standup-mr 0.7.0 → 1.0.1

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to standup-mr are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] - 2026-10-12
+
+### Fixed
+
+- GitLab merge requests take their pipeline from `head_pipeline`, the one
+  GitLab shows on the MR. The `/pipelines` list is not ordered newest first,
+  so a merge request could be reported blocked by a stale red pipeline from an
+  earlier commit, and the current failure's log was never read.
+- Error lines from GitLab's timestamped job logs no longer start with the
+  stream marker (`01O`, `00E+`) that follows each timestamp.
+
+### Added
+
+- Every MCP tool declares a human-readable `title`, which clients show in
+  their tool lists and permission prompts.
+
+## [1.0.0] - 2026-10-12
+
+First stable release. From here on the CLI commands and flags, the JSON that
+`fetch` and `get_standup_data` return, the MCP tool names and arguments, and
+the environment variables follow semantic versioning: anything that would
+break an existing setup waits for 2.0.
+
+### Added
+
+- **Remote MCP server for claude.ai.** Add
+  `https://standup.ilkerbalcilar.com/mcp` as a custom connector, sign in with
+  GitHub or gitlab.com — or paste a token for a self-hosted host — and use
+  standup-mr from claude.ai on the web and on mobile, with no environment
+  variables. One connector can hold several accounts and an optional chat
+  webhook. The server lives in `remote/` and is not part of the npm package.
+- **Sign in to your company's GitLab or GitHub Enterprise.** On the connect
+  page, type the host: if someone there already set up sign-in, use it;
+  otherwise register an OAuth application once, following the exact redirect
+  URI and scopes the page shows, and everyone at that host can sign in from
+  then on.
+- `server.json` lists the remote endpoint, so registries show both the npm
+  package and the hosted server.
+- Both servers declare the project icon in `serverInfo.icons`.
+
+### Fixed
+
+- GitLab requests send the token as `Authorization: Bearer` instead of
+  `PRIVATE-TOKEN`. Personal access tokens work either way, but OAuth tokens —
+  from `glab`'s browser login or from the remote server's sign-in — were
+  rejected with 401.
+
 ## [0.7.0] - 2026-10-10
 
 ### Added

package/README.md

@@ -66,12 +66,55 @@ So if you already use `gh` or `glab`, there is nothing to configure.
 npx standup-mr fetch --markdown | npx standup-mr post --slack "$SLACK_WEBHOOK_URL"
 ```
 
-## The three surfaces
+## claude.ai (web and mobile)
+
+No token, no config file — sign in instead. In claude.ai open **Settings →
+Connectors → Add custom connector** and paste:
+
+```
+https://standup.ilkerbalcilar.com/mcp
+```
+
+Press **Connect**. A page opens where you link the accounts the note should
+read:
+
+- **GitHub** — sign in through the standup-mr GitHub App. It only sees the
+  repositories it is installed on, so install it on your org too; if the org
+  won't approve it, add github.com with a fine-grained token instead.
+- **gitlab.com** — sign in with GitLab.
+- **Your company's GitLab or GitHub Enterprise** — type the host. If someone
+  at your company already set up sign-in, you get a "Sign in with …" button.
+  Otherwise set it up once: the page shows the exact redirect URI and scopes
+  for an OAuth application on your host, you paste its ID and secret, and
+  everyone at that host can sign in from then on. A read-only token works too.
+- **Chat webhook** _(optional)_ — Slack, Discord or Google Chat, so Claude can
+  post the finished note when you ask it to.
+
+Link as many as you like — say, GitHub for side projects and your company's
+GitLab for work — then ask for "my standup" or "my work standup". With
+several accounts linked, Claude asks which one you mean.
+
+The connector then works from the claude.ai mobile app as well.
+
+**What is stored.** Your provider tokens and webhook URL, encrypted with
+AES-256-GCM, and only to read your merge requests and post your note. The
+access tokens Claude holds are stored as hashes. Disconnecting the connector
+deletes everything; connections unused for 30 days are deleted. The server is
+the code in [`remote/`](remote/).
