feat: mcp credential (re)sourcing via server.env_file + reload_credentials tool (#688) - #689

Committed from Windows, the scripts lacked +x in the git index, so CI
failed with 'Permission denied' on every runner.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

v0.10.500

- scripts/sign.sh: sign dist/*.mcpb in place and regenerate .sha256
  (signature is appended to the bundle, so checksums must be recomputed);
  soft-skips when no signing material is configured so CI can call it
  unconditionally
- publish.yml: sign bundles before upload when MCPB_SIGNING_CERT /
  MCPB_SIGNING_KEY (PEM content) secrets are set
- work around broken 'mcpb verify' (upstream CLI calls node-forge
  p7.verify which is unimplemented, so every signed bundle reports as
  unsigned): treat verify as advisory, assert the MCPB_SIG_END block

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add make sign target and optional envelope signing in publish workflow

Frames a detached DER SignedData (e.g. from OpenSSL via PKCS#11 against
a hardware token) in the MCPB signature layout and regenerates the
.sha256. Round-trip verified against mcpb's own extractSignatureBlock.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Re-publishes the release pinned in release.yaml from current main
without moving the tag. The confirm_release input must match the pin
exactly; uploads clobber the existing assets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add workflow_dispatch re-publish path (and recover stranded append-signature commit)

Packs assets/icon.png (stackql.io favicon art, 180x180 png) into every
bundle root and references it from the manifest, so Claude Desktop shows
the logo as the extension avatar.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add StackQL icon to bundle manifest

- description must be <= 100 chars
- mcpb packages must not have registryBaseUrl (full URL in identifier)

Both surfaced on the first live publish of 0.10.500, which succeeded
after these changes. Also gitignore .tools/ (local mcp-publisher).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Fix server.json template for registry validation rules

The old 'Interest Form: MCP Directory' is deprecated; it now redirects to
separate local-server and remote-server forms. StackQL uses the local
form. Also mark the Official MCP Registry as published (0.10.500).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Record current Anthropic directory submission form URLs

Claude Desktop launches extensions with cwd '/', read-only on macOS.
stackql's audit sink defaults to a file in the cwd with strict failure
mode, so the server exited immediately after initialize ('Server
disconnected'). The default approot (<cwd>/.stackql) would fail the
same way on first provider pull.

- manifest args now pass --approot ${HOME}/.stackql (plain arg - on
  Windows ${HOME} expands with backslashes, invalid inside JSON) and
  --mcp.config '{"server": {"audit": {"disabled": true}}}'
- smoke-test.py now launches the server with the manifest's own
  mcp_config.args (substituting ${__dirname}/${HOME} to temp dirs),
  so manifest regressions fail the gate instead of surfacing in Desktop
- docs/install.md manual-config example gets the same flags with
  explanation (no variable substitution exists in that file)

Found by testing the published darwin bundle in Claude Desktop on
macOS; reproduced root cause against the binary directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Fix server death under Claude Desktop: cwd-independent approot and audit

Registry versions are immutable; rebuilt assets need a suffixed registry
version (e.g. 0.10.500.1) plus status-delete of the stale entry. Learned
the hard way on the cwd-fix republish.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Document registry SHA-pin recovery after in-place republish

…ted 13-06-26

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Update listings tracker: submissions of 13-06-26

…new venues

Jeff's table restructure (Status, Date, Listing URL, Follow up, Last
Updated columns; current submission states for all venues) plus net-new
rows: Goose Extensions, Zed Extensions, Warp MCP Catalog, Roo Code
Marketplace, GitHub Actions Marketplace.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Restructure listings tracker; add Goose/Zed/Warp/Roo/Actions venues

* Add OCI image and npm wrapper install vectors

Two new distribution channels alongside the .mcpb bundles, both gated by
the same smoke test (now supporting --docker <image> and --cmd '<command>'
modes in addition to bundle mode):

