Bind patched Penpot MCP into designer + design-reviewer containers #64
Labels
No labels
area:agents
area:dashboard
area:database
area:design
area:design-review
area:flows
area:infra
area:meta
area:security
area:sessions
area:webhook
area:workdir
security
type:bug
type:chore
type:meta
type:user-story
No milestone
No project
No assignees
1 participant
dev
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
charles/claude-hooks#64
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
User story
As the designer agent, I want the patched Penpot MCP server registered in my container with the right env vars, so that my
design-implementskill can actually create pages/frames/shapes on Penpot files instead of aborting with "nomcp__penpot__*namespace".Context
First live dispatch on #62 failed cleanly — the designer read the spec, listed its MCP surface, found only
claude.ai Excalidraw,Context7,Gmail,Google Calendar,Google Drive,Hugging Face, andforgejo— nomcp__penpot__*— and per thedesign-implementskill rule ("container env is wrong — surface it, don't silently retry") posted a diagnostic comment and aborted:The MCP patches already live under
~/Workspace/penpot-mcp-server/on the claude-hooks host. They includeAUTHELIA_BASIC_AUTH(forward-auth),PENPOT_AUTH_TOKEN_COOKIE(pre-seeded OIDC session — this Penpot instance haslogin-with-passworddisabled and tokens off), and a DB→RPC fallback onget_file_info. Host secrets are at~/.config/claude-hooks/{penpot-creds,authelia-creds,penpot-cookie}.Acceptance criteria
Image
claude-hooks:dev(or a new tagged variant for design agents, e.g.claude-hooks:designer) includes the patchedpenpot-mcp-serverbinary. Bake-in pattern mirrors the forgejo-mcp patch approach (see commit109fb12 feat(infra): bake patched forgejo-mcp into the image).Dockerfile+/home/charles/Workspace/penpot-mcp-server/pinned to a known commit (vendor via submodule or copy-on-build).MCP registration
forgejo-mcp) includes apenpotentry invoking the patched binary with the right env vars.designeranddesign-reviewercontainers embed the Penpot MCP.boss/dev/reviewerstay code-only.Env vars passed from host secrets
AUTHELIA_BASIC_AUTH=<user>:<password>from~/.config/claude-hooks/authelia-creds(format: two lines,userthenpassword).PENPOT_AUTH_TOKEN_COOKIE= contents of~/.config/claude-hooks/penpot-cookie(single-line JWE).PENPOT_EMAIL,PENPOT_PASSWORD= lines 1+2 of~/.config/claude-hooks/penpot-creds(even though login-with-password is disabled on our instance, the MCP expects them to be set — empty strings cause an earlier crash per the.envcomment).PENPOT_BASE_URL=https://design.jacquin.app,PENPOT_PUBLIC_URL= same.Smoke
scripts/smoke-creds.sh(or extend the existing one) also probes Penpot MCP presence inside thedesignercontainer — something likedocker exec claude-hooks-designer <command> list-tools | grep -c mcp__penpot__returning > 0.area:designoff/on). The designer task should now drive the MCP, create a Penpot file, and post a handoff comment. Thehello-framewithHELLOtext is the verification artifact.Docs
CLAUDE.md"Penpot MCP auth" paragraph already mentions the cookie + Authelia-basic bits. Add a pointer to the smoke script and note which containers carry the MCP (and which don't).Out of scope
376f8f9); this ticket is pure plumbing.label_updated(when a second label is added to an already-area:designissue) — noted infix/forgejo-label-updated-event/ PR #63; separate story if the churn bites.References
/home/charles/Workspace/penpot-mcp-server/(seesrc/penpot_mcp/{config.py,services/api.py,services/changes.py}for the three patches)~/.config/claude-hooks/{penpot-creds,authelia-creds,penpot-cookie}(all 0600)109fb12 feat(infra): bake patched forgejo-mcp into the image (closes #32)— mirror the patternmcp_merge_bug.md— documents the forgejo-mcp patch bake-inDependencies
main).main.