mcp-github-crunchtools 2.0.1__tar.gz → 2.1.0__tar.gz

mcp_github_crunchtools-2.1.0/.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+# The repo's own checks, from python-sdlc at the release .pre-commit-config.yaml
+# pins -- the same image and the same commands the laptop runs, so a green push
+# predicts a green CI (constitution XII, v1.30.0).
+#
+# NOT every check on this pull request: Gourmand and Gatehouse run as their own
+# workflows, which is why `sdlc ci` leaves them out (XII: "CI runs push's checks
+# except Gourmand and Gatehouse, which CI runs through their own workflows").
+# The Gourmand job below is one of them.
+#
+# The job NAME `sdlc ci` is the required check in the org ruleset "Python SDLC
+# gates". Renaming the job stops it gating, silently.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sdlc:
+    name: sdlc ci
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      # The release is read from .pre-commit-config.yaml, so one line pins the
+      # launcher, the image and every tool in it, for the laptop and CI both.
+      - name: sdlc ci
+        run: |
+          set -eu
+          rev=$(awk '/repo: https:\/\/github.com\/crunchtools\/python-sdlc/ {f=1; next}
+                     f && /rev:/ {print $2; exit}' .pre-commit-config.yaml)
+          [ -n "$rev" ] || { echo "no python-sdlc rev in .pre-commit-config.yaml" >&2; exit 2; }
+          git clone -q --depth 1 --branch "$rev" https://github.com/crunchtools/python-sdlc "$RUNNER_TEMP/sdlc"
+          $RUNNER_TEMP/sdlc/bin/sdlc ci
+
+  gourmand:
+    name: Code Quality (Gourmand)
+    uses: crunchtools/gatehouse/.github/workflows/gourmand.yml@v0

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.28.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.36.0

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/.github/workflows/container.yml

@@ -43,7 +43,11 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            # `latest` is the newest STABLE RELEASE, not the newest build of the
+            # branch, which has its own tag above (constitution 1.33.0, RT#1559).
+            # A prerelease is not what `latest` means, so it is excluded by the
+            # hyphen: SemVer puts every prerelease identifier after one.
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }}
 
       - name: Build and push
         uses: docker/build-push-action@v7
@@ -61,7 +65,7 @@ jobs:
         if: github.event_name != 'pull_request'
         uses: aquasecurity/trivy-action@v0.36.0
         with:
-          image-ref: ${{ env.QUAY_IMAGE }}:latest
+          image-ref: ${{ env.QUAY_IMAGE }}:${{ steps.meta.outputs.version }}
           format: "table"
           exit-code: "0"
           severity: "CRITICAL,HIGH"
@@ -99,7 +103,11 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            # `latest` is the newest STABLE RELEASE, not the newest build of the
+            # branch, which has its own tag above (constitution 1.33.0, RT#1559).
+            # A prerelease is not what `latest` means, so it is excluded by the
+            # hyphen: SemVer puts every prerelease identifier after one.
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }}
 
       - name: Build and push
         uses: docker/build-push-action@v7

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.28.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.31.0

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/.github/workflows/security.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-    uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.28.0
+    uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.31.0
 
   container-scan:
     name: Container Security Scan

mcp_github_crunchtools-2.1.0/.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+# Every check runs from python-sdlc, pinned here once (constitution XII,
+# v1.30.0). This `rev:` fixes the launcher, the image and every tool inside it,
+# for this laptop and for CI, which reads the same line.
+#
+# What each hook runs is configured in pyproject.toml: [tool.sdlc.commit],
+# [tool.sdlc.push], [tool.sdlc.ci]. `sdlc tiers` prints it.
+#
+# `default_install_hook_types` must name both: without pre-push, `pre-commit
+# install` wires only the commit hook and every verdict silently stops running.
+
+default_install_hook_types: [pre-commit, pre-push]
+
+repos:
+  - repo: https://github.com/crunchtools/python-sdlc
+    rev: v0.6.1
+    hooks:
+      - id: sdlc-commit
+      - id: sdlc-push

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/.specify/memory/constitution.md

@@ -2,9 +2,9 @@
 
 > **Version:** 1.3.0
 > **Ratified:** 2026-06-14
-> **Amended:** 2026-10-14
+> **Amended:** 2026-11-09
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.28.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.36.0
 > **Profile:** MCP Server
 
