feat(mcp,kvm): publish to Forgejo Cargo registry + image attachments #25

Merged

David merged 1 commit from feat/cargo-registry-publish into main

2026-05-21 12:20:42 +02:00

David commented

2026-05-21 12:17:55 +02:00

Owner

Summary

Lets downstream repos (desktop-mcp today; agent installers tomorrow) depend on vervain-agent-mcp and vervain-agent-kvm as normal version deps instead of cross-repo path deps. Eliminates the actions/checkout@v5 + read:repository PAT scope plumbing those repos currently need (see desktop-mcp PR #1).

Bundles two strands at the consumer's request:

Cargo registry publish setup (the bulk of the change).
vervain-agent-mcp::ToolResult image-attachment API plus Registry::call / McpError::code made public, so out-of-process transports (desktop-mcp's axum adapter, custom HTTP shims) can dispatch and build error responses without going through serve().

What this PR sets up

.cargo/config.toml defines a psa-systems-cargo registry alias pointing at sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/.
Each publishable crate (vervain-agent-mcp, vervain-agent-kvm) gets publish = ["psa-systems-cargo"] so an accidental cargo publish without --registry is rejected.
Root Cargo.toml workspace deps gain version = "0.0.1" alongside the existing path so cargo publish has a version to record.
.forgejo/workflows/publish-crates.yml runs cargo publish on per-crate tag pushes (vervain-agent-mcp-v<semver> / vervain-agent-kvm-v<semver>), gated by a workspace-version-vs-tag equality check.

Auth

secrets.PSA_SYSTEMS_PRIVATE_PACKAGE_PAT with write:package scope, already provisioned for build-package.yml. Cargo and Generic Packages share the scope on Forgejo.

Smoke test

cargo check --workspace --all-features                                                    # clean
cargo publish --dry-run --registry psa-systems-cargo --package vervain-agent-mcp          # reaches Uploading
cargo publish --dry-run --registry psa-systems-cargo --package vervain-agent-kvm          # reaches Uploading

Test plan

CI green on this PR
Merge to main
Tag vervain-agent-mcp-v0.0.1 and vervain-agent-kvm-v0.0.1; verify Publish crates workflow uploads both
cargo search --registry psa-systems-cargo vervain-agent-mcp returns the published crate from a clean dev box
Land the matching desktop-mcp PR that flips path-deps to { version = "0.0.1", registry = "psa-systems-cargo" }
Close desktop-mcp PR #1 once the cross-repo checkout is gone

## Summary Lets downstream repos (desktop-mcp today; agent installers tomorrow) depend on `vervain-agent-mcp` and `vervain-agent-kvm` as normal version deps instead of cross-repo path deps. Eliminates the `actions/checkout@v5` + `read:repository` PAT scope plumbing those repos currently need (see desktop-mcp PR #1). Bundles two strands at the consumer's request: - Cargo registry publish setup (the bulk of the change). - `vervain-agent-mcp::ToolResult` image-attachment API plus `Registry::call` / `McpError::code` made public, so out-of-process transports (desktop-mcp's axum adapter, custom HTTP shims) can dispatch and build error responses without going through `serve()`. ## What this PR sets up - `.cargo/config.toml` defines a `psa-systems-cargo` registry alias pointing at `sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/`. - Each publishable crate (`vervain-agent-mcp`, `vervain-agent-kvm`) gets `publish = ["psa-systems-cargo"]` so an accidental `cargo publish` without `--registry` is rejected. - Root `Cargo.toml` workspace deps gain `version = "0.0.1"` alongside the existing `path` so `cargo publish` has a version to record. - `.forgejo/workflows/publish-crates.yml` runs `cargo publish` on per-crate tag pushes (`vervain-agent-mcp-v<semver>` / `vervain-agent-kvm-v<semver>`), gated by a workspace-version-vs-tag equality check. ## Auth `secrets.PSA_SYSTEMS_PRIVATE_PACKAGE_PAT` with `write:package` scope, already provisioned for `build-package.yml`. Cargo and Generic Packages share the scope on Forgejo. ## Smoke test ``` cargo check --workspace --all-features # clean cargo publish --dry-run --registry psa-systems-cargo --package vervain-agent-mcp # reaches Uploading cargo publish --dry-run --registry psa-systems-cargo --package vervain-agent-kvm # reaches Uploading ``` ## Test plan - [ ] CI green on this PR - [ ] Merge to main - [ ] Tag `vervain-agent-mcp-v0.0.1` and `vervain-agent-kvm-v0.0.1`; verify `Publish crates` workflow uploads both - [ ] `cargo search --registry psa-systems-cargo vervain-agent-mcp` returns the published crate from a clean dev box - [ ] Land the matching desktop-mcp PR that flips path-deps to `{ version = "0.0.1", registry = "psa-systems-cargo" }` - [ ] Close desktop-mcp PR #1 once the cross-repo checkout is gone

