Merge remote-tracking branch 'origin/staging' into codex/telegram-hot-activation-tests

# Conflicts:
#	src/extensions/manager.rs

Author: henrypark133

.github/workflows/code_style.yml

@@ -86,37 +86,13 @@ jobs:
       uses: actions/checkout@v6
       with:
         fetch-depth: 0
+    - uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
     - name: Check for .unwrap(), .expect(), assert!() in production code
       run: |
         BASE="${{ github.event.pull_request.base.sha }}"
-        # Get added lines in .rs files (production only, exclude tests/)
-        ADDED=$(git diff "$BASE"...HEAD -- 'src/**/*.rs' 'crates/**/*.rs' \
-          | grep -E '^\+[^+]' || true)
-
-        if [ -z "$ADDED" ]; then
-          echo "No production Rust changes detected."
-          exit 0
-        fi
-
-        # Match panic-inducing patterns, excluding test code and safety suppressions
-        VIOLATIONS=$(echo "$ADDED" \
-          | grep -E '\.(unwrap|expect)\(|[^_]assert(_eq|_ne)?!' \
-          | grep -Ev 'debug_assert|// safety:|#\[cfg\(test\)\]|#\[test\]|mod tests' \
-          || true)
-
-        if [ -n "$VIOLATIONS" ]; then
-          echo "::error::Found .unwrap(), .expect(), or assert!() in production code."
-          echo "Production code must use proper error handling instead of panicking."
-          echo "Suppress false positives with an inline '// safety: <reason>' comment."
-          echo ""
-          echo "$VIOLATIONS" | head -20
-          echo ""
-          COUNT=$(echo "$VIOLATIONS" | wc -l | tr -d ' ')
-          echo "Total: $COUNT violation(s)"
-          exit 1
-        fi
-
-        echo "OK: No panic-inducing calls in changed production code."
+        python3 scripts/check_no_panics.py --base "$BASE" --head HEAD
 
   # Roll-up job for branch protection
   code-style:

.github/workflows/e2e.yml

@@ -52,7 +52,7 @@ jobs:
           - group: features
             files: "tests/e2e/scenarios/test_skills.py tests/e2e/scenarios/test_tool_approval.py"
           - group: extensions
-            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py"
+            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py tests/e2e/scenarios/test_oauth_credential_fallback.py tests/e2e/scenarios/test_routine_oauth_credential_injection.py"
     steps:
       - uses: actions/checkout@v6
 

.gitignore

@@ -14,6 +14,10 @@
 
 target/
 
+# Python
+__pycache__/
+*.pyc
+
 # Benchmark results (local runs, not committed)
 bench-results/
 

Cargo.lock

@@ -132,14 +132,15 @@ fn embed_registry_catalog(root: &Path) {
         // No registry dir: write empty catalog
         fs::write(
             &out_path,
-            r#"{"tools":[],"channels":[],"bundles":{"bundles":{}}}"#,
+            r#"{"tools":[],"channels":[],"mcp_servers":[],"bundles":{"bundles":{}}}"#,
         )
         .unwrap();
         return;
     }
 
     let mut tools = Vec::new();
     let mut channels = Vec::new();
+    let mut mcp_servers = Vec::new();
 
     // Collect tool manifests
     let tools_dir = registry_dir.join("tools");
@@ -153,6 +154,12 @@ fn embed_registry_catalog(root: &Path) {
         collect_json_files(&channels_dir, &mut channels);
     }
 
+    // Collect MCP server manifests
+    let mcp_servers_dir = registry_dir.join("mcp-servers");
+    if mcp_servers_dir.is_dir() {
+        collect_json_files(&mcp_servers_dir, &mut mcp_servers);
+    }
+
     // Read bundles
     let bundles_path = registry_dir.join("_bundles.json");
     let bundles_raw = if bundles_path.is_file() {
@@ -163,9 +170,10 @@ fn embed_registry_catalog(root: &Path) {
 
     // Build the combined JSON
     let catalog = format!(
-        r#"{{"tools":[{}],"channels":[{}],"bundles":{}}}"#,
+        r#"{{"tools":[{}],"channels":[{}],"mcp_servers":[{}],"bundles":{}}}"#,
         tools.join(","),
         channels.join(","),
+        mcp_servers.join(","),
         bundles_raw,
     );
 

build.rs

@@ -6,6 +6,12 @@ rust-version = "1.92"
 description = "Prompt injection defense, input validation, secret leak detection, and safety policy enforcement"
 authors = ["NEAR AI <[email protected]>"]
 license = "MIT OR Apache-2.0"
+homepage = "https://github.com/nearai/ironclaw"
+repository = "https://github.com/nearai/ironclaw"
+publish = false
+
+[package.metadata.dist]
+dist = false
 
 [dependencies]
 aho-corasick = "1"

crates/ironclaw_safety/Cargo.toml

@@ -2,7 +2,7 @@
   "name": "discord",
   "display_name": "Discord Channel",
   "kind": "channel",
-  "version": "0.2.1",
+  "version": "0.2.0",
   "wit_version": "0.3.0",
   "description": "Talk to your agent in Discord",
   "keywords": [

registry/channels/discord.json

@@ -0,0 +1,9 @@
+{
+  "name": "asana",
+  "display_name": "Asana",
+  "kind": "mcp_server",
+  "description": "Connect to Asana for task management, projects, and team coordination",
+  "keywords": ["tasks", "projects", "management", "team"],
+  "url": "https://mcp.asana.com/v2/mcp",
+  "auth": "dcr"
+}

registry/mcp-servers/asana.json

@@ -0,0 +1,9 @@
+{
+  "name": "cloudflare",
+  "display_name": "Cloudflare",
+  "kind": "mcp_server",
+  "description": "Connect to Cloudflare for DNS, Workers, KV, and infrastructure management",
+  "keywords": ["cdn", "dns", "workers", "hosting", "infrastructure"],
+  "url": "https://mcp.cloudflare.com/mcp",
+  "auth": "dcr"
+}

registry/mcp-servers/cloudflare.json

@@ -0,0 +1,9 @@
+{
+  "name": "intercom",
+  "display_name": "Intercom",
+  "kind": "mcp_server",
+  "description": "Connect to Intercom for customer messaging, support, and engagement",
+  "keywords": ["support", "customers", "messaging", "chat", "helpdesk"],
+  "url": "https://mcp.intercom.com/mcp",
+  "auth": "dcr"
+}