chore(deps): update docker.io/library/python docker tag to v3.15

Reviewed-on: #62

.gitea/workflows/docker-build.yaml

@@ -32,15 +32,32 @@ jobs:
           docker rm -f qdrant-${{ github.run_id }} 2>/dev/null || true
           docker run -d --name qdrant-${{ github.run_id }} \
             --network "container:$(hostname)" \
-            docker.io/qdrant/qdrant:latest
+            docker.io/qdrant/qdrant:v1.19
 
       - name: Wait for Qdrant
         run: |
-          for i in $(seq 1 30); do
+          # /healthz answers before the storage engine accepts writes, and a cold
-            curl -s http://localhost:6333/healthz && echo "QDRANT ready" && break
+          # container on a loaded host can take several seconds to create its
-            echo "Waiting for Qdrant... ($i/30)"
+          # first collection. Gate on a real write round-trip, not on /healthz.
+          ready=""
+          for i in $(seq 1 60); do
+            if curl -sf "http://localhost:6333/healthz" > /dev/null 2>&1 \
+              && curl -sf -X PUT "http://localhost:6333/collections/ci_readiness_probe?timeout=60" \
+                   -H 'Content-Type: application/json' \
+                   -d '{"vectors":{"size":4,"distance":"Cosine"}}' > /dev/null 2>&1; then
+              curl -sf -X DELETE "http://localhost:6333/collections/ci_readiness_probe" > /dev/null 2>&1 || true
+              ready="yes"
+              echo "QDRANT ready: write path OK (attempt $i)"
+              break
+            fi
+            echo "Waiting for Qdrant... ($i/60)"
             sleep 1
           done
+          if [ -z "$ready" ]; then
+            echo "Qdrant write path never became ready"
+            docker logs --tail 100 qdrant-${{ github.run_id }} || true
+            exit 1
+          fi
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
@@ -53,6 +70,15 @@ jobs:
         env:
           QDRANT_URL: http://localhost:6333
           COLLECTION_NAME: test_mcp_maildir
+          # The qdrant client defaults to a 5s request timeout, which a cold
+          # collection on a shared runner can exceed; this job has no SLA.
+          QDRANT_TIMEOUT: "60"
+
+      - name: Qdrant diagnostics
+        if: failure()
+        run: |
+          docker ps -a || true
+          docker logs --tail 200 qdrant-${{ github.run_id }} || true
 
       - name: Cleanup Qdrant
         if: always()

.gitea/workflows/main.yaml

@@ -45,17 +45,32 @@ jobs:
         run: |
           docker run -d --name qdrant-${{ github.run_id }} \
             --network "container:$(hostname)" \
-            docker.io/qdrant/qdrant:latest
+            docker.io/qdrant/qdrant:v1.19
 
       - name: Wait for Qdrant
         run: |
-          for i in $(seq 1 30); do
+          # /healthz answers before the storage engine accepts writes, and a cold
-            curl -s http://localhost:6333/healthz \
+          # container on a loaded host can take several seconds to create its
-              && echo "QDRANT ready" && break
+          # first collection. Gate on a real write round-trip, not on /healthz.
-            echo "Waiting for Qdrant... ($i/30)"
+          ready=""
+          for i in $(seq 1 60); do
+            if curl -sf "http://localhost:6333/healthz" > /dev/null 2>&1 \
+              && curl -sf -X PUT "http://localhost:6333/collections/ci_readiness_probe?timeout=60" \
+                   -H 'Content-Type: application/json' \
+                   -d '{"vectors":{"size":4,"distance":"Cosine"}}' > /dev/null 2>&1; then
+              curl -sf -X DELETE "http://localhost:6333/collections/ci_readiness_probe" > /dev/null 2>&1 || true
+              ready="yes"
+              echo "QDRANT ready: write path OK (attempt $i)"
+              break
+            fi
+            echo "Waiting for Qdrant... ($i/60)"
             sleep 1
           done
-          curl -s http://localhost:6333/healthz > /dev/null
+          if [ -z "$ready" ]; then
+            echo "Qdrant write path never became ready"
+            docker logs --tail 100 qdrant-${{ github.run_id }} || true
+            exit 1
+          fi
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
@@ -67,6 +82,15 @@ jobs:
         env:
           QDRANT_URL: http://localhost:6333
           COLLECTION_NAME: test_mcp_maildir
+          # The qdrant client defaults to a 5s request timeout, which a cold
+          # collection on a shared runner can exceed; this job has no SLA.
+          QDRANT_TIMEOUT: "60"
+
+      - name: Qdrant diagnostics
+        if: failure()
+        run: |
+          docker ps -a || true
+          docker logs --tail 200 qdrant-${{ github.run_id }} || true
 
       - name: Cleanup Qdrant
         if: always()

