Merge pull request #36 from lorem-dev/develop

release: prepare v0.7.0

Author: lorem-dev

.claude.json

@@ -3,10 +3,7 @@
     "codegraph": {
       "type": "stdio",
       "command": "codegraph",
-      "args": [
-        "serve",
-        "--mcp"
-      ]
+      "args": ["serve", "--mcp"]
     }
   }
 }

.github/workflows/ci.yml

@@ -56,7 +56,7 @@ jobs:
       - name: Set up Node.js 22 with pnpm cache
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           cache: pnpm
 
       - name: Install dependencies (frozen lockfile)
@@ -173,7 +173,7 @@ jobs:
       - name: Set up Node.js 22 with pnpm cache
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           cache: pnpm
 
       - name: Install dependencies (frozen lockfile)
@@ -247,7 +247,7 @@ jobs:
       - name: Set up Node.js 22 with pnpm cache
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           cache: pnpm
 
       - name: Install dependencies (frozen lockfile)
@@ -260,5 +260,5 @@ jobs:
         # reproducible and fail for reasons in the diff, not because the fixture
         # moved. Locally the same script force-pulls instead.
         env:
-          SKILLKEEPER_E2E_PIN_FIXTURE: "1"
+          SKILLKEEPER_E2E_PIN_FIXTURE: '1'
         run: pnpm test:e2e

.github/workflows/docs.yml

@@ -24,8 +24,8 @@ on:
     tags:
       # Final releases only: the negative pattern excludes any pre-release tag
       # (a `-` qualifier), so an RC never starts this workflow at all.
-      - "v*"
-      - "!v*-*"
+      - 'v*'
+      - '!v*-*'
   workflow_dispatch:
 
 # mike pushes commits to the gh-pages branch.

.github/workflows/release.yml

@@ -26,7 +26,7 @@ name: Release
 on:
   push:
     tags:
-      - "v*"
+      - 'v*'
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -49,7 +49,7 @@ jobs:
       - name: Set up Node.js 22
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           # This job only runs node scripts/check-version.mjs and never installs
           # deps. Disable setup-node's package-manager cache: it otherwise
           # auto-detects the pnpm packageManager field and fails locating pnpm
@@ -96,32 +96,32 @@ jobs:
           # macOS Apple Silicon
           - os: macos-latest
             target: aarch64-apple-darwin
-            args: "--target aarch64-apple-darwin"
+            args: '--target aarch64-apple-darwin'
           # macOS Intel (cross-compiled on the arm64 runner)
           - os: macos-latest
             target: x86_64-apple-darwin
-            args: "--target x86_64-apple-darwin"
+            args: '--target x86_64-apple-darwin'
           # Linux x64. ubuntu-22.04 keeps the AppImage's glibc floor low for
           # broader distro compatibility.
           - os: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
-            args: ""
+            args: ''
           # Linux arm64, built natively on the arm64 runner (free for public
           # repositories). Same 22.04 image as the x64 leg, so both AppImages
           # share a glibc floor.
           - os: ubuntu-22.04-arm
             target: aarch64-unknown-linux-gnu
-            args: ""
+            args: ''
           # Windows x64
           - os: windows-latest
             target: x86_64-pc-windows-msvc
-            args: ""
+            args: ''
           # Windows arm64 (cross-compiled on the x64 runner, as macOS Intel is).
           # Only the Rust target changes; Node, pnpm and the frontend build stay
           # on the x64 image.
           - os: windows-latest
             target: aarch64-pc-windows-msvc
-            args: "--target aarch64-pc-windows-msvc"
+            args: '--target aarch64-pc-windows-msvc'
 
     steps:
       - name: Checkout repository
@@ -171,15 +171,15 @@ jobs:
           # 7.7 GB of the repository's 10 GB budget across a handful of release
           # candidates, which evicted the CI caches that do get reused.
           save-if: false
-          workspaces: ". -> target"
+          workspaces: '. -> target'
 
       - name: Enable pnpm via corepack
         run: corepack enable
 
       - name: Set up Node.js 22 with pnpm cache
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           cache: pnpm
 
       - name: Install dependencies (frozen lockfile)
@@ -475,7 +475,7 @@ jobs:
       - name: Set up Node.js 22
         uses: actions/setup-node@v5
         with:
-          node-version: "24"
+          node-version: '24'
           # This job runs only node scripts (release notes) plus gh/gpg and
           # never installs deps. Disable the package-manager cache so setup-node
           # does not try to locate pnpm before corepack is enabled.

