update_issue_labels is annotated destructiveHint: false but replaces (removes) existing labels

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#3,760 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 2 Tagen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
69/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
go
Bereich
api, security

Rechercherichtung

Lies pkg/github/issues_granular.go:368-375 und vergleiche die destruktiven Annotationen von update_issue_labels und update_issue_assignees mit ihrem Ersetzungsverhalten. Prüfe die Tests in der Nähe auf Tool-Annotationen; fertig ist die Arbeit, wenn beide Tools, die Ersetzungen vornehmen können, destruktives Verhalten deklarieren und die relevanten Tests bestehen. Die Tools sind hinter dem Feature-Flag issues_granular verborgen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Describe the bug

The granular update_issue_labels tool sets destructiveHint: false. Its own description says "This replaces the current labels with the provided list", and that is what it does: labels not in the list are removed. A host that keys confirmation on destructiveHint may not prompt for a call that removes labels.

This is the opposite of #3281 / PR #3293, which are about additive tools that omit the hint. Here the hint is explicitly false on a tool that removes data. Open PR #2742 adds method: replace|add|remove but keeps replace as the default and does not change the annotation. update_issue_assignees uses the same annotation and the same replace pattern (issues_granular.go:238). That one was not tested live.

A previous PR, #2471, which marked the granular update_issue_* tools destructive for client egress policy, was closed unmerged. This issue is narrower: it concerns only the two replace-semantics tools, where the description and the annotation disagree.

The tool is behind the issues_granular feature flag, and this is an annotation-accuracy item only. To enable it, start the server with --features=issues_granular, which swaps the consolidated issue_write for the granular issue tools.

Code (main 99d6d650, unchanged since v2.1.0): pkg/github/issues_granular.go:368-375 (update_issue_labels, DestructiveHint: new(false) at :373).

Affected version

v2.1.0 (image sha256:f6056fc1…0f8a, commit 4bcdcdf8) and main nightly (image sha256:48bc16d0…338f, revision 99d6d650), both with --features=issues_granular.

Steps to reproduce the behavior
  1. tools/list shows update_issue_labels annotations {"destructiveHint":false,"idempotentHint":false,"openWorldHint":true,"readOnlyHint":false}.
  2. Issue N has labels [c, d].
    (123 stands for the issue/PR number.)
  3. Call: 
    {"name":"update_issue_labels","arguments":{"owner":"OWNER","repo":"REPO","issue_number":123,"labels":["a"]}}
  4. Result: success. Labels are now [a]: c and d were removed.
Expected vs actual behavior

Expected: a tool that can remove labels is annotated destructiveHint: true, or omits the hint, which defaults to true.

Actual: destructiveHint: false.

Suggested fix: set DestructiveHint: new(true) on update_issue_labels (and update_issue_assignees) while replace is possible. Annotations are static, so this holds even if PR #2742 adds non-destructive methods.

Logs
annotations: {"destructiveHint":false,"idempotentHint":false,"openWorldHint":true,"readOnlyHint":false,"title":"Update Issue Labels"}
labels before [c, d] -> update_issue_labels labels=["a"] -> OK -> labels after [a]     (v2.1.0 and main)

Found during an independent audit of v2.1.0 on a throwaway org and private test repo. Prepared with AI assistance (Claude Code); reproduced by two independent test runs before filing.

Vorherrschende Sprache
Go
Sterne
34.2k
Forks
5.3k
Ø Merge
5 T. 18 Std.
Gemergte PRs (30 T.)
13

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus github/github-mcp-server

Alle Issues in github/github-mcp-server

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.