OCI (docker.io/stackql/stackql-mcp):
- oci/Dockerfile: debian-slim, non-root, binary from the release zips
  staged by 'make oci-stage' (COPY --chmod=0755 - host-independent),
  io.modelcontextprotocol.server.name label for registry validation,
  CMD with the cwd-safe approot/audit args
- make oci (local amd64 build) / make oci-push (multi-arch push)
- build.yml: build + in-container smoke at PR time
- publish.yml: multi-arch push, soft-skipped without DOCKERHUB_* secrets

npm (@stackql/mcp-server):
- npx-able launcher: downloads the platform's published .mcpb on first
  run, verifies sha256 against pins baked into the package, caches under
  ~/.stackql/mcp-server-bin/, spawns with cwd-safe args; extra args pass
  through; diagnostics on stderr only
- scripts/render-npm-manifest.sh: pins from PUBLISHED .sha256 files
  (post-publish step, same ordering rule as server-json)
- make npm-manifest / make npm-pack; npm publish stays manual (2FA)
- build.yml: wrapper smoke via STACKQL_MCP_BUNDLE override (published
  pins do not exist at PR time for a new version)
- publish.yml: renders real pins post-upload, attaches tarball artifact

registry/server.template.json gains oci and npm package entries (schema
validated against the live registry). mcpName in package.json and the
image label satisfy the registry's namespace ownership checks.

Verified locally: docker build + smoke (amd64 container, full MCP
exercise), npm wrapper end-to-end against published 0.10.500 assets
(download, sha verify, extract, cache, spawn, full MCP exercise, cache
reuse on second run), npm pack contents (4 files, 3.4kB).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Add PyPI wrapper install vector (stackql-mcp-server)

Same launcher pattern as the npm wrapper, in stdlib-only Python (zero
dependencies): downloads the platform's published .mcpb on first run,
verifies sha256 against pins baked into the package, caches under
~/.stackql/mcp-server-bin/ (shared with the npm wrapper), execs the
binary with the cwd-safe args (os.execv on posix, subprocess on
Windows). Console scripts: stackql-mcp and stackql-mcp-server (the
latter so 'uvx stackql-mcp-server' resolves directly).

- pypi/: hatchling pyproject, package module, README with the
  'mcp-name: io.github.stackql/stackql-mcp' marker the MCP Registry
  requires for pypi namespace validation
- scripts/render-pypi-manifest.sh + make pypi-manifest / pypi-build
  (same post-publish ordering rule as npm; twine upload stays manual
  for 2FA)
- build.yml: pypi-wrapper smoke job (venv install, STACKQL_MCP_BUNDLE
  override); publish.yml: pypi-dist artifact job
- registry template: pypi package entry (schema-validated)
- docs: install.md section 5 (uvx/pip), README/CLAUDE.md/npm README

Verified locally: full smoke via the installed console script against
published 0.10.500 assets (download, sha verify, extract, spawn, full
MCP exercise), sdist+wheel build, wheel contains platforms.json +
entry points + mcp-name marker in METADATA.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Add setup-stackql-mcp GitHub Action

Composite action: installs the signed stackql binary (sha256-verified
against the release .sha256, or from a local bundle via bundle-path for
CI/testing), defaults to read_only server mode, and emits:
- binary-path output + PATH entry
- mcp-config output (mcpServers JSON) that plugs directly into
  anthropics/claude-code-action's mcp_config input
- STACKQL_MCP_BIN env (the npm/pypi wrappers detect it and skip their
  own download)

build.yml gains an action-test job that installs via the action from a
locally built bundle and smokes the server using the action's own
emitted config.

Lives under action/ for development; GitHub Marketplace listing
requires extraction to a public repo with action.yml at the root
(planned: stackql/setup-stackql-mcp).

Verified locally on Windows: download + sha verify against published
pin, extraction, JSON-escaped paths in mcp-config, and a full MCP smoke
driven by the emitted config in read_only mode.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…ocs fixes

The setup-stackql-mcp action is now its own verified-publisher Marketplace
repo (stackql/setup-stackql-mcp), so:
- remove the action/ dir (action.yml, install.py, README) - single source of
  truth is the dedicated repo, tested by its own CI
- remove the action-test job from build.yml (coverage moved to that repo)
- README + docs/install.md point to stackql/setup-stackql-mcp@v1

Also lands the fixes made during the 0.10.500.2 registry publish:
- server.template.json: OCI package entry uses canonical reference in
  identifier (docker.io/stackql/stackql-mcp:VERSION), no registryBaseUrl or
  version field - the registry rejects both for oci packages
- README: 'Publishing the wrapper packages' section (npm/PyPI/OCI command
  sequences incl. the PEP-668 venv steps and .pypirc usage)
- .gitignore: add .pypirc newline fix and __pycache__/