+
+**When to use the local server instead.** A GitLab behind a VPN or on a
+private network is out of reach of a hosted server. Run the stdio server
+below on your own machine — the token never leaves it.
+
+## The four surfaces
 
 **CLI** — the core. Emits JSON; zero runtime dependencies.
 
-**MCP server** (`mcp/`) — one tool, `get_standup_data`, for Claude Desktop,
-Cursor, or any MCP client. See [`mcp/README.md`](mcp/README.md).
+**MCP server** (`mcp/`) — three tools for Claude Desktop, Claude Code, Cursor,
+or any MCP client that runs a local process. See [`mcp/README.md`](mcp/README.md).
+
+**Remote MCP server** (`remote/`) — the same tools over HTTPS with sign-in, for
+claude.ai on the web and on mobile. See [above](#claudeai-web-and-mobile).
 
 **Claude Code plugin** — the note-writing playbook, shipped as the `standup`
 skill. From inside Claude Code:
@@ -205,6 +248,16 @@ that pipeline is red; this one opens the failed job's log and shows you the
 404 — and a 404 rather than a 403 usually means the token's scope is wrong, not
 that the package is missing.
 
+## Stability
+
+Since 1.0.0 the CLI commands and flags, the JSON that `fetch` and
+`get_standup_data` return, the MCP tool names and arguments, and the
+environment variables follow [semantic versioning](https://semver.org/): a
+change that would break an existing setup waits for a major release. New
+fields in the JSON may appear in minor releases, so read it by name rather
+than by position. The hosted server at `standup.ilkerbalcilar.com` is
+updated continuously and is not tied to the npm version.
+
 ## Known limits
 
 - **GitHub's events feed is shallow.** It is capped at roughly 300 events over

package/dist/{chunk-J5LAGA3U.js → chunk-3C3PBI3T.js}

@@ -383,7 +383,7 @@ var SECTION = /section_(start|end):\d+:\S*/g;
 var SIGNAL = /(\berror\b|Error:|fatal:|npm ERR!|\bfailed\b)/i;
 var NOISE = /^(Cleaning up|Job failed: exit status|ERROR: Job failed|Uploading artifacts|Job succeeded)/i;
 var MAX_LINE = 200;
-var TIMESTAMP = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+/;
+var TIMESTAMP = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+(?:[0-9a-f]{2}[OE]\+?\s)?/;
 var ERROR_MARKER = /^##\[error\]\s*/;
 var GROUP_START = /^##\[group\]/;
 var GROUP_END = /^##\[endgroup\]/;
@@ -810,7 +810,10 @@ var GitLabProvider = class {
     const response = await sendWithRetry(
       this.fetchImpl,
       url,
-      { headers: { "PRIVATE-TOKEN": this.token } },
+      // Bearer, not PRIVATE-TOKEN: GitLab accepts personal access tokens
+      // either way, but OAuth tokens — glab's browser login, and the
+      // remote server's sign-in — only as a bearer.
