github-agent 2.4.2__tar.gz → 2.4.4__tar.gz

{github_agent-2.4.2 → github_agent-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.2
+Version: 2.4.4
 Summary: GitHub Agent for MCP
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -12,9 +12,8 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: gql[requests]>=4.4.0
 Requires-Dist: requests>=2.34.2
-Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.11
+Requires-Dist: agent-connector-sdk[graphql,mcp]<1.0.0,>=0.3.13
 Provides-Extra: mcp
 Provides-Extra: all
 Provides-Extra: test
@@ -45,7 +44,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.4*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

{github_agent-2.4.2 → github_agent-2.4.4}/README.md

@@ -20,7 +20,7 @@
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.4*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

github_agent-2.4.4/github_agent/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.4.4"

{github_agent-2.4.2 → github_agent-2.4.4}/github_agent/github_gql.py

@@ -4,11 +4,10 @@
 import logging
 from typing import Any
 
-from agent_connector_sdk.exceptions import MissingParameterError, ParameterError
+from agent_connector_sdk.exceptions import MissingParameterError
 from agent_connector_sdk.tls.profile import ResolvedTLSProfile
 from agent_connector_sdk.tls.resolve import resolve_tls_profile
-from gql import Client, gql
-from gql.transport.requests import RequestsHTTPTransport
+from agent_connector_sdk.transports.graphql import GraphQLAuth, GraphQLClient
 
 
 class GraphQL:
@@ -44,29 +43,21 @@ class GraphQL:
         # GitHub GraphQL authenticates with a bearer token (classic PAT,
         # fine-grained PAT, or OAuth/GitHub-App installation token).
         self.headers = {"Authorization": f"Bearer {token}"}
-        self.transport = RequestsHTTPTransport(
-            url=self.url,
-            headers=self.headers,
-            **self.tls_profile.requests_kwargs(),
-        )
-        self.client = Client(
-            transport=self.transport, fetch_schema_from_transport=False
+        self._gql = GraphQLClient(
+            self.url,
+            auth=GraphQLAuth.bearer(token),
+            tls_profile=self.tls_profile,
+            tls_service="github",
         )
 
+    @property
+    def client(self) -> Any:
+        """The underlying protocol client, built on first use."""
+        return self._gql.client
+
     def close(self) -> None:
-        """Release GraphQL transport state and runtime-only TLS material.
-
-        ``Client.close_sync()`` unconditionally asserts ``self.session`` is a
-        ``SyncClientSession`` — but under gql 4.0 that attribute is only ever
-        set by ``connect_sync()`` (called implicitly by ``execute_gql`` /
-        ``client.execute``). If this ``GraphQL`` was constructed but never
-        used to run a query, the underlying ``Client`` has no ``session``
-        attribute yet and ``close_sync()`` raises ``AttributeError`` instead
-        of being a no-op. Only close a session that was actually opened.
-        """
-        if hasattr(self.client, "session"):
-            self.client.close_sync()
-        self.tls_profile.cleanup()
+        """Release GraphQL transport state and runtime-only TLS material."""
+        self._gql.close()
 
     @staticmethod
     def _graphql_endpoint(url: str) -> str:
@@ -91,17 +82,7 @@ class GraphQL:
         Raises:
             ParameterError: If the query fails or the response carries errors.
         """
-        try:
-            query = gql(query_str)
-            result = self.client.execute(
-                query, variable_values=variables, operation_name=operation_name
-            )
-            if "errors" in result:
-                raise ParameterError(f"GraphQL errors: {result['errors']}")
-            return result
-        except Exception as e:
-            logging.error("GraphQL execution failed: error_type=%s", type(e).__name__)
-            raise ParameterError(f"Query execution failed: {type(e).__name__}") from e
+        return self._gql.execute(query_str, variables, operation_name)
 
     def enable_pull_request_auto_merge(
         self, pull_request_id: str, merge_method: str = "MERGE"

{github_agent-2.4.2 → github_agent-2.4.4}/github_agent/github_http.py

@@ -4,21 +4,23 @@ from __future__ import annotations
 
 import http.client
 import json
-import os
 import ssl
 from typing import Any
 
+from agent_connector_sdk.tls.errors import TransportSecurityError
+from agent_connector_sdk.tls.profile import ResolvedTLSProfile
+from agent_connector_sdk.tls.resolve import resolve_tls_profile
+
 GITHUB_API_HOST = "api.github.com"
 MAX_REQUEST_BYTES = 1 * 1024 * 1024
 MAX_RESPONSE_BYTES = 8 * 1024 * 1024
 
 
-def _tls_context() -> ssl.SSLContext:
-    cafile = os.environ.get("SSL_CERT_FILE") or os.environ.get("REQUESTS_CA_BUNDLE")
-    capath = os.environ.get("SSL_CERT_DIR")
+def _tls_profile() -> ResolvedTLSProfile:
+    """Resolve the GitHub TLS profile from the SDK (SDK-CONNECTOR-CONTROL-R017)."""
     try:
-        return ssl.create_default_context(cafile=cafile or None, capath=capath or None)
-    except (OSError, ssl.SSLError):
+        return resolve_tls_profile("github")
+    except TransportSecurityError:
         raise RuntimeError("runtime TLS trust configuration is invalid") from None
 
