Repository navigation
Conversation
Add offline assembly from exact native artifacts and an explicit HTTPS MCP URL. The launcher verifies the shipped digest and uses no global CLI, runtime download, or lifecycle hook. Six focused tests pass; signed release artifacts and client acceptance remain required.
Replace the separate CLI login workflow with host MCP sign-in, short-lived upload authorization, and the plugin-bundled collector. Preserve scope, frozen upload identity, completion evidence, and paid-consent boundaries. Setup and review skills validate; this draft does not publish a hosted endpoint or native artifacts.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
Keep hosted MCP resources below application paths usable and pass the full descriptor to the bundled collector for identity validation. Real native bundles passed default, committed, and uncommitted local TLS upload fixtures. App installation and hosted OAuth/review remain separate acceptance gates.
Require explicit native artifact source, SHA-256, version, platform, and HTTPS MCP endpoint. Produce a short-lived workflow artifact with executable permissions preserved in tar, without publishing a release or directory entry. Actionlint passes; manual workflow dispatch and marketplace import remain separate acceptance gates.
Preserve the explicitly supplied MCP resource URL without requiring a /mcp suffix. Keep HTTPS and credential/query/fragment/whitespace guards in both local assembly and CI. Seven packaging tests and ten extracted workflow-validator cases pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeRabbit setup currently requires a global CLI installation and separate sign-in. This draft prepares a package with a native collector and hosted MCP connection, so users connect through Codex once and request reviews of local changes.
Validation:
python3 plugins/coderabbit/scripts/test-plugin-package.pypasses seven tests; the extracted workflow validator passes ten URL cases;git diff --checkpasses. Fresh macOS arm64 packages assemble with CLI 0.9.0 and both launchers return 0.9.0. Prior real native/hosted protocol tests passed six client/scope combinations with fixture authentication and zero backend reviews.Source-only installation contains neither native artifacts nor a deployed endpoint. Approved signed/notarized artifacts, supported platform/import-size qualification, compatible hosted deployment, and fresh-client sign-in/review acceptance remain release gates. Packaging checks do not establish app installation or live authentication. The upload capability passes through tool context; account credentials are not relayed. No release/directory publication or workflow dispatch is performed. Existing onboarding PR #20 remains separate.