 This file holds what is specific to mcp-github. The fleet rules and the MCP
@@ -35,7 +35,8 @@ restated here.
   truncates long identifiers.
 - **API:** `Authorization: Bearer` header, never the URL; the
   `X-GitHub-Api-Version` header is pinned to `2022-11-28`; path parameters
-  are URL-encoded; requests time out after 30s; responses are capped at 10MB.
+  are URL-encoded; requests time out after 30s; responses are capped at 10MB
+  while reading, not from the `content-length` header GitHub need not send.
 - **Redirects:** the API client follows none. A job log, which GitHub serves
   as a redirect to a pre-signed storage URL, is fetched by a separate client
   that has no token, over HTTPS to a named host only, streamed, with only its

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/CHANGELOG.md

@@ -6,6 +6,50 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-11-09
+
+### Fixed
+
+- **The JSON path had no ceiling.** The response size limit read the
+  `content-length` header and nothing else, so a reply without that header was
+  read whole into memory. The job-log download has always read in bounded
+  pieces, which is what made the gap easy to miss: the repo looked like it
+  streamed because one of its two read paths did. The JSON path now reads in
+  bounded pieces too, measured before each chunk is copied in.
+
+- **An error that is not GitHub's JSON shape says what it was.** It arrived as
+  `Unknown error` or 200 bare characters of body with no indication of where
+  they came from, so an Enterprise login page, a proxy error and the API
+  refusing something were one message. Such a body is now quoted, bounded,
+  alongside the method, URL, status and content-type of the request it
+  answered. GitHub's own `message` is still used verbatim when present, now
+  length-bounded.
+
+- **The URL in an error carries no secret.** Userinfo is dropped, and
+  `access_token` — GitHub's own retired query-string auth — along with
+  `client_secret`, `code` and `token` are redacted by name. By name rather
+  than by dropping the query string, because `per_page`, `state` and `sha` are
+  the diagnosis.
+
+### Added
+
+- **The client says what it is.** Requests carry
+  `User-Agent: mcp-github-crunchtools/<version> (+<repo url>)`, with the
+  version read from installed package metadata. GitHub asks API clients to
+  send one, and httpx's default `python-httpx/<version>` is what bot
+  protection answers with a challenge page (RT #1596).
+
+### Changed
+
+- Client tests drive `build_request` and `send` rather than `request`, because
+  the client now streams. The contract tests in
+  `tests/test_http_contract.py` use the existing `_patch_transport`, which
+  gives them a real `httpx.AsyncClient`: the agent string and the bounded read
+  are the client's own behaviour, so a mock standing in for it cannot see them.
+
+- Inherits constitution v1.36.0, whose MCP Server profile 1.8.0 states the
+  outbound HTTP contract (RT #1601).
+
 ## [2.0.1] - 2026-10-31
 
 ### Security

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/Containerfile

@@ -27,7 +27,7 @@ FROM quay.io/hummingbird/python:3.14
 
 # Labels for container metadata
 LABEL name="mcp-github-crunchtools" \
-      version="2.0.1" \
+      version="2.1.0" \
       summary="Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search" \
       description="A security-focused MCP server for GitHub built on Red Hat UBI" \
       maintainer="crunchtools.com" \

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-github-crunchtools
-Version: 2.0.1
+Version: 2.1.0
 Summary: Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search
 Author: crunchtools.com
 License-Expression: AGPL-3.0-or-later

