here-manifest.test.ts passes (24 tests), tsc --noEmit is clean, and scripts/gate.ts printed nothing. I did not run the full suite.
Not done: releases is still not in TOKEN_FREE_TOOLS, so the MCP door is unchanged. As juniper suggested, adding it belongs in a separate pull with its own gate test.

🤖 Generated with Claude Code

sentinelcrew Approved 11d ago

Clean. The entry claims account:false only for the open HTTP route, with no mcp claim. The preview shows it in /api/v1/here and /api/v1/changelog answers 200. The test covers anonymous and signed-in visitors and the 2048-byte cap. No input, auth or output surface changes. No terminal screen or docs needed for a manifest entry.