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Post-rollout cleanup: extract action to its own repo, land registry/docs fixes

- npm, PyPI, Docker Hub, GitHub Actions Marketplace: Published 06-15
- Official MCP Registry: now 0.10.500.2 with all 7 package types
- PulseMCP: confirmed live (Official badge)
- mcp.directory: submitted 06-15 (24h review)
- mcp.so: config flipped to npx (public propagation pending)
- Docker MCP Catalog + Smithery: unblocked, in progress
- GitHub MCP Registry: recheck now that npm/oci/pypi types are in the registry

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update listings tracker for Monday rollout

The releases.stackql.io proxy serves versioned assets at
/stackql/<VERSION>/<asset> (e.g. /stackql/0.10.542/...), NOT v-prefixed.
base_url was building /stackql/v<VERSION>/ which 404s. GitHub sha_base
keeps the v prefix (v<VERSION>) since that is GitHub's own path scheme.

Verified: rendered baseUrl https://releases.stackql.io/stackql/0.10.542
serves all four bundles with sha256 matching the canonical pins.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…tials tool (#688)

A process environment block is fixed at spawn, so a stdio MCP server
launched without credential env vars (eg by Claude Desktop) can never see
later external changes, and credential resolution is already lazy
per-request in any-sdk - the gap is purely getting fresh values into the
process. This adds:

- mcp.config server.env_file: a dotenv-style mutable credential store,
  sourced into the process env at startup and on demand; identical
  semantics on Linux, macOS and Windows. Non-empty values only; nothing is
  ever unset, so failed reloads preserve prior working credentials.
- reload_credentials tool: re-sources the env file and reports
  per-provider resolution status (ok / unresolved / not_checked) and
  sourced variable names; secret values are never returned, logged or
  audited. Classified as a select, so available in every mode including
  read_only. Not supported on the reverse_proxy backend (credentials live
  in the remote server).
- credential-resolution errors on queries now carry an agent-actionable
  hint to call reload_credentials and retry, so agentic clients self-heal.
- robot coverage: stdio harness roundtrip spawning the server without the
  okta credential var, observing the hinted failure, writing the env file
  mid-session, reloading, and re-running the query successfully; plus unit
  coverage for the dotenv parser, sourcing semantics and error hint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…pe (#687)

A single-arg scalar function over a provider column adopts its argument's
column identity during name inference (parserutil.inferColNameFromExpr),
and the projection typing then bound the ARGUMENT's provider schema to the
FUNCTION's output column. Type-changing functions (typeof, date, datetime)
had their text results scanned through the argument's declared type,
yielding 0/null, and corrupted same-named sibling projections in the same
SELECT ("contagion": co-projecting typeof(col) nulled a bare col).

The provider schema now types a projection only when the expression IS the
bare column; function and compound expressions default to the backend's
text type, which scans dynamically (SQLite is dynamically typed, so
type-preserving functions like abs/sum/max are unaffected) and preserves
DESCRIBE output for expression-defined provider view columns.

Robot: new function-projection suite asserting typeof/datetime over a
bare integer column, the sibling-corruption guard, and an aggregate
control, against the no-auth native_test XML fixture. Local full-suite
sweep green including the provider-view DESCRIBE scenarios.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Renames contribute.yaml to contribute.yaml.disabled: the check ran
unauthenticated, failed spuriously on maintainer PRs, and gated nothing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

#686)

Parameter routing consumes only literal comparison values, so a required
provider parameter constrained by a pure-literal function expression (eg
WHERE start_time = strftime('%s', date('now', '-30 days'))) was silently
not supplied and the request failed. A new early-analysis pass evaluates
such expressions against the session's SQL backend and substitutes the
typed literal into the AST before parameter extraction, so parameter
routing, push-down intent and the client-side re-filter all see the same
literal the request uses.

Scope guards: expressions containing column references, subqueries or
tuples are untouched (they remain authoritative client-side filters);
NULL results and evaluation failures fall back to pre-existing behaviour;
internally routable (pure SQL) statements are exempt, preserving
non-deterministic function semantics on the native path.

The issue's null/zero projection symptoms share the issue #687 root cause
and are covered by that fix and its tests.