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/gourmand-exceptions.toml

@@ -35,3 +35,14 @@ check = "EV002-manifest_lint_suppression"
 path = "pyproject.toml"
 justification = "Each remaining global ruff ignore was verified against this codebase with the project's own pinned toolchain (`uv run ruff check --select <RULE>`, ignore list temporarily cleared for an unmasked read) before being kept: TRY003 (7 src/ files, GitHub API error messages), PLR0913/PLR0917 (4 src/ files -- server.py, tools/actions.py, tools/issues.py, tools/pull_requests.py -- MCP tool signatures mirror the wire API and genuinely take many named/positional parameters), PLR2004 (client.py plus tests, HTTP status/size comparisons), PLW0603 (client.py + config.py, module-level lazy singletons), TID252 (5 src/ files, this package's own internal relative imports). Two previously-global entries with zero hits anywhere (S106) or fixable outright (PIE790: one redundant `pass` removed from errors.py; RUF022: one unsorted `__all__` in tools/__init__.py) were resolved with `ruff check --fix` instead of kept ignored. S101 (assert), S105 (a literal secret value in test fixtures), and PLC0415 (importing the module/fixture under test inside the test body) were moved from the global ignore into `[tool.ruff.lint.per-file-ignores]` for tests/* -- all three fire only in tests/, never in src/."
 classification = "by_design"
+
+# Ruff is not missing; it moved. Gourmand's IF001 looks for a literal
+# `ruff-check` hook id, and under python-sdlc (constitution XII, v1.30.0) ruff
+# runs inside the `sdlc-commit` hook, configured by [tool.ruff] in
+# pyproject.toml. Same precedent as trentina.
+[[exceptions]]
+check = "linter_configuration"
+path = ".pre-commit-config.yaml"
+pattern = "ruff-check"
+justification = "ruff runs inside the sdlc-commit hook from python-sdlc (constitution XII v1.30.0), configured by [tool.ruff] in pyproject.toml; Gourmand looks for a literal ruff hook id"
+classification = "by_design"

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp-github-crunchtools"
-version = "2.0.1"
+version = "2.1.0"
 description = "Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search"
 requires-python = ">=3.10"
 license = "AGPL-3.0-or-later"
@@ -68,6 +68,7 @@ max-complexity = 10
 "tests/*" = ["S101", "S105", "PLC0415", "PLR2004"]
 
 [tool.mypy]
+files = ["src"]
 python_version = "3.10"
 strict = true
 warn_return_any = true
@@ -76,3 +77,13 @@ warn_unused_configs = true
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]
+
+[tool.sdlc.push]
+# No in-repo Semgrep rules: the check exits 2 when .semgrep is absent
+# rather than scanning nothing and calling it a pass.
+skip = ["semgrep"]
+
+# The values the old CI job set, so the tests that read them still run.
+[tool.sdlc.push.pytest]
+env = { GITHUB_TOKEN = "test_token_for_ci" }
+

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/crunchtools/mcp-github",
     "source": "github"
   },
-  "version": "2.0.1",
+  "version": "2.1.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "mcp-github-crunchtools",
-      "version": "2.0.1",
+      "version": "2.1.0",
       "transport": {
         "type": "stdio"
       }

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/src/mcp_github_crunchtools/__init__.py

@@ -29,7 +29,7 @@ import argparse
 
 from .server import mcp
 
-__version__ = "2.0.1"
+__version__ = "2.1.0"
 __all__ = ["main", "mcp"]
 
 

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/src/mcp_github_crunchtools/client.py

@@ -5,9 +5,11 @@ All requests go through this client to ensure consistent security practices.
 """
 
 import ipaddress
+import json
 import logging
 import re
 import time
+from importlib.metadata import version
 from typing import Any
 from urllib.parse import urlparse
 
@@ -44,6 +46,62 @@ def _retry_after_seconds(headers: httpx.Headers) -> int | None:
 