+      { headers: { Authorization: `Bearer ${this.token}` } },
       this.host
     );
     assertUsable(response, this.host);
@@ -901,14 +904,11 @@ var GitLabProvider = class {
   async shapeMr(mr) {
     const projectId = mr.project_id;
     const iid = mr.iid;
-    const [pipelines, unresolved] = await Promise.all([
-      this.getJson(
-        `projects/${projectId}/merge_requests/${iid}/pipelines`,
-        { per_page: 1 }
-      ),
+    const [detail, unresolved] = await Promise.all([
+      this.getJson(`projects/${projectId}/merge_requests/${iid}`),
       this.countUnresolved(projectId, iid)
     ]);
-    const latest = pipelines?.[0];
+    const latest = detail?.head_pipeline ?? void 0;
     return {
       provider: "gitlab",
       project: String(mr.references.full).split("!")[0],

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   postWebhook,
   readStandupSkillBody,
   toMarkdown
-} from "./chunk-J5LAGA3U.js";
+} from "./chunk-3C3PBI3T.js";
 
 // src/cli/cli.ts
 import { realpathSync } from "fs";

package/dist/index.js

@@ -45,7 +45,7 @@ import {
   toMarkdown,
   undiagnosed,
   unreachable
-} from "./chunk-J5LAGA3U.js";
+} from "./chunk-3C3PBI3T.js";
 export {
   ApiError,
   ConfigError,

package/dist/mcp/server.js

@@ -306,7 +306,7 @@ var SECTION = /section_(start|end):\d+:\S*/g;
 var SIGNAL = /(\berror\b|Error:|fatal:|npm ERR!|\bfailed\b)/i;
 var NOISE = /^(Cleaning up|Job failed: exit status|ERROR: Job failed|Uploading artifacts|Job succeeded)/i;
 var MAX_LINE = 200;
-var TIMESTAMP = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+/;
+var TIMESTAMP = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+(?:[0-9a-f]{2}[OE]\+?\s)?/;
 var ERROR_MARKER = /^##\[error\]\s*/;
 var GROUP_START = /^##\[group\]/;
 var GROUP_END = /^##\[endgroup\]/;
@@ -842,7 +842,10 @@ var GitLabProvider = class {
     const response = await sendWithRetry(
       this.fetchImpl,
       url,
-      { headers: { "PRIVATE-TOKEN": this.token } },
+      // Bearer, not PRIVATE-TOKEN: GitLab accepts personal access tokens
+      // either way, but OAuth tokens — glab's browser login, and the
+      // remote server's sign-in — only as a bearer.
+      { headers: { Authorization: `Bearer ${this.token}` } },
       this.host
     );
     assertUsable(response, this.host);
@@ -933,14 +936,11 @@ var GitLabProvider = class {
   async shapeMr(mr) {
     const projectId = mr.project_id;
     const iid = mr.iid;
-    const [pipelines, unresolved] = await Promise.all([
-      this.getJson(
-        `projects/${projectId}/merge_requests/${iid}/pipelines`,
-        { per_page: 1 }
-      ),
+    const [detail, unresolved] = await Promise.all([
+      this.getJson(`projects/${projectId}/merge_requests/${iid}`),
       this.countUnresolved(projectId, iid)
     ]);
-    const latest = pipelines?.[0];
+    const latest = detail?.head_pipeline ?? void 0;
     return {
       provider: "gitlab",
       project: String(mr.references.full).split("!")[0],
@@ -1277,49 +1277,71 @@ async function runPostTool(args, deps = {}) {
 async function runInstructionsTool() {
   return text(readStandupSkillBody());
 }
+var STANDUP_TOOL_TITLE = "Get standup data";
+var POST_TOOL_TITLE = "Post standup note";
+var INSTRUCTIONS_TOOL_TITLE = "Get note instructions";
+var STANDUP_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+var POST_TOOL_ANNOTATIONS = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var INSTRUCTIONS_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var SERVER_ICONS = [
+  {
+    src: "https://raw.githubusercontent.com/Jubstaaa/standup-mr/main/assets/icon-512.png",
+    mimeType: "image/png",
+    sizes: ["512x512"]
+  },
+  {
+    src: "https://raw.githubusercontent.com/Jubstaaa/standup-mr/main/assets/icon.svg",
