feat(0017): undo group transactions — begin/end/rollback, envelope rollback_available, HL 28

.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+# Quality gates: ruff lint/format, basedpyright, pytest
+# Node 20 is deprecated on Actions runners; prefer Node 24-native action major lines.
+# See: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Prefer Node 24 runtime for JS actions while ecosystem finishes migration
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  quality:
+    name: Lint · Format · Types · Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v9.0.0
+        with:
+          enable-cache: true
+
+      - name: Python toolchain
+        run: uv python install 3.13
+
+      - name: Sync project (incl. dev group)
+        run: uv sync --group dev
+
+      - name: Ruff lint
+        run: uv run ruff check .
+
+      - name: Ruff format check
+        run: uv run ruff format --check .
+
+      - name: Type check (basedpyright)
+        run: uv run basedpyright
+
+      - name: Pytest (unit / offline)
+        run: uv run pytest -m "not integration and not slow"

.gitignore

@@ -1,14 +1,40 @@
 /.idea/
 *.egg-info/
 /__pycache__/
+**/__pycache__/
 .venv/
 *.pyc
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+dist/
+build/
+output/
+*.xcf
 
 # macOS
 .DS_Store
 
 # Claude Code working directory
 /.claude/
 
-# Generated test artifacts
-/tests/continuous_edit_test/output/
+# Generated live-script artifacts
+/scripts/continuous_edit_test/output/
+
+# --- Local agent / governance (not committed; personal orchestration) ---
+.agents/
+AGENTS.md
+conductor/
+
+# Ledgerful + AI-Brains local state / secrets
+.ledgerful/
+.env
+.env.*
+!.env.example
+
+# Local Grok / IDE
+.grok/
+.vscode/
+.cursor/

.pre-commit-config.yaml

@@ -1,6 +1,9 @@
+# Ruff rev must stay aligned with pyproject.toml / CI (ruff==0.16.1 as of 2026-08-02)
+# Local: ruff-check may --fix; CI runs check-only (no --fix) via ci.yml.
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.11
+    rev: v0.16.1
     hooks:
       - id: ruff-check
         args: [--fix]
+      - id: ruff-format

CLAUDE.md

@@ -12,7 +12,7 @@ This is a GIMP MCP (Model Context Protocol) integration that enables external co
 ## Architecture
 
 The system uses a client-server architecture:
-- GIMP Plugin creates a socket server (localhost:9877) that accepts Python-Fu commands
+- GIMP Plugin creates a socket server (`127.0.0.1:9877`, session auth) — arbitrary Python-Fu/`cmds` disabled by default
 - MCP Server connects to this socket and exposes a `call_api` tool for MCP clients
 - Commands are executed in GIMP's Python-Fu environment with access to the full GIMP 3.2 API
 
@@ -32,10 +32,11 @@ path is shown in **Edit > Preferences > Folders > Plug-ins**. Base dirs per plat
 BASE="$HOME/snap/gimp/current/.config/GIMP"
 GIMP_DIR="$(ls -d "$BASE"/3.* 2>/dev/null | sort -V | tail -1)"
 mkdir -p "$GIMP_DIR/plug-ins/gimp-mcp-plugin"
-cp gimp-mcp-plugin.py "$GIMP_DIR/plug-ins/gimp-mcp-plugin/"
+cp gimp-mcp-plugin.py gimp_mcp_security.py gimp_mcp_snapshot.py gimp_mcp_export.py \
+  "$GIMP_DIR/plug-ins/gimp-mcp-plugin/"
 chmod +x "$GIMP_DIR/plug-ins/gimp-mcp-plugin/gimp-mcp-plugin.py"
 ```
-Then start it from **Tools > MCP > Start MCP Server** in GIMP.
+Copy all four files (`gimp-mcp-plugin.py`, `gimp_mcp_security.py`, `gimp_mcp_snapshot.py`, `gimp_mcp_export.py`) into the plug-ins folder; missing any helper fails closed at plugin import. Then start it from **Tools > MCP > Start MCP Server** in GIMP.
 
 ### MCP Server Configuration
 Add to Claude Desktop config (`~/.config/Claude/claude_desktop_config.json`):
@@ -86,7 +87,7 @@ images = Gimp.get_images()
 image = images[0]  # or image1 = images[0]
 layers = image.get_layers()
 layer = layers[0]  # or layer1 = layers[0]
-drawable = layer   # or drawable1 = layer
+drawable = layer  # or drawable1 = layer
 ```
 
 ### Common Operations