 
 MAX_RESPONSE_SIZE = 10 * 1024 * 1024
+BODY_SNIPPET_CHARS = 200
+ELLIPSIS = "..."
+
+
+def _body_snippet(body: bytes) -> str:
+    """A short, single-line excerpt of a response body, for an error message."""
+    prefix = body[: BODY_SNIPPET_CHARS * 4]
+    collapsed = " ".join(prefix.decode("utf-8", errors="replace").split())
+    if not collapsed:
+        return "<empty body>"
+    if len(collapsed) > BODY_SNIPPET_CHARS or len(body) > len(prefix):
+        return collapsed[: BODY_SNIPPET_CHARS - len(ELLIPSIS)] + ELLIPSIS
+    return collapsed
+
+
+# Query parameters whose value is a secret rather than part of the request.
+# `access_token` is GitHub's own retired query-string auth, and an Enterprise
+# host in front of a proxy can take any of these.
+REDACTED_PARAMS = frozenset({"access_token", "client_secret", "code", "token"})
+
+
+def _safe_url(url: httpx.URL) -> httpx.URL:
+    """A URL fit to appear in an error message (Layer 1).
+
+    Userinfo first: it carries its secret before the path, where redacting
+    query parameters never reaches it. The rest is redacted by name, because
+    `per_page`, `state` and `sha` are the diagnosis.
+    """
+    url = url.copy_with(userinfo=b"")
+    for name in REDACTED_PARAMS & set(url.params):
+        url = url.copy_set_param(name, "***")
+    return url
+
+
+def _where(response: httpx.Response) -> str:
+    """Which request a response answered, for an error message.
+
+    The requested URL rather than the path: `GITHUB_API_BASE_URL` points this
+    client at github.com or at an Enterprise host, and a base URL that answers
+    with a login page is not something a path alone can describe.
+    """
+    return (
+        f"{response.request.method} {_safe_url(response.request.url)} "
+        f"(HTTP {response.status_code}, {response.headers.get('content-type', 'no content-type')})"
+    )
+
+
+# Identify this client by name. httpx otherwise sends `python-httpx/<version>`,
+# which bot protection answers with an HTML challenge page instead of the API --
+# the failure that cost an afternoon on mcp-wordpress (RT #1596). GitHub also
+# asks API clients to send one. The version comes from installed package
+# metadata so it cannot drift from pyproject.toml.
+USER_AGENT = (
+    f"mcp-github-crunchtools/{version('mcp-github-crunchtools')} "
+    "(+https://github.com/crunchtools/mcp-github)"
+)
 # A job log is streamed and only its tail is kept, so it may be larger than a
 # buffered API response; past this the download is abandoned.
 MAX_DOWNLOAD_SIZE = 2 * MAX_RESPONSE_SIZE
@@ -127,6 +185,7 @@ class GitHubClient:
             headers = {
                 "Accept": DEFAULT_ACCEPT,
                 "X-GitHub-Api-Version": GITHUB_API_VERSION,
+                "User-Agent": USER_AGENT,
             }
             if self._config.token:
                 headers["Authorization"] = f"Bearer {self._config.token}"
@@ -177,11 +236,17 @@ class GitHubClient:
         params: dict[str, Any] | None = None,
         json_data: dict[str, Any] | None = None,
         accept: str | None = None,
-    ) -> httpx.Response:
-        """Send one authenticated API request and return the raw response.
+    ) -> tuple[httpx.Response, bytes]:
+        """Send one authenticated API request and return it with its bounded body.
 
         Transport failures and oversized responses are raised as
         GitHubApiError; the HTTP status is left for the caller to judge.
+
+        Streamed rather than read whole, because the cap has to hold while the
+        body arrives. The `content-length` check this replaces was the only
+        limit on the JSON path, and GitHub does not always send that header --
+        the job-log download below has always read in bounded pieces, which is
+        what made the gap easy to miss.
         """
         # Resolved before anything else, so a call with no usable token makes
         # no request at all.
@@ -194,23 +259,49 @@ class GitHubClient:
         logger.debug("API request: %s %s", method, path)
 
         try:
-            response = await client.request(
+            request = client.build_request(
                 method=method,
                 url=path,
                 params=params,
                 json=json_data,
                 headers=headers or None,
             )
+            response = await client.send(request, stream=True)
+            try:
+                body = await self._read_capped(response)
+            finally:
+                await response.aclose()
         except httpx.TimeoutException as e:
             raise GitHubApiError(0, f"Request timeout: {e}") from e
         except httpx.RequestError as e:
             raise GitHubApiError(0, f"Request failed: {e}") from e
 
-        content_length = response.headers.get("content-length")
-        if content_length and int(content_length) > MAX_RESPONSE_SIZE:
-            raise GitHubApiError(0, "Response too large")
+        return response, body
+
+    @staticmethod
+    async def _read_capped(response: httpx.Response) -> bytes:
+        """Read the body, aborting as soon as it would pass MAX_RESPONSE_SIZE.
 
