serve honours TPK_STREAM_PREFIX; report the running version everywhere (#84, #85)

[gangtao]

Closes #84. Closes #85.

#84 — tpk serve / stdio MCP ignored TPK_STREAM_PREFIX

ingest, export/import and auth honoured the prefix; serve and mcp_server.main() did not — ensure_schema, corpus seeding, seed_admin, the shared KnowledgeGraph, the chat agent's live-corpus provider and create_app() all ran unprefixed. A prefixed deployment would ingest into one set of streams and serve from another, and TPK_STREAM_PREFIX=x tpk serve silently ran on the real streams (how this was found).

The prefix is now resolved once in serve / main() and threaded through all of those (create_app already passed it to auth, API, usage, audit, graph and /mcp).

#85 — which version is running?

The package said 0.1.0 while releases are v0.0.x, and nothing reported a version at runtime.

• src/tpk/version.py — one resolver: TPK_VERSION / TPK_COMMIT (baked into the published images — the build context has no .git, so the image can't work it out itself) → git describe for a checkout → dev. tpk.__version__ uses it; pyproject.toml's version becomes a documented placeholder (0.0.0) that is reported nowhere, so there is no hand-edited constant to forget.
• Build — Dockerfile ARG TPK_VERSION / TPK_COMMIT → ENV in both final stages (placed late, so no extra cache busting); the Docker workflow passes the tag without its v (or dev-<sha> for branch/PR builds) and the commit.
• Surfaces — tpk --version → tpk 0.0.5 (bc549ef); GET /healthz → {"status","version","commit"} (unauthenticated on purpose: a rollout check becomes one curl); web UI sidebar footer + login page (fetched from /healthz, so it is the server's version, tooltip shows the commit, hidden when the sidebar is collapsed); the tpk serve startup line; MCP serverInfo.version.
• README documents it, and that the prefix applies to every entry point.

Testing

• New tests, RED→GREEN: tests/test_version.py (env → version, leading v dropped, git describe fallback, dev fallback, CLI flag, /healthz, MCP server version) and tests/test_serve_prefix.py — real DB: a user and a graph node that exist only under the prefix are reachable through the app tpk serve builds (login + /api/graph/search), corpus seeding lands in the prefixed registry, and the stdio server's KnowledgeGraph carries the prefix. Both prefix tests were confirmed to fail without the fix.
• pytest: 313 passed, 10 skipped, 1 failed — tests/test_ingest.py::test_ingest_repo_passes_extraction_and_backend, environment-dependent and failing on main too. tests/test_server.py::test_healthz updated for the new body.
• Web: npm run build + npm run check:sanitize clean.
• Image: docker build --target app --build-arg TPK_VERSION=9.9.9 --build-arg TPK_COMMIT=… → tpk --version prints tpk 9.9.9 (bc549ef); without build-args → tpk dev; this checkout → tpk 0.0.5-dirty (bc549ef).
• Live, against a real tpk serve in a throwaway database with TPK_STREAM_PREFIX=pfx_: startup line tpk 0.0.6 (abc1234) starting on … (stream prefix 'pfx_'); /healthz → {"status":"ok","version":"0.0.6","commit":"abc1234"}; all 11 streams created carry the prefix, none unprefixed; seeded admin logs in; browser check: v0.0.6 on the login page and in the sidebar footer (tooltip tpk 0.0.6 (abc1234)), hidden when collapsed.
• Not exercised: the workflow change itself (it runs on this PR's CI build; the published-tag path first runs on the next release).

Notes

• /healthz's body gained two keys — anything asserting it equals {"status":"ok"} exactly needs updating (k8s probes here use / and TCP, unaffected).
• Once docs: refresh for 0.0.5 (remote MCP & API tokens, bounded tools, source:view, UI pages, k8s upgrade) #86 (docs) is merged, step 3 of its new k8s "Upgrading" section can become curl https://<host>/healthz and check the version.

🤖 Generated with Claude Code