.prettierignore

@@ -13,3 +13,18 @@ apps/desktop/src/renderer/services/bridge/generated
 # from here would dirty its worktree and show up as an unintended pointer bump.
 examples/test-repo
 
+# Written by `cargo test` (mcp::schema::tests::writes_the_schema_file). Prettier
+# and the generator disagree about its layout, so formatting it here would make
+# the two rewrite it in turn, forever.
+schemas
+
+# Written by `pnpm run i18n` from the `.po` sources. Same reason as above: the
+# generator owns the layout, so the formatter must not.
+packages/i18n/src/catalogs
+
+# Markdown is hand-authored prose here, and the formatter's model of it does not
+# match how these pages are written: it strips the alignment padding out of
+# reference tables, and it moves a list item's continuation line to column 0
+# when the line above ends inside an unclosed inline-code span (see the ledger
+# paragraph in docs/usage/mcp.md). Neither buys anything a reader can see.
+*.md

.prettierrc.json

@@ -2,7 +2,8 @@
   "semi": true,
   "singleQuote": true,
   "trailingComma": "all",
-  "printWidth": 100,
+  "printWidth": 120,
   "tabWidth": 2,
-  "endOfLine": "lf"
+  "endOfLine": "lf",
+  "embeddedLanguageFormatting": "off"
 }

CHANGES.md

@@ -2,14 +2,38 @@
 
 ## Development
 
+### Added
+
+- An MCP server definition can carry an `oauth` block for the agent's
+  sign-in. See
+  [MCP Servers](https://lorem-dev.github.io/skillkeeper/latest/usage/mcp/#oauth).
+- Codex MCP presets can use the `http` transport, not just `stdio`. See
+  [MCP Servers](https://lorem-dev.github.io/skillkeeper/latest/usage/mcp/#per-agent-native-destinations).
+- An MCP server (and its parameters) can carry a `description`, and a
+  parameter can be restricted to a set of labeled `options`. See
+  [MCP Servers](https://lorem-dev.github.io/skillkeeper/latest/usage/mcp/#descriptions-and-parameter-metadata).
+
+### Fixed
+
+- Codex now resolves a real project-scoped `.codex/config.toml` instead of
+  always writing the global config.
+- Updating an MCP server no longer deletes it when the new definition cannot be
+  installed. An update removes the instance and writes it back; if the source
+  had changed to a transport the agent cannot express, or to a parameter with
+  no value, the write failed after the removal and the instance was gone along
+  with its stored parameter values. Both are now decided before anything is
+  removed, on the CLI and in the desktop app.
+- A server name written in a repository's `mcp.yml` can no longer inject
+  terminal escape sequences into `mcp list` output.
+
 ## Version 0.6.0
 
 ### Added
 
 - A `SKILL.md` can declare the skills of its own repository that it needs, as
   `skillkeeper.requires` or a flat `requires`.
 - Installing a skill installs its transitive dependencies. See
-  [Skills and Hooks](https://lorem-dev.github.io/skillkeeper/usage/skills-and-hooks/).
+  [Skills and Hooks](https://lorem-dev.github.io/skillkeeper/latest/usage/skills-and-hooks/).
 - `skillkeeper repo lint` reports what is statically wrong in a skill
   repository, with ten stable diagnostic codes and exit codes a CI gate can use.
 - `skill update` updates a skill's dependencies as well, and installs any the

Cargo.lock

@@ -2,8 +2,7 @@ import { fileURLToPath } from 'node:url';
 import type { StorybookConfig } from '@storybook/react-vite';
 import { mergeConfig } from 'vite';
 
-const fromHere = (relative: string): string =>
-  fileURLToPath(new URL(relative, import.meta.url));
+const fromHere = (relative: string): string => fileURLToPath(new URL(relative, import.meta.url));
 
 // Mirror the renderer aliases from vite.config.ts so Storybook's Vite resolves
 // the same paths the app does.
@@ -17,8 +16,7 @@ const config: StorybookConfig = {
   framework: '@storybook/react-vite',
   stories: ['../src/renderer/**/*.stories.@(ts|tsx)'],
   addons: [],
-  viteFinal: (viteConfig) =>
-    mergeConfig(viteConfig, { resolve: { alias } }),
+  viteFinal: (viteConfig) => mergeConfig(viteConfig, { resolve: { alias } }),
 };
 
 export default config;

apps/desktop/.storybook/main.ts

@@ -2,10 +2,7 @@
   "$schema": "../gen/schemas/desktop-schema.json",
   "identifier": "default",
   "description": "Base capability for the main window and the SSH unlock window.",
-  "windows": [
-    "main",
-    "ssh-unlock"
-  ],
+  "windows": ["main", "ssh-unlock"],
   "permissions": [
     "core:default",
     "dialog:default",