-        return response
+        One buffer, measured before the copy: `aiter_bytes()` promises nothing
+        about chunk size -- one chunk can be the whole body -- so appending
+        first would copy in exactly the response being refused.
+        """
+        declared = response.headers.get("content-length")
+        if declared and declared.isdigit() and int(declared) > MAX_RESPONSE_SIZE:
+            raise GitHubApiError(
+                response.status_code,
+                f"{_where(response)} declared {declared} bytes, over the "
+                f"{MAX_RESPONSE_SIZE} byte limit",
+            )
+        body = bytearray()
+        async for chunk in response.aiter_bytes():
+            if len(body) + len(chunk) > MAX_RESPONSE_SIZE:
+                raise GitHubApiError(
+                    response.status_code,
+                    f"{_where(response)} sent over the {MAX_RESPONSE_SIZE} byte limit",
+                )
+            body += chunk
+        return bytes(body)
 
     async def _request(
         self,
@@ -242,22 +333,25 @@ class GitHubClient:
             PermissionDeniedError: On 401 authorization failures
             NotFoundError: When the resource does not exist
         """
-        response = await self._send(method, path, params, json_data, accept)
+        response, body = await self._send(method, path, params, json_data, accept)
 
         if not response.is_success:
-            self._handle_error_response(response)
+            self._handle_error_response(response, body)
 
         if response.status_code == 204:
             return {"status": "deleted"}
 
         content_type = response.headers.get("content-type", "")
         if "application/json" not in content_type:
-            return {"content": response.text}
+            return {"content": body.decode("utf-8", errors="replace")}
 
         try:
-            parsed = response.json()
+            parsed = json.loads(body)
         except ValueError as e:
-            raise GitHubApiError(response.status_code, f"Invalid JSON response: {e}") from e
+            raise GitHubApiError(
+                response.status_code,
+                f"{_where(response)} is not JSON ({e}): {_body_snippet(body)}",
+            ) from e
 
         if isinstance(parsed, list):
             return self._wrap_list_response(parsed, response)
@@ -291,7 +385,7 @@ class GitHubClient:
 
         return wrapped
 
-    def _handle_error_response(self, response: httpx.Response) -> None:
+    def _handle_error_response(self, response: httpx.Response, body: bytes) -> None:
         """Handle error responses from the API.
 
         GitHub signals primary rate limiting with HTTP 403 (not 429) plus
@@ -299,23 +393,28 @@ class GitHubClient:
 
         Args:
             response: HTTP response
+            body: its bounded body, already read
 
         Raises:
             Various UserError subclasses based on error type
         """
         status_code = response.status_code
 
-        error_msg: str = "Unknown error"
+        error_msg: str = ""
         try:
-            error_body = response.json()
+            error_body = json.loads(body)
             if isinstance(error_body, dict):
                 raw_msg = error_body.get("message", error_body.get("error"))
                 if isinstance(raw_msg, (dict, str, int, float)):
-                    error_msg = str(raw_msg)
+                    error_msg = str(raw_msg)[: BODY_SNIPPET_CHARS * 4]
             else:
-                error_msg = str(error_body)
+                error_msg = str(error_body)[: BODY_SNIPPET_CHARS * 4]
         except ValueError:
-            error_msg = response.text[:200] if response.text else "Unknown error"
+            error_msg = ""
+        # A body that is not GitHub's JSON error shape is quoted with the
+        # request it answered: that is what tells an Enterprise login page or a
+        # proxy apart from the API refusing something.
+        error_msg = error_msg or f"{_where(response)} returned {_body_snippet(body)}"
 
         rate_remaining = response.headers.get("x-ratelimit-remaining")
 
@@ -387,10 +486,10 @@ class GitHubClient:
             RateLimitError, PermissionDeniedError, NotFoundError: As for any
                 API request, from the first hop
         """
-        response = await self._send("GET", path)
+        response, body = await self._send("GET", path)
         if not response.is_redirect:
             if not response.is_success:
-                self._handle_error_response(response)
+                self._handle_error_response(response, body)
             raise GitHubApiError(response.status_code, "Expected a redirect to a download")
 
         location = response.headers.get("location", "")

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/src/mcp_github_crunchtools/server.py

@@ -46,7 +46,7 @@ READ_ONLY = {"readOnlyHint": True}
 
 mcp = FastMCP(
     name="mcp-github",
-    version="2.0.1",
+    version="2.1.0",
     instructions=(
         "Secure MCP server for GitHub repositories: issues, pull requests "
         "(open, review discussion, diffs, CI checks, merge), Actions runs and "

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/src/mcp_github_crunchtools/tools/files.py