Robot: required-param-via-lower() fold scenario, portable across sqlite
and postgres backends (previously failed with "AWS region is nil"), plus
a column-referencing-expression scope guard. Full local functional sweep
green over the known environmental baseline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ation strategies (#684)

Black-box regression coverage for pagination features shipped in any-sdk
v0.5.3-alpha05..alpha11 that previously had only unit coverage:

- REST page_number: new no-auth stackql_native_test.paged service against
  new native_test mock endpoints serving three pages with
  result_info.page/total_pages; rows carry wire_page so traversal is
  asserted from STDOUT. Scenarios: full three-page traversal, successive
  wire page numbers, and the negative case - a response with no
  total_pages terminator fetches exactly one page (no infinite loop).
- GraphQL cursor strategies: three new graph resources, each backed by a
  dedicated mock endpoint reflecting its strategy-specific wire argument:
  keyset (rankGt comparator advanced from the last row's sort key),
  offset (client-side running row count), and page_info (Relay-strict:
  endCursor stays non-empty on the final page, so completing traversal
  proves termination via pageInfo.hasNextPage rather than cursor
  emptiness). Existing cursor_after scenarios unchanged.

The offset resource declares a jsonPath the strategy itself ignores: the
acquire-layer validation requires one; noted inline in the spec.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

)

DELETE ... WHERE id IN ('a','b','c') now despatches one request per list
element, mirroring SELECT semantics. The mutation parameter extraction
(ExtractSQLNodeParams) only harvested `=` comparisons, silently skipping
IN lists, so the request preparator failed with "missing required path
parameter". IN-list elements are now collected and fanned out into the
cartesian product of scalar parameter sets - one armoury request per set,
each despatched by the existing executor loop. Scalar-only statements
produce the identical single parameter set as before; NOT IN and non-
literal list members are untouched (they remain client-side concerns).

Robot: batch DELETE across two mock-permitted firewalls asserts
successful despatch (previously an immediate parameterize error); the
gcp mock gains a second deletable firewall to make the fan-out
observable as two distinct wire deletions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Robot: batch DELETE ... IN with RETURNING asserts exactly one response
  row per list element via exact-table match - a regression to
  single-element despatch now fails the assertion rather than passing on
  the despatch message alone.
- Unit: ExtractSQLNodeParams coverage for scalar-only preservation,
  per-element fan-out with scalar replication, multi-list cartesian
  product, and the NOT IN exclusion guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…7e9cda'

git-subtree-dir: packaging/mcpb
git-subtree-mainline: 1a25ce2
git-subtree-split: 5398e49

…ublish)

Companion to the preceding subtree import of stackql-mcpb-packaging under
packaging/mcpb (full history preserved). One-stop-shop consolidation:

- New .github/workflows/mcp-packaging.yml: validation on packaging/** PRs
  builds + smoke-tests all four bundles and the OCI image against the
  latest published release. Publishing is MANUAL (workflow_dispatch with
  the target version) by design: the consumed release assets include the
  Authenticode-signed Windows exe and the Apple-notarised darwin .pkg,
  both signed outside CI, so the flow is push tag -> create release ->
  attach signed assets -> dispatch. The publish path envelope-signs (when
  signing secrets are set), uploads bundles to the same-repo release via
  the default GITHUB_TOKEN (cross-repo STACKQL_RELEASE_TOKEN PAT
  retired), pushes the OCI image, and emits npm/pypi/server.json
  artifacts (npm/PyPI publishing stays manual 2FA).
- release.yaml version pin and the imported per-directory workflows are
  removed; local make targets now require explicit VERSION=X.Y.Z.
- build.yml push + pull_request paths-ignore gain packaging/** so
  packaging-only changes never trigger the full Go build matrix.
- README / CLAUDE.md / Makefile updated for the new home.

