Route every MinimalIssueRef/MinimalPullRequestRef construction through shared
constructors that sanitize the user-authored title, so issue_dependency_read,
issue_dependency_write and find_duplicate no longer forward raw issue titles.
Also sanitize the get_file_blame commit message headline, after truncation so
the headline is still cut at the author's real first line break.
Extends the sanitization regression suite with the project status update body,
both ref constructors and the dependency ref, and adds tool-level regression
tests for find_duplicate and get_file_blame.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Reimplement issue dependencies on go-github v89 REST API
Issue dependencies (blocked_by / blocking) were implemented on GraphQL via
githubv4. Because the pinned githubv4 library predates the dependency
mutations, the code hand-declared AddBlockedByInput / RemoveBlockedByInput
and resolved issue numbers to node IDs with a custom aliased query.
go-github v89 adds first-class REST methods (ListBlockedBy, ListBlocking,
AddBlockedBy, RemoveBlockedBy), so switch issue_dependency_read and
issue_dependency_write to those. This removes the workaround, aligns the
tools with the rest of the REST-based issue tooling, and simplifies tests.
- Rewrite issue_dependencies.go on REST: page-based pagination for reads,
and a single Issues.Get to resolve the blocking issue's database ID for
writes. Preserve the tool surface, self-dependency guard and cross-repo
support.
- Rewrite the issue dependency tests on the REST mock helpers.
- Regenerate the read toolsnap (cursor -> page pagination) and docs.
Refs #950
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Normalize issue dependency ref state to match other tools
The REST issue-dependency endpoints return lower-case issue states
(open/closed), whereas the previous GraphQL implementation and the
sibling get_parent tool populate MinimalIssueRef.State from the GraphQL
IssueState enum (OPEN/CLOSED). Upper-case the state in
issueToDependencyRef so the field stays consistent across every tool that
emits a MinimalIssueRef, and guard against a nil issue while here.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add issue dependency read/write MCP tools
Add two feature-flagged tools for issue blocked-by / blocking
relationships, gated behind the issue_dependencies flag so they stay off
the default tool surface (auto-enabled for insiders only):
- issue_dependency_read: get_blocked_by / get_blocking via the
Issue.blockedBy / Issue.blocking GraphQL connections, cursor-paginated.
- issue_dependency_write: add / remove x blocked_by / blocking via the
addBlockedBy / removeBlockedBy mutations. Accepts issue numbers and
resolves them to node IDs in a single aliased query; "blocking" is the
inverse of "blocked_by" with the subject/related roles swapped.
Closes the MCP gap behind the gh CLI dependency verbs (cli/cli#13057).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fail fast on self-dependency in issue_dependency_write
Reject a write where the subject and related issue are identical before
resolving node IDs or issuing a mutation, avoiding two API round-trips.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Revert addition of `any of` for required ui_get scopes
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sam Morrow