fix: add curl fallback to /debug-report when MCP tools unavailable #103

Merged
lmiranda merged 4 commits from fix/issue-100-debug-report-fallback into development 2026-01-22 20:01:33 +00:00
Owner

Summary

  • Adds curl fallback to /debug-report when MCP tools are unavailable
  • Implements secure temp file handling with restrictive permissions
  • Provides three-tier graceful degradation: MCP → curl → local file

Problem

When MCP tools are not available in a session (the very scenario /debug-report is designed to diagnose), the command could not create the diagnostic issue, defeating its purpose.

Solution

Step 6 now offers two options:

  • Option A: Use MCP tools (preferred, when available)
  • Option B: Curl fallback with proper security measures

Security measures implemented:

  • mktemp -m 600 for restrictive file permissions
  • jq --rawfile for safe JSON construction (avoids command substitution vulnerabilities)
  • Proper cleanup of temporary files

Test plan

  • Test /debug-report when MCP tools ARE available (Option A should work)
  • Test /debug-report when MCP tools are NOT available with credentials configured
  • Test /debug-report when MCP tools are NOT available without credentials (should save locally)

Fixes #100


🤖 Generated with Claude Code

## Summary - Adds curl fallback to `/debug-report` when MCP tools are unavailable - Implements secure temp file handling with restrictive permissions - Provides three-tier graceful degradation: MCP → curl → local file ## Problem When MCP tools are not available in a session (the very scenario `/debug-report` is designed to diagnose), the command could not create the diagnostic issue, defeating its purpose. ## Solution Step 6 now offers two options: - **Option A**: Use MCP tools (preferred, when available) - **Option B**: Curl fallback with proper security measures Security measures implemented: - `mktemp -m 600` for restrictive file permissions - `jq --rawfile` for safe JSON construction (avoids command substitution vulnerabilities) - Proper cleanup of temporary files ## Test plan - [ ] Test `/debug-report` when MCP tools ARE available (Option A should work) - [ ] Test `/debug-report` when MCP tools are NOT available with credentials configured - [ ] Test `/debug-report` when MCP tools are NOT available without credentials (should save locally) Fixes #100 --- 🤖 Generated with [Claude Code](https://claude.ai/code)
lmiranda added 3 commits 2026-01-22 19:19:55 +00:00
Reviewed-on: #102
When MCP tools are not available in a session (the very scenario
/debug-report is designed to diagnose), the command now falls back to:

1. Check for Gitea credentials at ~/.config/claude/gitea.env
2. Use curl + jq to create the issue via Gitea REST API
3. If no credentials, save report to local file for manual submission

Security measures:
- Uses mktemp -m 600 for restrictive file permissions
- Uses jq --rawfile for safe JSON construction (no command substitution)
- Proper cleanup of temporary files

Fixes #100

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
lmiranda added 1 commit 2026-01-22 19:28:11 +00:00
The MCP server's branch-aware security blocks write operations on
protected branches (main, fix/*, etc). After pushing a feature branch
and creating a PR, we must switch back to development before adding
comments to issues via MCP tools.
lmiranda merged commit 0b23a02886 into development 2026-01-22 20:01:33 +00:00
lmiranda deleted branch fix/issue-100-debug-report-fallback 2026-01-22 20:01:33 +00:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: personal-projects/leo-claude-mktplace#103