 
@@ -103,11 +105,12 @@ def github_json_request(
     _validate_token_shape(token)
     body = _encode_request_body(payload)
     headers = _request_headers(token)
+    profile = _tls_profile()
     connection = http.client.HTTPSConnection(
         GITHUB_API_HOST,
         443,
         timeout=30,
-        context=_tls_context(),
+        context=profile.ssl_context,
     )
     try:
         connection.request(method, path, body=body, headers=headers)
@@ -118,3 +121,4 @@ def github_json_request(
         raise RuntimeError("GitHub service is unavailable") from None
     finally:
         connection.close()
+        profile.cleanup()

{github_agent-2.4.2 → github_agent-2.4.4}/github_agent/mcp_server.py

@@ -39,7 +39,7 @@ from github_agent.auth import (
 )
 from github_agent.github_response_models import PagesAlreadyEnabled, PagesNotEnabled
 
-__version__ = "2.4.2"
+__version__ = "2.4.4"
 logger = get_logger("GithubMCPServer")
 logger.setLevel(logging.INFO)
 

{github_agent-2.4.2 → github_agent-2.4.4}/github_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.2
+Version: 2.4.4
 Summary: GitHub Agent for MCP
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -12,9 +12,8 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: gql[requests]>=4.4.0
 Requires-Dist: requests>=2.34.2
-Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.11
+Requires-Dist: agent-connector-sdk[graphql,mcp]<1.0.0,>=0.3.13
 Provides-Extra: mcp
 Provides-Extra: all
 Provides-Extra: test
@@ -45,7 +44,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.4*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

{github_agent-2.4.2 → github_agent-2.4.4}/github_agent.egg-info/requires.txt

@@ -1,6 +1,5 @@
-gql[requests]>=4.4.0
 requests>=2.34.2
-agent-connector-sdk[mcp]<1.0.0,>=0.3.11
+agent-connector-sdk[graphql,mcp]<1.0.0,>=0.3.13
 
 [all]
 

{github_agent-2.4.2 → github_agent-2.4.4}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "github-agent"
-version = "2.4.2"
+version = "2.4.4"
 readme = "README.md"
 description = "GitHub Agent for MCP"
 requires-python = ">=3.12"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: Public Domain", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]
-dependencies = [ "gql[requests]>=4.4.0", "requests>=2.34.2", "agent-connector-sdk[mcp]>=0.3.11,<1.0.0",]
+dependencies = [ "requests>=2.34.2", "agent-connector-sdk[mcp,graphql]>=0.3.13,<1.0.0",]
 [[project.authors]]
 name = "Project Maintainers"
 email = "maintainers@users.noreply.github.com"

github_agent-2.4.4/tests/test_github_gql.py

@@ -0,0 +1,73 @@
+"""GitHub GraphQL client — endpoint derivation + construction (no network)."""
+
+from __future__ import annotations
+
+import pytest
+from agent_connector_sdk.exceptions import MissingParameterError
+
+from github_agent.github_gql import GraphQL
+
+
+def test_endpoint_github_com():
+    assert GraphQL._graphql_endpoint("https://api.github.com") == (
+        "https://api.github.com/graphql"
+    )
+    assert GraphQL._graphql_endpoint("https://api.github.com/") == (
+        "https://api.github.com/graphql"
+    )
+
+
+def test_endpoint_enterprise():
+    assert GraphQL._graphql_endpoint("https://github.example/api/v3") == (
+        "https://github.example/api/graphql"
+    )
+
+
+def test_requires_url_and_token():
+    with pytest.raises(MissingParameterError):
+        GraphQL(url=None, token="x")
+    with pytest.raises(MissingParameterError):
+        GraphQL(url="https://api.github.com", token=None)
+
+
+def test_construction_sets_bearer_header():
+    g = GraphQL(url="https://api.github.com", token="tok123")
+    assert g.headers["Authorization"] == "Bearer tok123"
+    assert g.url.endswith("/graphql")
+
+
+def test_close_without_session_does_not_raise():
+    """close() on a never-used client is a safe no-op."""
+    GraphQL(url="https://api.github.com", token="tok123").close()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-CONNECTOR-IDENTITY-R002")
+def test_wrapper_delegates_to_shared_graphql_client():
+    from unittest.mock import patch
+
+    from agent_connector_sdk.tls.resolve import resolve_tls_profile
+    from agent_connector_sdk.transports.graphql import GraphQLClient
+
+    profile = resolve_tls_profile("github")
+    g = GraphQL(url="https://github.example/api/v3", token="tok123", tls_profile=profile)
+    assert isinstance(g._gql, GraphQLClient)
+    assert g._gql.endpoint == "https://github.example/api/graphql"
+    assert g._gql.headers["Authorization"] == "Bearer tok123"
+    assert g._gql.tls_profile is profile
+    with patch.object(GraphQLClient, "execute", return_value={"viewer": {}}) as ex:
+        assert g.execute_gql("query { viewer { login } }", {"a": 1}, "Op") == {
+            "viewer": {}
+        }
+    ex.assert_called_once_with("query { viewer { login } }", {"a": 1}, "Op")
+
+
+def test_execute_failure_message_is_redacted_class_name():
+    from unittest.mock import patch
+
+    from agent_connector_sdk.exceptions import ParameterError
+    from agent_connector_sdk.transports.graphql import GraphQLClient
+
+    g = GraphQL(url="https://api.github.com", token="tok123")
+    with patch.object(GraphQLClient, "_attempt", side_effect=ValueError("boom")):
+        with pytest.raises(ParameterError, match="Query execution failed: ValueError"):
+            g.execute_gql("query { viewer { login } }")

