feat: MCP server for artifact cleanup (supersedes #17, with delete guard)

[kunjee17]

Supersedes #17. Contains @NotYash1066's original commit unchanged, plus one fix commit on top.

I could not push directly to the fork branch for #17, so this branch carries their work forward. Their commit is preserved, so authorship survives in history. Close #17 once this merges.

Why the extra commit

clean_artifacts deleted any path handed to it. Caller-supplied strings went straight to remove_dir_all with no validation. The caller here is a model, so a hallucinated or prompt-injected path meant silent recursive deletion. Verified against the built binary before the fix:

$ echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"clean_artifacts",
  "arguments":{"paths":["/tmp/irona-notartifact/my-documents"]}}}' | irona --mcp
{"result":{"structuredContent":{"deleted_count":1,"total_freed_bytes":10, ...
>>> DELETED

That directory held a text file and no marker. destructiveHint: true is advisory — clients are not obliged to confirm on it.

Every path is now canonicalized and gated on a new scanner::is_artifact, which accepts a directory only when a marker file sits beside it (target/ next to a Cargo.toml) or a .gitignore rule matches it. One bad path fails the whole call and deletes nothing. Same input after the fix:

{"error":{"code":-32602,"message":"refusing to delete /tmp/irona-notartifact/my-documents:
 not a build artifact directory. Only paths returned by scan_artifacts can be cleaned."}}
>>> SURVIVED

The TUI lost its streaming scan. Splitting scan into scan_artifacts made the parallel dir_size phase collect into a Vec before sending anything, so the list stayed empty until the whole scan finished — noticeable on a large workspace, since dir_size is the slow phase. Phase 1 is now a shared collect_candidates helper: scan streams each entry as its size lands, scan_artifacts collects for MCP.

Also flips isError when some deletions fail, instead of always reporting false.

Verification

• cargo nextest run — 63 pass (54 from feat: add MCP server for artifact cleanup #17, 9 new)
• cargo clippy --all-targets -- -D warnings — clean
• new tests: non-artifact refused, mixed batch refused wholesale, gitignore-detected dir still cleanable, is_artifact accepts marker-backed and gitignore-matched dirs, rejects plain dirs / target/ without Cargo.toml / denylisted .git, and scan emits all Found messages before Done
• live stdio check of both the refusal and a real target/ still being cleaned

Not addressed

initialize still echoes back whatever protocolVersion the client sends, including unsupported ones, and scan_artifacts has no cap on result count. Both are minor and worth a follow-up rather than holding this up.

🤖 Generated with Claude Code