SecondShift v0.1.0b7

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0b7-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0b7-py3-none-any.whl
secondshift up

SecondShift 0.1.0b7

This beta fixes MCP sign-in for servers like Grafana Cloud and Wildedge. Links
people share, such as invites and sign-in links, no longer sit under /-/.
GitHub sign-in only shows when it is set up.

MCP connections

• Extra OAuth scopes. Some servers grant more scopes than SecondShift asks
  for. Grafana Cloud adds mcp:* scopes even after read-only consent. Before,
  sign-in refused the grant and saved nothing. Now a grant is accepted when it
  has every scope SecondShift asked for. The connection shows a "Connected with
  additional permissions" warning that lists the extras. The stored token keeps
  all granted permissions. A grant that is missing a required scope is still
  refused (#173).
• Refresh and reconnect. A token refresh updates the granted scopes and
  the warning. If a refresh loses a required scope, the connection expires.
  Reconnecting asks for the original scopes, not the extras.
• Local schema references. Tool input schemas may now use $ref to
  definitions in the same schema, such as a nullable pagination cursor.
  Before, sign-in failed with "MCP schema references are not supported."
  External, missing and cyclic references are still refused. References are
  checked without network access, within depth and size limits (#172).

New URLs

Only admin and health stay under /-/ (#169).

Before	After
/-/invite/<token>/	/invite/<token>/
/-/sign-in/<token>/	/sign-in/<token>/
/-/github/connect/	/github/connect/
/-/github/callback/	/github/callback/

The old paths don't redirect. Invite and sign-in links made before the upgrade
stop working. Create new ones.

GitHub sign-in

• The sign-in page shows GitHub only when GITHUB_CLIENT_ID and
  GITHUB_CLIENT_SECRET are both set. Before, the button showed on every
  install and led to a GitHub error page (#170).
• The button reads "Continue with GitHub" and shows the GitHub logo (#171).

Upgrade compatibility

From beta 6, keep your existing data, private configuration and encryption
keys. Install the new wheel or update the pinned container image to
ghcr.io/piotrekno1/second-shift:0.1.0b7. Then run the normal migration
commands. This release adds no migrations.

Update your GitHub App callback URL. In the App settings on GitHub, change
it to https://secondshift.example.com/github/callback/, using your hostname.
For local development, use http://localhost:5173/github/callback/. Until you
do, connecting GitHub fails with a redirect URL error.

Existing MCP OAuth connections keep working. Their current scopes become the
required scopes until their next refresh or sign-in.

From older alpha builds, fresh databases are still required. Follow the
beta 1 upgrade instructions.

Limitations

The tests use stand-ins for GitHub, the model provider and S3. The Grafana
Cloud scope warning was checked with a sample token grant, not a live
sign-in. Real GitHub.com and model providers, public HTTPS certificates, and
production S3 permissions still need checking on your own deployment. See the
deployment guide.

What's Changed

• Point install docs at 0.1.0b6 by @piotrekno1 in #167
• Describe manual, scheduled, and webhook skill runs by @piotrekno1 in #168
• Keep only admin and health under /-/ by @piotrekno1 in #169
• Hide GitHub sign-in when it has no credentials by @piotrekno1 in #170
• Show the GitHub logo on the sign-in button by @piotrekno1 in #171
• Allow bounded local JSON Schema references in MCP tools by @piotrekno1 in #172
• Accept required MCP OAuth scopes and warn about additional permissions by @piotrekno1 in #173
• Release 0.1.0b7 by @piotrekno1 in #174

Full Changelog: v0.1.0b6...v0.1.0b7