Set gRPC socket to 0660 for group access

The MCP agent needs to access the mc-proxy admin socket. The agent
runs as the mcp user in the mc-proxy group. 0600 blocked group
access; 0660 allows it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint proto proto-lint clean docker all devserver
+.PHONY: build test vet lint proto proto-lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mc-proxy:
 	go build $(LDFLAGS) -o mc-proxy ./cmd/mc-proxy
@@ -33,7 +35,10 @@ clean:
 	rm -f mc-proxy mcproxyctl
 
 docker:
-	docker build --build-arg VERSION=$(shell git describe --tags --always --dirty) -t mc-proxy -f Dockerfile .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mc-proxy:$(VERSION) -f Dockerfile .
+
+push: docker
+	docker push $(MCR)/mc-proxy:$(VERSION)
 
 devserver: mc-proxy
 	@mkdir -p srv

flake.nix

@@ -27,6 +27,14 @@
             "-w"
             "-X main.version=${version}"
           ];
+          postInstall = ''
+            mkdir -p $out/share/zsh/site-functions
+            mkdir -p $out/share/bash-completion/completions
+            mkdir -p $out/share/fish/vendor_completions.d
+            $out/bin/mcproxyctl completion zsh > $out/share/zsh/site-functions/_mcproxyctl
+            $out/bin/mcproxyctl completion bash > $out/share/bash-completion/completions/mcproxyctl
+            $out/bin/mcproxyctl completion fish > $out/share/fish/vendor_completions.d/mcproxyctl.fish
+          '';
         };
       };
     };

internal/grpcserver/grpcserver.go

@@ -60,7 +60,7 @@ func New(cfg config.GRPC, srv *server.Server, store *db.Store, logger *slog.Logg
 		return nil, nil, fmt.Errorf("listening on unix socket %s: %w", path, err)
 	}
 
-	if err := os.Chmod(path, 0600); err != nil {
+	if err := os.Chmod(path, 0660); err != nil {
 		_ = ln.Close()
 		return nil, nil, fmt.Errorf("setting socket permissions: %w", err)
 	}