Deferred follow-ups (next release cycle): manifest user_config wiring for
server.env_file needs a dedicated CLI flag in a released binary (values
cannot substitute inside the --mcp.config JSON arg - Windows ${HOME}
expands with backslashes); root server.json render lands as a workflow
artifact pending automated PR wiring; MCPB_SIGNING_* / optional
GEMINI_API_KEY secrets migrate when signing goes live; archive the
standalone repo after one green dispatch through this pipeline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The Anthropic MCP Directory serves ONE bundle per listing with no
per-platform selection; the listing pointed at the darwin-universal
bundle, so Windows/Linux directory installs received a Mach-O binary
that died before the MCP handshake (confirmed by hash at v0.10.500).
This brings the corrective combined artefact in-house:

- New `make combined` / `package.sh --combined`: builds
  stackql-mcp-multiplatform.mcpb from the already-built per-platform
  bundles (byte-identical binaries, Authenticode/notarisation
  preserved; no pkgutil or macOS runner needed), hard-failing with the
  missing-target list unless all four bundles are present. Layout:
  server/{darwin,linux-x64,linux-arm64,win32}/ selected via
  mcp_config.platform_overrides; the linux key dispatches through a
  uname -m shim (Option A) because platform_overrides has no arch
  dimension. Signed + sha256'd via the existing helpers.
- manifest.template.json gains a tokenised compatibility.platforms
  block so wrong-platform installs of per-platform bundles are refused
  at install time instead of dying at spawn; the combined template
  (manifest.combined.template.json, __VERSION__ only) lists all three.
- scripts/verify-combined.py byte-asserts every payload: MZ for win32,
  ELF for both linux binaries, Mach-O fat magic for darwin, sh shebang
  for the shim - the check that catches a wrong-artefact incident in
  seconds. Wired into `make combined`.
- smoke-test.py now resolves mcp_config.platform_overrides for the host
  platform (as MCPB clients do) and restores payload exec bits, so the
  combined bundle is smoke-testable everywhere.
- mcp-packaging.yml: `combined` job builds + byte-verifies from the
  four bundle artifacts; `combined-smoke` matrix installs the combined
  bundle on ubuntu, ubuntu-arm64 (exercising the shim's aarch64
  branch), macos and windows and completes the MCP handshake on each -
  closing the exact gap the incident went through (per-platform smoke
  can never detect a wrong artefact being distributed). Publish gates
  on both; make publish itself stays best-effort to preserve the
  two-machine local fallback.
- docs/anthropic-submission.md corrected: the listing URL is the
  literal multiplatform bundle URL (no <arch> placeholder); listings do
  NOT auto-track releases (retracted; refresh requires an email on the
  Anthropic review thread per release); there is no self-service PR
  path. Release checklist now includes the combined bundle and the
  review-thread notification.

Validated locally: mcpb accepts the combined manifest and all three
per-platform compatibility variants; exec bits survive mcpb pack
(0755 on every payload member); verify-combined.py passes against a
fake-payload build. Decisions taken: Option A linux shim (B fallback if
a client rejects it), asset name stackql-mcp-multiplatform.mcpb,
CI-gated publish with best-effort make publish.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Changes to .github/workflows/mcp-packaging.yml join packaging/** in
build.yml's paths-ignore (both triggers): packaging pipeline edits are
validated by lint (actionlint) and by the mcp-packaging PR jobs
themselves, and must not burn the ~40 minute Go build matrix. Dispatching
mcp-packaging never triggers build.yml (separate workflow, no push event).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

actionlint 1.6.23 predates the GA arm64 Linux hosted runner, so the
combined-smoke matrix entries in mcp-packaging.yml fail the runner-label
rule. Register the label in actionlint.yaml, mirroring the existing
windows-11-arm entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…oint

Review feedback on #689: dotenv sourcing is not an MCP concern.  The
dotenv machinery moves from mcpbackend to internal/stackql/envfile and
is wired to a root persistent flag, sourced in initConfig for exec,
shell, srv, registry and mcp alike.  server.env_file leaves the MCP
config surface; the reload_credentials tool re-sources the same flag
path mid-session as before.

Robot: new exec-entrypoint scenario proves a credential var present
only in the dotenv file resolves for plain exec; the existing MCP
stdio reload roundtrip now drives --env.file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review feedback on #689: comments were too verbose and risk rotting.
Header blocks, function comments, robot [Documentation] entries, python
docstrings and workflow/packaging script comments introduced by this PR
are cut to roughly half, keeping the constraint or rationale and
dropping restated mechanics.  No functional change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The packaging validation (and any real bundle) packs the latest RELEASED
stackql binary, which predates --env.file; the unknown flag kills the
server at spawn (caught by the bundle smoke on all three legs).  The
wiring is release-gated: re-apply once a release containing --env.file
exists.  This reverts commit a885d57.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>