Merge branch 'main' into main

Author: parvezmosharafvu

docs/streamable-http.md

@@ -72,13 +72,23 @@ The OAuth protected resource metadata's `resource` attribute will be populated w
   ],
   "scopes_supported": [
     "repo",
-    ...
+    "read:org",
+    "read:user",
+    "user:email",
+    "read:packages",
+    "write:packages",
+    "read:project",
+    "project",
+    "gist",
+    "notifications"
   ],
   ...
 }
 ```
 
 This allows OAuth clients to discover authentication requirements and endpoint information automatically.
+Scopes excluded from this default set, such as `delete_repo`, are requested only
+through a per-tool OAuth authorization challenge when needed.
 
 The HTTP server is the OAuth protected resource, not the authorization server. It
 therefore serves `/.well-known/oauth-protected-resource` but does not serve

pkg/github/copilot.go

@@ -214,6 +214,19 @@ func AssignCopilotToIssue(t translations.TranslationHelperFunc) inventory.Server
 				return utils.NewToolResultError(err.Error()), nil, nil
 			}
 
+			// owner, repo and issue_number are required, but WeakDecode zero-fills a
+			// missing value, so a missing arg reached the query as a confusing
+			// "Could not resolve to a Repository" error. Reject the zero values.
+			if params.Owner == "" {
+				return utils.NewToolResultError("missing required parameter: owner"), nil, nil
+			}
+			if params.Repo == "" {
+				return utils.NewToolResultError("missing required parameter: repo"), nil, nil
+			}
+			if params.IssueNumber == 0 {
+				return utils.NewToolResultError("missing required parameter: issue_number"), nil, nil
+			}
+
 			client, err := deps.GetGQLClient(ctx)
 			if err != nil {
 				return nil, nil, fmt.Errorf("failed to get GitHub client: %w", err)
@@ -588,6 +601,19 @@ func AssignCopilotToIssueWithIntent(t translations.TranslationHelperFunc) invent
 				return utils.NewToolResultError(err.Error()), nil, nil
 			}
 
+			// owner, repo and issue_number are required, but WeakDecode zero-fills a
+			// missing value, so reject the zero values (as with rationale/confidence
+			// below) before they reach the query as a confusing repository error.
+			if params.Owner == "" {
+				return utils.NewToolResultError("missing required parameter: owner"), nil, nil
+			}
+			if params.Repo == "" {
+				return utils.NewToolResultError("missing required parameter: repo"), nil, nil
+			}
+			if params.IssueNumber == 0 {
+				return utils.NewToolResultError("missing required parameter: issue_number"), nil, nil
+			}
+
 			// Validate rationale length (rune count, matching the granular assignee tools).
 			rationale := strings.TrimSpace(params.Rationale)
 			if rationale == "" {

pkg/github/copilot_test.go

@@ -59,6 +59,36 @@ func TestAssignCopilotToIssue(t *testing.T) {
 		expectToolError    bool
 		expectedToolErrMsg string
 	}{
+		{
+			name: "missing owner is rejected",
+			requestArgs: map[string]any{
+				"repo":         "repo",
+				"issue_number": float64(123),
+			},
+			mockedClient:       githubv4mock.NewMockedHTTPClient(),
+			expectToolError:    true,
+			expectedToolErrMsg: "missing required parameter: owner",
+		},
+		{
+			name: "missing repo is rejected",
+			requestArgs: map[string]any{
+				"owner":        "owner",
+				"issue_number": float64(123),
+			},
+			mockedClient:       githubv4mock.NewMockedHTTPClient(),
+			expectToolError:    true,
+			expectedToolErrMsg: "missing required parameter: repo",
+		},
+		{
+			name: "missing issue_number is rejected",
+			requestArgs: map[string]any{
+				"owner": "owner",
+				"repo":  "repo",
+			},
+			mockedClient:       githubv4mock.NewMockedHTTPClient(),
+			expectToolError:    true,
+			expectedToolErrMsg: "missing required parameter: issue_number",
+		},
 		{
 			name: "successful assignment when there are no existing assignees",
 			requestArgs: map[string]any{
@@ -1228,6 +1258,19 @@ func TestAssignCopilotToIssueWithIntent(t *testing.T) {
 		expectedToolErrMsg string
 		expectSuggestion   bool