@@ -51,9 +51,7 @@ async def get_file_content(
 
     client = get_client()
     params = {"ref": ref} if ref else None
-    result = await client.get(
-        f"/repos/{owner}/{repo}/contents/{encoded_path}", params=params
-    )
+    result = await client.get(f"/repos/{owner}/{repo}/contents/{encoded_path}", params=params)
 
     if isinstance(result.get("content"), list):
         raise ValidationError("path refers to a directory, not a file")
@@ -119,6 +117,4 @@ async def list_repo_tree(
 
     client = get_client()
     params = {"recursive": "1"} if recursive else None
-    return await client.get(
-        f"/repos/{owner}/{repo}/git/trees/{encoded_sha}", params=params
-    )
+    return await client.get(f"/repos/{owner}/{repo}/git/trees/{encoded_sha}", params=params)

{mcp_github_crunchtools-2.0.1 → mcp_github_crunchtools-2.1.0}/tests/conftest.py

@@ -2,7 +2,8 @@
 
 import os
 from collections.abc import Callable, Generator
-from unittest.mock import AsyncMock, patch
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import httpx
 import pytest
@@ -41,46 +42,67 @@ def _mock_response(
     )
 
 
-def _patch_client(mock_response: httpx.Response):
-    """Patch the httpx AsyncClient to return a mock response.
+def _answer(template: httpx.Response, request: httpx.Request) -> httpx.Response:
+    """A fresh response with a template's status, type and body, for one request.
+
+    Fresh because a streamed body can be read once, and because the error
+    messages under test name `response.request.url` -- the URL the client
+    actually built, not the placeholder a template carries. Content-length is
+    dropped so httpx recomputes it, unless a test set one deliberately.
+    """
+    keep = template.headers.get("content-length") if "content-length" in template.headers else None
+    headers = {k: v for k, v in template.headers.items() if k.lower() != "content-length"}
+    response = httpx.Response(
+        template.status_code, headers=headers, content=template.content, request=request
+    )
+    if keep is not None:
+        response.headers["content-length"] = keep
+    return response
+
 
-    Sets GITHUB_TOKEN so config initializes, then mocks the HTTP layer.
+def _mock_http(**send: Any) -> AsyncMock:
+    """A stand-in for the client, whose `build_request` builds a real request.
+
+    The client streams now: `build_request` then `send(..., stream=True)`. A
+    real `httpx.Client` builds the request, so assertions on the method, url,
+    params, json and headers a caller passed still mean what they did, while
+    `send` is what each test scripts.
+
+    What this cannot see is the client's own behaviour -- the User-Agent it
+    adds and the bounded read it performs. Those are tested through
+    `_patch_transport`, which uses a real client (constitution v1.36.0,
+    Layer 3).
     """
+    builder = httpx.Client(base_url="https://api.github.com")
+    mock_http = AsyncMock(spec=httpx.AsyncClient)
+    mock_http.build_request = MagicMock(side_effect=builder.build_request)
+    mock_http.send = AsyncMock(**send)
+    return mock_http
+
+
+def _patch_client(mock_response: httpx.Response):
+    """Patch the AsyncClient so every request is answered with one response."""
     import mcp_github_crunchtools.client as client_mod
     import mcp_github_crunchtools.config as config_mod
 
     client_mod._client = None
     config_mod._config = None
-
     os.environ.setdefault("GITHUB_TOKEN", "ghp_test_mock_token")
 
-    mock_http = AsyncMock(spec=httpx.AsyncClient)
-    mock_http.request = AsyncMock(return_value=mock_response)
-
-    return patch.object(
-        httpx,
-        "AsyncClient",
-        return_value=mock_http,
-    )
+    return patch.object(httpx, "AsyncClient", return_value=_mock_http(return_value=mock_response))
 
 
 def _patch_client_sequence(*mock_responses: httpx.Response):
-    """Patch the AsyncClient to return a sequence of responses."""
+    """Patch the AsyncClient to answer with a sequence of responses."""
     import mcp_github_crunchtools.client as client_mod
     import mcp_github_crunchtools.config as config_mod
 
     client_mod._client = None
     config_mod._config = None
-
     os.environ.setdefault("GITHUB_TOKEN", "ghp_test_mock_token")
 
-    mock_http = AsyncMock(spec=httpx.AsyncClient)
-    mock_http.request = AsyncMock(side_effect=list(mock_responses))
-
     return patch.object(
-        httpx,
-        "AsyncClient",
-        return_value=mock_http,
+        httpx, "AsyncClient", return_value=_mock_http(side_effect=list(mock_responses))
     )