Merge branch 'http-stack-2' into scope-challenge-http

Author: omgitsads

.github/workflows/docker-publish.yml

@@ -60,7 +60,7 @@ jobs:
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

internal/ghmcp/server.go

@@ -133,7 +133,7 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 	inventoryBuilder := github.NewInventory(cfg.Translator).
 		WithDeprecatedAliases(github.DeprecatedToolAliases).
 		WithReadOnly(cfg.ReadOnly).
-		WithToolsets(cfg.EnabledToolsets).
+		WithToolsets(github.ResolvedEnabledToolsets(cfg.DynamicToolsets, cfg.EnabledToolsets, cfg.EnabledTools)).
 		WithTools(github.CleanTools(cfg.EnabledTools)).
 		WithServerInstructions().
 		WithFeatureChecker(featureChecker)

pkg/github/dependencies.go

@@ -320,10 +320,14 @@ func (d *RequestDeps) GetGQLClient(ctx context.Context) (*githubv4.Client, error
 
 	// Construct GraphQL client
 	// We use NewEnterpriseClient unconditionally since we already parsed the API host
+	// Wrap transport with GraphQLFeaturesTransport to inject feature flags from context,
+	// matching the transport chain used by the remote server.
 	gqlHTTPClient := &http.Client{
 		Transport: &transport.BearerAuthTransport{
-			Transport: http.DefaultTransport,
-			Token:     token,
+			Transport: &transport.GraphQLFeaturesTransport{
+				Transport: http.DefaultTransport,
+			},
+			Token: token,
 		},
 	}
 

pkg/github/pullrequests.go

@@ -1519,7 +1519,7 @@ func SubmitPendingPullRequestReview(ctx context.Context, client *githubv4.Client
 		"prNum":  githubv4.Int(params.PullNumber),
 	}
 
-	if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
+	if err := client.Query(ctx, &getLatestReviewForViewerQuery, vars); err != nil {
 		return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
 			"failed to get latest review for current user",
 			err,
@@ -1604,7 +1604,7 @@ func DeletePendingPullRequestReview(ctx context.Context, client *githubv4.Client
 		"prNum":  githubv4.Int(params.PullNumber),
 	}
 
-	if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
+	if err := client.Query(ctx, &getLatestReviewForViewerQuery, vars); err != nil {
 		return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
 			"failed to get latest review for current user",
 			err,
@@ -1778,7 +1778,7 @@ func AddCommentToPendingReview(t translations.TranslationHelperFunc) inventory.S
 				"prNum":  githubv4.Int(params.PullNumber),
 			}
 
-			if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
+			if err := client.Query(ctx, &getLatestReviewForViewerQuery, vars); err != nil {
 				return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
 					"failed to get latest review for current user",
 					err,

pkg/github/server.go

@@ -140,25 +140,23 @@ func registerDynamicTools(server *mcp.Server, inventory *inventory.Inventory, de
 	}
 }
 
-// resolveEnabledToolsets determines which toolsets should be enabled based on config.
+// ResolvedEnabledToolsets determines which toolsets should be enabled based on config.
 // Returns nil for "use defaults", empty slice for "none", or explicit list.
-func resolveEnabledToolsets(cfg *MCPServerConfig) []string {
-	enabledToolsets := cfg.EnabledToolsets
-
+func ResolvedEnabledToolsets(dynamicToolsets bool, enabledToolsets []string, enabledTools []string) []string {
 	// In dynamic mode, remove "all" and "default" since users enable toolsets on demand
-	if cfg.DynamicToolsets && enabledToolsets != nil {
+	if dynamicToolsets && enabledToolsets != nil {
 		enabledToolsets = RemoveToolset(enabledToolsets, string(ToolsetMetadataAll.ID))
 		enabledToolsets = RemoveToolset(enabledToolsets, string(ToolsetMetadataDefault.ID))
 	}
 
 	if enabledToolsets != nil {
 		return enabledToolsets
 	}
-	if cfg.DynamicToolsets {
+	if dynamicToolsets {
 		// Dynamic mode with no toolsets specified: start empty so users enable on demand
 		return []string{}
 	}
-	if len(cfg.EnabledTools) > 0 {
+	if len(enabledTools) > 0 {
 		// When specific tools are requested but no toolsets, don't use default toolsets
 		// This matches the original behavior: --tools=X alone registers only X
 		return []string{}

