Merge pull request 'romm-mcp: restore library scans via POST /api/tasks/scan' (#20) from fix/romm-scan-endpoint into main

romm_system action=scan threw client-side:

  Scan endpoint removed in RomM 5.0. Use the RomM web UI to trigger library scans.

That note is stale. The comment above the stub says RomM 5.0 removed POST
/api/tasks/run -- true -- but 5.4 serves POST /api/tasks/scan with a ScanPayload
(type, platforms, platform_fs_slugs, roms_ids, apis). Verified against the running
instance: /api/tasks/scan is in the 5.4.1 OpenAPI (226 paths), and a call with a
bad key answers 401 from that exact endpoint rather than 404.

So the stub was blocking a working endpoint, and scans still needed a human in the
UI. Patch restores runScan() defaulting to type=quick, which indexes new and
changed files without re-hashing the whole library (a full scan hashes 229 GB).

The patch targets dist/client.js: the npm tarball ships only dist/ plus a .d.ts, so
there is no .ts to patch without dragging in typescript. Keep it small and delete
it when upstream restores runScan().

packages/default.nix

@@ -33,5 +33,6 @@
   pdf-mcp = pkgs.callPackage ./pdf-mcp/package.nix { };
   mcp-searxng = pkgs.callPackage ./mcp-searxng/package.nix { };
   python-ssh-mcp = pkgs.callPackage ./python-ssh-mcp/package.nix { };
+  romm-mcp = pkgs.callPackage ./romm-mcp/package.nix { };
   # example-mcp-server = pkgs.callPackage ./example-mcp-server/package.nix { };
 }

packages/romm-mcp/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchzip,
+}:
+
+buildNpmPackage rec {
+  pname = "romm-mcp";
+  version = "1.0.5";
+
+  src = fetchzip {
+    url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
+    hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
+  };
+
+  # Upstream publishes no package-lock.json (only package.json), and
+  # buildNpmPackage requires one to compute npmDepsHash. This lock is generated
+  # from the published tarball itself -- `npm install --package-lock-only
+  # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
+  # the dependency tree that shipped with this version.
+  npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+
+    # romm_system action=scan was stubbed out client-side ("Scan endpoint removed in
+    # RomM 5.0"), but RomM 5.4 restored POST /api/tasks/scan, so the stub only blocks a
+    # working endpoint. Upstream publishes no sources in the npm tarball, so this patches
+    # the compiled dist/ directly; drop it once upstream restores runScan().
+    patch -p1 < ${./romm-mcp-scan.patch}
+  '';
+
+  # dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
+  # compile here -- same arrangement as navidrome-mcp and n8n-mcp.
+  dontNpmBuild = true;
+
+  meta = with lib; {
+    description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
+    homepage = "https://github.com/rodrigosiviero/romm-mcp";
+    license = licenses.mit;
+    mainProgram = pname;
+    platforms = platforms.all;
+  };
+}

packages/romm-mcp/romm-mcp-scan.patch

@@ -0,0 +1,19 @@
+--- a/dist/client.js
++++ b/dist/client.js
+@@ -244,8 +244,14 @@
+     // NOTE: RomM 5.0 removed the POST /api/tasks/run endpoint.
+     // Scans are now managed through RQ workers and require background job management.
+     // Use the RomM web UI for scans and metadata updates.
+-    async runScan() {
+-        throw new Error("Scan endpoint removed in RomM 5.0. Use the RomM web UI to trigger library scans.");
++    async runScan(scanType = "quick") {
++        // RomM 5.4 restored library scans behind POST /api/tasks/scan (ScanPayload:
++        // type, platforms, platform_fs_slugs, roms_ids, apis). The stub above predates
++        // that. "quick" indexes new/changed files; "full" re-hashes the whole library.
++        return this.request("/api/tasks/scan", {
++            method: "POST",
++            body: JSON.stringify({ type: scanType }),
++        });
+     }
+     async runMetadataScan() {
+         throw new Error("Metadata scan endpoint removed in RomM 5.0. Use the RomM web UI to trigger metadata updates.");