{github_agent-2.4.2 → github_agent-2.4.4}/tests/test_github_http.py

@@ -163,3 +163,68 @@ def test_github_json_request_encodes_payload_as_compact_json():
     assert value == {"created": True}
     sent_kwargs = connection.request.call_args.kwargs
     assert sent_kwargs["body"] == json.dumps({"title": "hi"}, separators=(",", ":")).encode()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_request_uses_sdk_tls_profile_context():
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: the connection uses the profile's context."""
+    connection, _ = _mock_connection()
+    profile = MagicMock()
+    with (
+        patch("github_agent.github_http.resolve_tls_profile", return_value=profile) as resolve,
+        patch("github_agent.github_http.http.client.HTTPSConnection", return_value=connection) as conn_cls,
+    ):
+        github_json_request("GET", "/repos/x/y", "tok")
+    resolve.assert_called_once_with("github")
+    assert conn_cls.call_args.kwargs["context"] is profile.ssl_context
+    profile.cleanup.assert_called_once()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_private_ca_is_carried_through_the_profile(tmp_path, monkeypatch):
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: a configured CA bundle reaches the profile."""
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec
+    import datetime
+
+    from github_agent.github_http import _tls_profile
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(x509.oid.NameOID.COMMON_NAME, "test-ca")])
+    now = datetime.datetime.now(datetime.timezone.utc)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(name)
+        .issuer_name(name)
+        .public_key(key.public_key())
+        .serial_number(1)
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(key, hashes.SHA256())
+    )
+    ca = tmp_path / "ca.pem"
+    ca.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    monkeypatch.setenv("GITHUB_CA_BUNDLE", str(ca))
+    profile = _tls_profile()
+    try:
+        assert profile.ca_bundle_path == ca
+        assert profile.verify_enabled
+    finally:
+        profile.cleanup()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_no_hand_built_ssl_context_remains():
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: no package code builds its own context."""
+    from pathlib import Path
+
+    import github_agent
+
+    root = Path(github_agent.__file__).parent
+    for path in root.rglob("*.py"):
+        text = path.read_text(encoding="utf-8")
+        assert "create_default_context" not in text, path
+        assert "verify=False" not in text, path
+        assert "disable_warnings" not in text, path

github_agent-2.4.2/github_agent/__init__.py

@@ -1 +0,0 @@
-__version__ = "2.4.2"

github_agent-2.4.2/tests/test_github_gql.py

@@ -1,55 +0,0 @@
-"""GitHub GraphQL client — endpoint derivation + construction (no network)."""
-
-from __future__ import annotations
-
-import pytest
-from agent_connector_sdk.exceptions import MissingParameterError
-
-from github_agent.github_gql import GraphQL
-
-
-def test_endpoint_github_com():
-    assert GraphQL._graphql_endpoint("https://api.github.com") == (
-        "https://api.github.com/graphql"
-    )
-    assert GraphQL._graphql_endpoint("https://api.github.com/") == (
-        "https://api.github.com/graphql"
-    )
-
-
-def test_endpoint_enterprise():
-    assert GraphQL._graphql_endpoint("https://github.example/api/v3") == (
-        "https://github.example/api/graphql"
-    )
-
-
-def test_requires_url_and_token():
-    with pytest.raises(MissingParameterError):
-        GraphQL(url=None, token="x")
-    with pytest.raises(MissingParameterError):
-        GraphQL(url="https://api.github.com", token=None)
-
-
-def test_construction_sets_bearer_header():
-    g = GraphQL(url="https://api.github.com", token="tok123")
-    assert g.headers["Authorization"] == "Bearer tok123"
-    assert g.url.endswith("/graphql")
-
-
-def test_close_without_session_does_not_raise():
-    """Regression guard: under gql 4.0, Client.close_sync() unconditionally
-    asserts ``self.session`` — an attribute only ever set by connect_sync()
-    (called implicitly the first time a query executes). A GraphQL client
-    that was constructed but never used to run a query has no such session
-    yet, so close() must be a safe no-op rather than raising AttributeError.
-    """
-    g = GraphQL(url="https://api.github.com", token="tok123")
-    g.close()
-
-
-def test_close_after_session_opened_closes_cleanly():
-    """Once a sync session has actually been opened, close() still closes it."""
-    g = GraphQL(url="https://api.github.com", token="tok123")
-    g.client.connect_sync()
-    assert hasattr(g.client, "session")
-    g.close()