pkg/github/server_test.go

@@ -214,7 +214,7 @@ func TestResolveEnabledToolsets(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			result := resolveEnabledToolsets(&tc.cfg)
+			result := ResolvedEnabledToolsets(tc.cfg.DynamicToolsets, tc.cfg.EnabledToolsets, tc.cfg.EnabledTools)
 			assert.Equal(t, tc.expectedResult, result)
 		})
 	}

pkg/http/handler.go

@@ -225,12 +225,15 @@ func InventoryFiltersForRequest(r *http.Request, builder *inventory.Builder) *in
 		builder = builder.WithReadOnly(true)
 	}
 
-	if toolsets := ghcontext.GetToolsets(ctx); len(toolsets) > 0 {
-		builder = builder.WithToolsets(toolsets)
+	toolsets := ghcontext.GetToolsets(ctx)
+	tools := ghcontext.GetTools(ctx)
+
+	if len(toolsets) > 0 {
+		builder = builder.WithToolsets(github.ResolvedEnabledToolsets(false, toolsets, tools)) // No dynamic toolsets in HTTP mode
 	}
 
-	if tools := ghcontext.GetTools(ctx); len(tools) > 0 {
-		if len(ghcontext.GetToolsets(ctx)) == 0 {
+	if len(tools) > 0 {
+		if len(toolsets) == 0 {
 			builder = builder.WithToolsets([]string{})
 		}
 		builder = builder.WithTools(github.CleanTools(tools))

pkg/http/transport/graphql_features.go

@@ -17,14 +17,16 @@ import (
 //
 // Usage:
 //
+//	import "github.com/github/github-mcp-server/pkg/http/transport"
+//
 //	httpClient := &http.Client{
-//	    Transport: &github.GraphQLFeaturesTransport{
+//	    Transport: &transport.GraphQLFeaturesTransport{
 //	        Transport: http.DefaultTransport,
 //	    },
 //	}
 //	gqlClient := githubv4.NewClient(httpClient)
 //
-// Then use withGraphQLFeatures(ctx, "feature_name") when calling GraphQL operations.
+// Then use ghcontext.WithGraphQLFeatures(ctx, "feature_name") when calling GraphQL operations.
 type GraphQLFeaturesTransport struct {
 	// Transport is the underlying HTTP transport. If nil, http.DefaultTransport is used.
 	Transport http.RoundTripper

pkg/utils/api.go

@@ -102,7 +102,7 @@ func newGHECHost(hostname string) (APIHost, error) {
 		return APIHost{}, fmt.Errorf("failed to parse GHEC GraphQL URL: %w", err)
 	}
 
-	uploadURL, err := url.Parse(fmt.Sprintf("https://uploads.%s", u.Hostname()))
+	uploadURL, err := url.Parse(fmt.Sprintf("https://uploads.%s/", u.Hostname()))
 	if err != nil {
 		return APIHost{}, fmt.Errorf("failed to parse GHEC Upload URL: %w", err)
 	}

pkg/utils/token.go

@@ -22,7 +22,7 @@ const (
 	TokenTypeIDEToken
 )
 
-var supportedThirdPartyTokenPrefixes = map[string]TokenType{
+var supportedGitHubPrefixes = map[string]TokenType{
 	"ghp_":        TokenTypePersonalAccessToken,            // Personal access token (classic)
 	"github_pat_": TokenTypeFineGrainedPersonalAccessToken, // Fine-grained personal access token
 	"gho_":        TokenTypeOAuthAccessToken,               // OAuth access token
@@ -67,7 +67,7 @@ func ParseAuthorizationHeader(req *http.Request) (tokenType TokenType, token str
 		return TokenTypeIDEToken, token, nil
 	}
 
-	for prefix, tokenType := range supportedThirdPartyTokenPrefixes {
+	for prefix, tokenType := range supportedGitHubPrefixes {
 		if strings.HasPrefix(token, prefix) {
 			return tokenType, token, nil
 		}