update_issue_labels is annotated destructiveHint: false but replaces (removes) existing labels

未关闭 适合新手
  • 哪里不对？
#3,760 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
69/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
go
领域
api, security

调研方向

阅读 pkg/github/issues_granular.go:368-375，并将 update_issue_labels 和 update_issue_assignees 的破坏性注解与它们的替换行为进行比较。检查附近有关工具注解的测试；当两个支持替换的工具都声明具有破坏性行为，且相关测试通过时，工作即告完成。这些工具受功能标志 issues_granular 控制。

由索引模型根据 Issue 内容生成。

描述

Describe the bug

The granular update_issue_labels tool sets destructiveHint: false. Its own description says "This replaces the current labels with the provided list", and that is what it does: labels not in the list are removed. A host that keys confirmation on destructiveHint may not prompt for a call that removes labels.

This is the opposite of #3281 / PR #3293, which are about additive tools that omit the hint. Here the hint is explicitly false on a tool that removes data. Open PR #2742 adds method: replace|add|remove but keeps replace as the default and does not change the annotation. update_issue_assignees uses the same annotation and the same replace pattern (issues_granular.go:238). That one was not tested live.

A previous PR, #2471, which marked the granular update_issue_* tools destructive for client egress policy, was closed unmerged. This issue is narrower: it concerns only the two replace-semantics tools, where the description and the annotation disagree.

The tool is behind the issues_granular feature flag, and this is an annotation-accuracy item only. To enable it, start the server with --features=issues_granular, which swaps the consolidated issue_write for the granular issue tools.

Code (main 99d6d650, unchanged since v2.1.0): pkg/github/issues_granular.go:368-375 (update_issue_labels, DestructiveHint: new(false) at :373).

Affected version

v2.1.0 (image sha256:f6056fc1…0f8a, commit 4bcdcdf8) and main nightly (image sha256:48bc16d0…338f, revision 99d6d650), both with --features=issues_granular.

Steps to reproduce the behavior
  1. tools/list shows update_issue_labels annotations {"destructiveHint":false,"idempotentHint":false,"openWorldHint":true,"readOnlyHint":false}.
  2. Issue N has labels [c, d].
    (123 stands for the issue/PR number.)
  3. Call: 
    {"name":"update_issue_labels","arguments":{"owner":"OWNER","repo":"REPO","issue_number":123,"labels":["a"]}}
  4. Result: success. Labels are now [a]: c and d were removed.
Expected vs actual behavior

Expected: a tool that can remove labels is annotated destructiveHint: true, or omits the hint, which defaults to true.

Actual: destructiveHint: false.

Suggested fix: set DestructiveHint: new(true) on update_issue_labels (and update_issue_assignees) while replace is possible. Annotations are static, so this holds even if PR #2742 adds non-destructive methods.

Logs
annotations: {"destructiveHint":false,"idempotentHint":false,"openWorldHint":true,"readOnlyHint":false,"title":"Update Issue Labels"}
labels before [c, d] -> update_issue_labels labels=["a"] -> OK -> labels after [a]     (v2.1.0 and main)

Found during an independent audit of v2.1.0 on a throwaway org and private test repo. Prepared with AI assistance (Claude Code); reproduced by two independent test runs before filing.

主要语言
Go
星标
34.2k
派生
5.3k
平均合并
5 天 18 小时
30 天内合并 PR
13

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/github-mcp-server 的其他 Issue

查看 github/github-mcp-server 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。