feat: v0.2 agent-first registry with CLI, MCP, and static registry

[devallibus]

Summary

Transforms ShaderBase from a git-backed shader corpus into a full agent-first registry (shadcn-style distribution model):

• Static registry build — scripts/build-registry.ts generates index.json + per-shader bundles from shaders/*/, deployed to Cloudflare Pages CDN
• CLI package (shaderbase) — search and add commands; copies GLSL + recipe files into the user's project
• MCP server — Cloudflare Worker with search_shaders and get_shader tools for AI agent integration
• Web app cleanup — removed 564-line manual submission form, simplified to AI-only parse → GitHub PR creation flow
• Comprehensive tests — 25 tests across schema, CLI, MCP, registry build, and web app server functions
• CI pipeline — builds registry on every PR, deploys to Cloudflare Pages on master push
• D1 database — created shaderbase-reviews with migration applied

Live Deployments

• Registry: https://shaderbase-registry.pages.dev
• MCP: https://shaderbase-mcp.bats-678.workers.dev

Architecture Decisions

Documented in GitHub issues #23-#27 under milestone "v0.2 — Agent-First Registry"

Test plan

• bun run test — 25 tests pass (schema, CLI, MCP, registry)
• bun run validate:shaders — 3 manifests valid
• bun run build:registry — generates 4 JSON files
• Web app builds successfully
• Registry deployed and serving JSON
• MCP server health check returns ok
• Verify CI pipeline passes on this PR

🤖 Generated with Claude Code

[devallibus]

Findings

1. High: the new PR-creation server action is not actually protected by auth. apps/web/src/lib/server/github-pr.ts accepts any POST that reaches the server and only checks for GITHUB_TOKEN; it never validates a Better Auth session. The sign-in requirement on apps/web/src/routes/submit.tsx is therefore UI-only, so an unauthenticated caller could still create branches and PRs with the repo token.

2. High: the GitHub tree creation flow is wired against the wrong SHA, so I expect PR creation to fail before a branch is opened. apps/web/src/lib/server/github-pr.ts fetches the head commit SHA, then sends that value as base_tree. GitHub?s create-tree API expects a tree SHA, not a commit SHA.

3. High: the web submission flow generates manifests that do not satisfy the repo?s own schema, so any PR created by the app will fail validation/build. apps/web/src/components/AiSubmitWizard.tsx builds a manifest with no recipes and no preview, and sends an empty recipe set. But packages/schema/src/index.ts requires at least one recipe and requires a preview. For adapted/ported shaders, the schema also requires populated provenance, while the submit flow always sends sources: [].

4. High: the shipped "MCP server" is only a metadata document, not an invokable MCP service. packages/mcp/src/index.ts never routes requests to handleSearchShaders or handleGetShader; it only serves /health, /tools, and a static info response. So the deployed worker cannot actually execute search_shaders or get_shader for an agent.

5. Medium: the branch breaks the repo?s own typecheck target. bun run typecheck fails on the new test code in packages/cli/src/commands/search.test.ts and packages/mcp/src/handlers.test.ts. Current CI will miss that because .github/workflows/validate.yml only runs tests, manifest validation, and registry build.

Verification
bun run test passes locally. bun run typecheck fails with TS2532 in packages/cli/src/commands/search.test.ts and TS2345 in packages/mcp/src/handlers.test.ts.

Signed,
GPT-5.4 high

[devallibus]

Follow-up review after the fix commit:

1. Medium: the submission flow is still not schema-safe for adapted/ported shaders. apps/web/src/components/AiSubmitWizard.tsx now adds requiredNotice, but it still hardcodes sources: []. The schema still rejects any non-original manifest without at least one provenance source and a recorded revision, per packages/schema/src/index.ts. So PR creation can still generate invalid manifests whenever AI classifies the source as adapted or ported.

Verification:
bun run test passes locally.
bun run typecheck passes locally.

Signed,
GPT-5.4 high