+    mimeType: "image/svg+xml",
+    sizes: ["any"]
+  }
+];
 function createServer() {
   const server = new McpServer({
     name: "standup-mr",
-    version: packageVersion(import.meta.url)
+    version: packageVersion(import.meta.url),
+    icons: SERVER_ICONS
   });
   server.registerTool(
     "get_standup_data",
     {
+      title: STANDUP_TOOL_TITLE,
       description: STANDUP_TOOL_DESCRIPTION,
       inputSchema: STANDUP_TOOL_SCHEMA,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: true
-      }
+      annotations: STANDUP_TOOL_ANNOTATIONS
     },
     async (args) => await runStandupTool(args)
   );
   server.registerTool(
     "post_standup_note",
     {
+      title: POST_TOOL_TITLE,
       description: POST_TOOL_DESCRIPTION,
       inputSchema: POST_TOOL_SCHEMA,
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
-        openWorldHint: true
-      }
+      annotations: POST_TOOL_ANNOTATIONS
     },
     async (args) => await runPostTool(args)
   );
   server.registerTool(
     "get_note_instructions",
     {
+      title: INSTRUCTIONS_TOOL_TITLE,
       description: INSTRUCTIONS_TOOL_DESCRIPTION,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
-      }
+      annotations: INSTRUCTIONS_TOOL_ANNOTATIONS
     },
     async () => await runInstructionsTool()
   );
@@ -1345,16 +1367,25 @@ if (entryUrl && import.meta.url === entryUrl) {
   });
 }
 export {
+  INSTRUCTIONS_TOOL_ANNOTATIONS,
   INSTRUCTIONS_TOOL_DESCRIPTION,
+  INSTRUCTIONS_TOOL_TITLE,
+  POST_TOOL_ANNOTATIONS,
   POST_TOOL_DESCRIPTION,
   POST_TOOL_SCHEMA,
+  POST_TOOL_TITLE,
+  SERVER_ICONS,
+  STANDUP_TOOL_ANNOTATIONS,
   STANDUP_TOOL_DESCRIPTION,
   STANDUP_TOOL_SCHEMA,
+  STANDUP_TOOL_TITLE,
   WEBHOOK_URL_ENV,
   collect,
   createServer,
+  failure,
   main,
   runInstructionsTool,
   runPostTool,
-  runStandupTool
+  runStandupTool,
+  text
 };

package/llms-install.md

@@ -3,6 +3,11 @@
 Instructions for an AI assistant setting this MCP server up on a user's
 machine. Everything here is verified against the published package.
 
+If the user is on claude.ai (web or mobile) rather than a client that runs
+local processes, none of this applies: tell them to add
+`https://standup.ilkerbalcilar.com/mcp` under Settings → Connectors → Add custom
+connector and sign in on the page that opens.
+
 ## What it needs
 
 - Node.js 20 or newer. Nothing to clone, nothing to build — the server runs

package/mcp/README.md

@@ -1,8 +1,13 @@
 # MCP server
 
-Exposes one tool, `get_standup_data`, for either GitLab or GitHub, returning
+Exposes three tools — `get_standup_data`, `get_note_instructions` and
+`post_standup_note` — for either GitLab or GitHub. `get_standup_data` returns
 the same JSON as `standup fetch`.
 
+This is the local, stdio server: it runs on your machine and reads tokens from
+its environment. On claude.ai (web or mobile), use the hosted connector instead
+— see [claude.ai (web and mobile)](../README.md#claudeai-web-and-mobile).
+
 ## Configure
 
 GitLab:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "standup-mr",
-    "version": "0.7.0",
+    "version": "1.0.1",
     "mcpName": "io.github.Jubstaaa/standup-mr",
     "description": "Standup notes from merge request state, not commit logs.",
     "keywords": [
@@ -53,6 +53,9 @@
         "CHANGELOG.md",
         "LICENSE"
     ],
+    "workspaces": [
+        "remote"
+    ],
     "scripts": {
         "build": "tsup",
         "lint": "eslint .",
@@ -64,8 +67,8 @@
         "prepublishOnly": "tsup"
     },
     "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.30.0",
-        "zod": "^4.4.3"
+        "@modelcontextprotocol/sdk": "^1.32.1",
+        "zod": "^4.6.6"
     },
     "devDependencies": {
         "@eslint/js": "^9.39.1",