xarmian 6118f7065c feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719) ...

The ChatGPT projection (U1) gets its own transport at <MCP URL>/chatgpt,
behind PAD_CHATGPT_MCP_ENABLED=true and served only while OAuth is
available. It is its own OAuth resource (U2a's second canonical): its
path-aware protected-resource document is
/.well-known/oauth-protected-resource/mcp/chatgpt, its 401s name that
document, and tokens do not cross between the two mounts. Personal access
tokens are refused there with a 401 naming OAuth-only, ahead of the PAT
branch that would accept them without the audience check.

The consent screen names the ChatGPT surface when the requested resource
is the ChatGPT one. The mount is wired only while the door versions
content (ChatGPTDoorVersionsContent, held to the behaviour by a test) and
every catalog tool has a response shape (ChatGPTCatalogReady); otherwise
startup logs and skips it. /mcp is byte-identical.

Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC

2026-10-02 03:34:43 -04:00

..

screenshots

test(screenshots): capture in dark mode (Pad's default theme) (#319)

2026-04-30 13:10:51 -04:00

architecture.md

ci(web): decide the npm audit gate from the report, not the exit code, and run it last (BUG-2881) (#1247)

2026-09-04 10:45:21 -04:00

backup.md

feat(materialize): recover unsaved editor sessions into items.content (TASK-2198 U4) (#1683)

2026-09-30 11:03:07 -04:00

brand.md

feat(web): Community link (GitHub Discussions) in the user menu and auth footer (TASK-2888) (#1251)

2026-09-04 23:42:15 -04:00

deployment.md

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00