* Identify STDIO API clients across MCP protocols

Preserve release identities, resolve actual source revisions, and attach upstream client metadata per request without mutating shared transports.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c

* Escape MCP client metadata and preserve revision provenance

Encode upstream client comments as valid HTTP header data, keep explicit build revisions independent of embedded dirty state, and reject null source hashes. Cover protocol wire behaviour and document the version-source contract.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c

* Preserve STDIO startup without usable version metadata

Skip invalid build metadata while retaining release and revision precedence. Fall back to dev with a stderr warning rather than preventing startup, and cover the compatibility contract in tests and documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c

* Always enable MCP Apps UI; remove remote_mcp_ui_apps flag gate

The remote_mcp_ui_apps flag is fully rolled out on the hosted server, but
the OSS server still defaulted it off. Make MCP Apps unconditional:

- _meta.ui is always emitted, stripped only when the client explicitly
  does not advertise the io.modelcontextprotocol/ui capability
- ui_get is always registered
- write tools defer to MCP App forms by default (still opt-out via
  mcp_apps_disable_form_deferral)
- remove MCPAppsFeatureFlag and its AllowedFeatureFlags/InsidersFeatureFlags
  entries
- update tests and regenerate docs

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove unused Inventory.checkFeatureFlag

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Omit app-only tools for clients without MCP Apps support

When a client does not advertise io.modelcontextprotocol/ui, stripping
_meta.ui from ui_get turned it into an ordinary model-visible tool,
violating its app-only contract. Now that ui_get is no longer feature
gated, omit tools whose ui.visibility excludes "model" instead.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Only tag builds should supply a release version. Other Docker builds use the existing linked-commit fallback instead of treating a branch or pull-request ref name as a release.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c

…nts and PR reviews (#3350)

* Add hide_comment and unhide_comment granular issue tools

Add two tools behind the issues_granular feature flag that hide
(minimize) and unhide (unminimize) comments via the GraphQL
minimizeComment/unminimizeComment mutations.

They support issue and pull request conversation comments, pull
request review comments, and pull request review bodies. Callers
pass the numeric REST ID plus a comment_type; the tool resolves the
GraphQL node ID via the matching REST endpoint before mutating.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Rename comment_type enum values to pull_request_review(_comment)

Use `pull_request_review` and `pull_request_review_comment` instead of
`review` and `review_comment` so the comment_type values are explicit
about which object they refer to.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use realistic minimizedReason values in hide_comment test mocks

GitHub returns minimizedReason in lowercase, hyphenated form (e.g.
"off-topic") rather than echoing the classifier enum, as confirmed by
an end-to-end run against the live API.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Split hide/unhide comment tools per object type

Replace hide_comment/unhide_comment, which took a comment_type
argument, with a granular pair per object type:

- hide_issue_comment / unhide_issue_comment (issues_granular):
  issue comments and pull request conversation comments
- hide_pull_request_review_comment / unhide_pull_request_review_comment
  (pull_requests_granular): inline pull request review comments
- hide_pull_request_review / unhide_pull_request_review
  (pull_requests_granular): pull request review bodies

Every argument is now unconditionally required, so the schemas no
longer need prose explaining which arguments apply to which type. The
six tools are built from one shared helper, parameterised by a
commentVisibilityTarget that describes each object type and how to
resolve its GraphQL node ID.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Validate classifier and IDs before calling the GitHub API

JSON schema constraints (enum, minimum) aren't enforced when tool
arguments are unmarshalled, so an invalid classifier or a negative ID
previously reached GitHub and surfaced as a confusing 404 or GraphQL
error. Reject them up front with a clear argument error instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>