.gitea/workflows/tag.yaml

@@ -95,3 +95,22 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           pull: true
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{{"ref":"main"}}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   qdrant:
-    image: docker.io/qdrant/qdrant:latest
+    image: docker.io/qdrant/qdrant:v1.19
     container_name: mcp_maildir_qdrant
     ports:
       - "127.0.0.1:6333:6333" # REST API
@@ -15,7 +15,7 @@ services:
       dockerfile: pkg/Dockerfile
     container_name: mcp_maildir_server
     ports:
-      - "127.0.0.1:8000:8000" # Expose the MCP HTTP (SSE) server
+      - "127.0.0.1:8000:8000" # Expose the MCP Streamable HTTP server (/mcp)
     env_file:
       - .env
     environment:

pkg/Dockerfile

@@ -1,5 +1,5 @@
 # 3.13, because with 3.14 it requires gcc (wheels not available)
-FROM docker.io/library/python:3.14-slim
+FROM docker.io/library/python:3.15-slim
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE=1

renovate.json

@@ -3,9 +3,12 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Track qdrant/qdrant Docker image from docker-compose.yml (native manager missed it)",
+      "description": "Track the pinned qdrant/qdrant image in docker-compose.yml and the CI workflows (native manager missed it)",
-      "managerFilePatterns": ["/^docker-compose\\.ya?ml$/"],
+      "managerFilePatterns": [
-      "matchStrings": ["image:\\s*(?:docker\\.io/)?qdrant/qdrant:(?<currentValue>[^\\s]+)"],
+        "/^docker-compose\\.ya?ml$/",
+        "/^\\.gitea/workflows/.*\\.ya?ml$/"
+      ],
+      "matchStrings": ["(?:docker\\.io/)?qdrant/qdrant:(?<currentValue>[^\\s\"']+)"],
       "depNameTemplate": "qdrant/qdrant",
       "datasourceTemplate": "docker"
     }

src/server.py

@@ -9,6 +9,7 @@ from typing import Any, Optional
 import qdrant_client as qdrant_pkg
 from dateutil import parser as date_parser
 from email.utils import parseaddr
+import uvicorn
 from dotenv import load_dotenv
 from starlette.requests import Request
 from starlette.responses import JSONResponse
@@ -36,6 +37,10 @@ COLLECTION_NAME = os.environ.get("COLLECTION_NAME", "")
 EMBEDDING_MODEL_NAME = os.environ.get("EMBEDDING_MODEL_NAME", "BAAI/bge-small-en-v1.5")
 DEFAULT_LIMIT = int(os.environ.get("SEARCH_LIMIT", "50"))
 
+# Per-request timeout (seconds) for Qdrant. The client default is 5s, which is
+# tight for a cold collection or a busy host: unset means keep that default.
+QDRANT_TIMEOUT = int(os.environ["QDRANT_TIMEOUT"]) if os.environ.get("QDRANT_TIMEOUT") else None
+
 if not QDRANT_URL:
     raise ValueError("QDRANT_URL environment variable is required.")
 if not COLLECTION_NAME:
@@ -60,8 +65,8 @@ def get_qdrant_client() -> QdrantClient:
     """Returns a singleton Qdrant client."""
     global _qdrant_client
     if _qdrant_client is None:
-        logger.info(f"Connecting to Qdrant at {QDRANT_URL}")
+        logger.info(f"Connecting to Qdrant at {QDRANT_URL} (timeout={QDRANT_TIMEOUT})")
-        _qdrant_client = QdrantClient(url=QDRANT_URL)
+        _qdrant_client = QdrantClient(url=QDRANT_URL, timeout=QDRANT_TIMEOUT)
     return _qdrant_client
 
 
@@ -340,6 +345,23 @@ def read_email(message_id: str):
         return {"error": f"read_email failed: {exc}"}
 
 
+# Streamable HTTP is the transport supported by current MCP clients (OpenCode,
+# Claude, ...). The legacy SSE transport is deprecated and is also a POST
+# target for clients that only speak Streamable HTTP, which answers 405.
+MCP_HOST = "0.0.0.0"
+MCP_PORT = 8000
+MCP_HTTP_PATH = "/mcp"
+
+
+def build_app():
+    """Builds the ASGI app serving the MCP endpoint over Streamable HTTP.
+
+    The MCP endpoint lives at MCP_HTTP_PATH; the custom route declared above
+    keeps serving GET /health for the Kubernetes probes.
+    """
+    return mcp.http_app(path=MCP_HTTP_PATH)
+
+
 if __name__ == "__main__":
     logger.info("Initializing models before starting server...")
     try:
@@ -348,6 +370,5 @@ if __name__ == "__main__":
     except Exception as e:
         logger.error(f"Failed to load models: {e}")
 
-    logger.info("Starting SSE server on 0.0.0.0:8000...")
+    logger.info(f"Starting Streamable HTTP server on {MCP_HOST}:{MCP_PORT}{MCP_HTTP_PATH}...")
-    # Start the MCP server using SSE (Server-Sent Events) over HTTP
+    uvicorn.run(build_app(), host=MCP_HOST, port=MCP_PORT)
-    mcp.run(transport="sse", host="0.0.0.0", port=8000)

tests/test_transport.py

@@ -0,0 +1,27 @@
+"""Transport-level tests for the mcp-maildir ASGI app.
+
+Current MCP clients (OpenCode, Claude, ...) only speak Streamable HTTP: they
+POST JSON-RPC to the configured URL. Serving the legacy SSE transport alone
+makes those clients fail with `405 Method Not Allowed`, so the app built by
+`server.build_app()` must expose the MCP endpoint at /mcp.
+
+Env vars are set in tests/conftest.py (shared session-wide).
+"""
+
+from server import build_app, MCP_HTTP_PATH
+
+
+def app_paths() -> set:
+    return {getattr(route, "path", None) for route in build_app().routes}
+
+
+class TestTransport:
+    def test_mcp_endpoint_is_streamable_http(self):
+        assert MCP_HTTP_PATH == "/mcp"
+        assert MCP_HTTP_PATH in app_paths()
+
+    def test_health_endpoint_is_exposed_for_probes(self):
+        assert "/health" in app_paths()
+
+    def test_legacy_sse_endpoint_is_gone(self):
+        assert "/sse" not in app_paths()