David added 1 commit

2026-05-21 12:17:55 +02:00

feat(mcp,kvm): publish to Forgejo Cargo registry + image attachments

Check / clippy + fmt + tests (pull_request) Successful in 1m24s

Details

d5373ac7fb

Lets downstream repos (desktop-mcp today; agent installers tomorrow) depend on `vervain-agent-mcp` and `vervain-agent-kvm` as normal version deps instead of cross-repo path deps. Eliminates the `actions/checkout@v5` + `read:repository` PAT scope plumbing those repos currently need (cf. desktop-mcp PR #1).

What this PR sets up

- `.cargo/config.toml` defines a `psa-systems-cargo` registry alias pointing at `sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/`. `sparse+` is supported by cargo 1.68+, well below the 1.93.1 floor in `rust-toolchain.toml`.
- Each publishable crate gets `publish = ["psa-systems-cargo"]` in its `[package]` block so an accidental `cargo publish` without `--registry` (which would target crates.io) is rejected with `error: failed to publish to registry: the registry 'crates-io' is not allowed`.
- `Cargo.toml` workspace deps for the two published crates gain `version = "0.0.1"` alongside the existing `path` so `cargo publish` has a version to record in the published manifest; the path keeps in-workspace builds resolving to the local copy.
- `.forgejo/workflows/publish-crates.yml` runs `cargo publish` on per-crate tag pushes (`vervain-agent-mcp-v<semver>` / `vervain-agent-kvm-v<semver>`), gated by a workspace-version-vs-tag check that exits non-zero on mismatch.

Auth

`secrets.PSA_SYSTEMS_PRIVATE_PACKAGE_PAT` with `write:package` scope, already provisioned for `build-package.yml`. Cargo and Generic Packages share the scope on Forgejo. Set as `CARGO_REGISTRIES_PSA_SYSTEMS_CARGO_TOKEN` env var at step scope (cargo's mechanical env-name convention for registry tokens).

ToolResult image attachments (separate but bundled per consumer request)

`vervain-agent-mcp::ToolResult` gains an `images: Vec<ToolImage>` field plus a `with_image(...)` builder. The wire serializer emits each image as an additional `{type: image, data, mimeType}` MCP content block after the text block. desktop-mcp's `screenshot` family already calls `ToolResult::with_image(...)`; this commit exposes the API as part of the published crate's surface. `Registry::call(name, args, progress)` and `McpError::code()` are now public so out-of-process transports (desktop-mcp's axum adapter) can dispatch without going through `serve()`.

Smoke test

`cargo check --workspace --all-features` clean. `cargo publish --dry-run --registry psa-systems-cargo --package vervain-agent-{mcp,kvm}` both reach the `Uploading ...` line ("aborting upload due to dry run" is the expected dry-run terminal state).

Rollout sequence

1. Merge this PR.
2. Tag `vervain-agent-mcp-v0.0.1` and `vervain-agent-kvm-v0.0.1` on main. CI publishes.
3. Land the matching desktop-mcp PR that flips from path-deps to `{ version = "0.0.1", registry = "psa-systems-cargo" }` and drops the cross-repo `actions/checkout` plumbing.
4. Close desktop-mcp PR #1 (the PAT-scope doc fix becomes obsolete; the PAT goes back to `write:package` only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>