Review: Add list_messages tool — read group message history via MCP

Verdict: READY

Template Completeness

• [x] Lineage — present (companion to groupme-sdk#3, SSH workflow context)
• [x] Repo — present (forgejo_admin/groupme-mcp)
• [x] User Story — present and well-formed (operator reads history via MCP)
• [x] Context — present (explains send-only gap, SDK dependency)
• [x] File Targets — present (modify messages.py, explicit "do not touch" list)
• [x] Acceptance Criteria — present (6 criteria covering core behavior)
• [x] Test Expectations — present (2 unit tests + run command)
• [x] Constraints — present (follow existing patterns, _resolve_group, read-only, deploy order)
• [x] Checklist — present
• [x] Related — present (SDK dep + project page)

File Targets

• [x] src/groupme_mcp/tools/messages.py — verified exists. Currently contains only send_message. Adding list_messages here is the correct location. The import pattern (from ..server import _error_response, _ok, _resolve_group, get_client, mcp) is already in place.
• [x] tests/test_messages.py — verified exists (not mentioned in ticket but implied by test expectations). Currently contains 3 tests for send_message. New tests should follow same pattern.
• [x] tests/conftest.py — verified. Already patches get_client and _resolve_group in the messages module. No changes needed for new tool.
• [x] src/groupme_mcp/tools/__init__.py — verified. Already imports messages module. No changes needed since new tool uses @mcp.tool() decorator auto-registration.

Repo Placement

Dependencies

• groupme-sdk#3 (board item #378) — OPEN, in todo column. The SDK does NOT yet have a list_messages method. The MessagesMixin in groupme-sdk/src/groupme_sdk/messages.py only has send_message. This is correctly documented in the ticket's Constraints ("Deploy order: groupme-sdk#3 must publish first, then this") and in the board labels (depends:groupme-sdk#3).
• Both items share story:GM-5 label — consistent lineage.
• No other blockers identified on the board.

Acceptance Criteria

• [x] "list_messages returns recent messages (default 20)" — testable via mock
• [x] "Uses _resolve_group for name-based resolution" — testable, helper already exists and is patched in conftest
• [x] "Each message includes: sender nickname, text, created_at, attachment URLs" — testable via mock return data
• [x] "before_id param for pagination" — testable, verify param passed to SDK
• [x] "limit param (default 20, max 100)" — testable, should include validation test for max boundary
• [x] "Read-only — NOT gated by PreToolUse approval hook" — verified. block-groupme-send.sh only matches send_message, add_member, remove_member. A new list_messages tool falls through to the *) case and exits 0 (allow). No hook changes needed.

Blast Radius

• No downstream consumers affected — this is a new read-only tool addition.
• No existing tools modified.
• The __init__.py registration and conftest.py mock patches already cover the messages module — no structural changes needed.
• The PreToolUse hook (block-groupme-send.sh) is safe — its case matcher is tool-name-specific and won't accidentally gate the new read tool.

Recommendation