 	}{
+		{
+			name: "missing owner is rejected",
+			requestArgs: map[string]any{
+				"repo":          "repo",
+				"issue_number":  float64(123),
+				"rationale":     "Well-scoped task.",
+				"confidence":    "HIGH",
+				"is_suggestion": false,
+			},
+			mockedClient:       githubv4mock.NewMockedHTTPClient(),
+			expectToolError:    true,
+			expectedToolErrMsg: "missing required parameter: owner",
+		},
 		{
 			name: "direct assignment with rationale and confidence preserves existing assignees",
 			requestArgs: map[string]any{

pkg/http/oauth/oauth.go

@@ -20,13 +20,12 @@ const (
 	OAuthProtectedResourcePrefix = "/.well-known/oauth-protected-resource"
 )
 
-// SupportedScopes lists every OAuth scope that an MCP tool may require. HTTP
-// protected-resource metadata advertises this full set so clients can step up
-// authorization for tools excluded from the default grant.
+// SupportedScopes lists every OAuth scope that an MCP tool may require.
 var SupportedScopes = scopes.SupportedOAuthScopes()
 
-// DefaultScopes are requested by stdio OAuth unless the operator explicitly
-// supplies --oauth-scopes. High-risk scopes such as delete_repo require opt-in.
+// DefaultScopes are advertised in protected-resource metadata and requested by
+// stdio OAuth unless the operator explicitly supplies --oauth-scopes. Other
+// scopes require opt-in through a per-tool authorization challenge.
 var DefaultScopes = scopes.DefaultOAuthScopes()
 
 // Config holds the OAuth configuration for the MCP server.
@@ -128,7 +127,7 @@ func (h *AuthHandler) metadataHandler() http.Handler {
 			Resource:               resourceURL,
 			AuthorizationServers:   []string{authorizationServerURL},
 			ResourceName:           "GitHub MCP Server",
-			ScopesSupported:        SupportedScopes,
+			ScopesSupported:        DefaultScopes,
 			BearerMethodsSupported: []string{"header"},
 		}
 

pkg/http/oauth/oauth_test.go

@@ -436,7 +436,18 @@ func TestHandleProtectedResource(t *testing.T) {
 			host:               "api.example.com",
 			method:             http.MethodGet,
 			expectedStatusCode: http.StatusOK,
-			expectedScopes:     SupportedScopes,
+expectedScopes: []string{
+				"repo",
+				"read:org",
+				"read:user",
+				"user:email",
+				"read:packages",
+				"write:packages",
+				"read:project",
+				"project",
+				"gist",
+				"notifications",
+			},
 			validateResponse: func(t *testing.T, body map[string]any) {
 				t.Helper()
 				assert.Equal(t, "GitHub MCP Server", body["resource_name"])
@@ -573,7 +584,12 @@ func TestHandleProtectedResource(t *testing.T) {
 				if tc.expectedScopes != nil {
 					scopes, ok := body["scopes_supported"].([]any)
 					require.True(t, ok)
-					assert.Len(t, scopes, len(tc.expectedScopes))
+					actualScopes := make([]string, len(scopes))
+					for i, scope := range scopes {
+						actualScopes[i], ok = scope.(string)
+						require.True(t, ok)
+					}
+					assert.Equal(t, tc.expectedScopes, actualScopes)
 				}
 			}
 		})
@@ -671,10 +687,20 @@ func TestSupportedScopes(t *testing.T) {
 	assert.Equal(t, expectedScopes, SupportedScopes)
 }
 
-func TestDefaultScopesRequiresExplicitDeleteRepoOptIn(t *testing.T) {
+func TestDefaultScopesRequireExplicitOptIn(t *testing.T) {
 	assert.Subset(t, SupportedScopes, DefaultScopes)
 	assert.Contains(t, SupportedScopes, "delete_repo")
 	assert.NotContains(t, DefaultScopes, "delete_repo")
+	assert.Contains(t, SupportedScopes, "workflow")
+	assert.NotContains(t, DefaultScopes, "workflow")
+	assert.Contains(t, SupportedScopes, "codespace")
+	assert.NotContains(t, DefaultScopes, "codespace")
+	assert.Contains(t, SupportedScopes, "admin:org")
+	assert.NotContains(t, DefaultScopes, "admin:org")
+	assert.Contains(t, SupportedScopes, "read:enterprise")
+	assert.NotContains(t, DefaultScopes, "read:enterprise")
+	assert.Contains(t, SupportedScopes, "admin:enterprise")
+	assert.NotContains(t, DefaultScopes, "admin:enterprise")
 	assert.Contains(t, DefaultScopes, "repo")
 }