ql-mcp-client rewrite: Phases 1 & 2 — Replace ql-mcp-client.js with Go implementation

[data-douser]

Replaces the JavaScript-based ql-mcp-client.js CLI with a Go implementation (gh-ql-mcp-client) supporting use as a gh extension. Migrates client integration test infrastructure to Go, modernizes CI/build workflows, and aligns server-side annotation/audit/cache/SARIF tooling to be always-on by default. Addresses several review issues: subprocess lifecycle leak on Close() timeout, inaccurate skipped-test counts, defunct VS Code setting, schema default mismatch, misleading docs, and repo-root pollution from relative output paths.

📝 Update Information

Primitive Details

• Type: Both
• Name: gh-ql-mcp-client Go CLI, MonitoringConfigSchema, VS Code extension settings, Go integration test runner
• Update Category: Bug Fix, Feature Enhancement

⚠️ CRITICAL: PR SCOPE VALIDATION

✅ ALLOWED FILES:

• Server implementation files (server/src/**/*.ts)
• Modified registration files (server/src/tools/*.ts)
• Updated or new test files (server/test/**/*.ts, client/internal/**/*_test.go)
• Documentation updates (README.md, CHANGELOG.md, server docs)
• Updated type definitions (server/src/types/*.ts)
• Go client implementation (client/internal/**/*.go, client/cmd/**/*.go)
• Configuration updates (extensions/vscode/package.json, client/Makefile)

🚫 FORBIDDEN FILES:

• Files unrelated to the primitive update
• Temporary or test output files
• IDE configuration files
• Log files or debug output

---

🛑 MANDATORY PR VALIDATION CHECKLIST

• ONLY server implementation files are included
• NO temporary or output files are included
• NO unrelated configuration files are included
• ALL existing tests continue to pass
• NEW functionality is properly tested

---

• Impact Scope: Moderate

Update Metadata

• Breaking Changes: No
• API Compatibility: Maintained
• Performance Impact: Neutral

🎯 Changes Description

Current Behavior

• JS client: client/src/ql-mcp-client.js required Node.js; not usable as a gh extension.
• Close() subprocess leak: timed out after 3 s but left the Node.js server process running.
• Skipped test count: printSummary() always showed 0 skipped regardless of actual skips.
• codeql-mcp.enableAnnotationTools VS Code setting: contributed but was a no-op; tools are always registered.
• MonitoringConfigSchema.enableAnnotationTools: defaulted to false while the server defaulted to true via parseBoolEnv.
• CHANGELOG: incorrectly claimed ENABLE_ANNOTATION_TOOLS=false disables tool registration.
• Relative output paths: codeql_query_run fixtures with bare relative output/interpretedOutput paths (e.g. "query-results.bqrs") wrote files into the repo root.
• sleep-based subprocess test: platform-specific; skipped on Windows.
• startsWith path containment check: fragile on Windows due to drive-letter casing.
• --timeout flag help: said "0 = use server defaults" but timeouts are enforced client-side.
• CloseTimeoutErr message: said "may still be running" even though Close() now kills the process.

Updated Behavior

• Go CLI (gh-ql-mcp-client): Cobra + mcp-go; built via make -C client build; usable as a gh extension.
• Close(): captures *exec.Cmd via transport.WithCommandFunc(); calls serverCmd.Process.Kill() on 3 s timeout.
• Skipped count: runToolTests() records a TestResult with skipped: prefix; printSummary() accurate.
• VS Code setting: codeql-mcp.enableAnnotationTools removed from package.json.
• MonitoringConfigSchema: enableAnnotationTools defaults to true.
• CHANGELOG: clarifies ENABLE_ANNOTATION_TOOLS only affects auto-caching in result processing, not tool registration.
• Output path sandboxing: rewriteRelativeOutputPaths() redirects bare relative output/interpretedOutput/outputDir to <tmpBase>/test-output/<tool>/<testCase>/; cleanStaleOutput uses filepath.Rel to safely clean both relative and absolute paths within tmpBase.
• Cross-platform subprocess test: re-execs the test binary with GO_TEST_HANG_SUBPROCESS=1; TestMain blocks forever — no external binary dependency.
• Path containment: uses filepath.Rel(absBase, absTarget) checking for ".." prefix instead of startsWith.
• --timeout help: "0 = use client defaults".
• CloseTimeoutErr: "attempted to kill server subprocess".
• make test-integration: skips pack install by default (--no-install-packs); make test-integration-with-packs for explicit pack setup.

Motivation

Review feedback identified a subprocess leak, inaccurate test summary, defunct VS Code setting, schema default mismatch, misleading docs, repo-root artifact pollution, Windows-incompatible test, and a fragile path-containment check.

🔄 Before vs. After Comparison

Functionality Changes

// BEFORE: Close() timed out but left subprocess running
case <-time.After(3 * time.Second):
    return fmt.Errorf("%s", CloseTimeoutErr)

// AFTER: Close() force-kills on timeout
case <-time.After(3 * time.Second):
    if c.serverCmd != nil && c.serverCmd.Process != nil {
        _ = c.serverCmd.Process.Kill()
    }
    return fmt.Errorf("%s", CloseTimeoutErr)

// BEFORE: relative output paths written to CWD (repo root)
params["output"] = "query-results.bqrs"

// AFTER: redirected to per-test sandbox under tmpBase
params["output"] = "<repoRoot>/.tmp/test-output/codeql_query_run/my_test/query-results.bqrs"

// BEFORE: startsWith fragile on Windows
if (!absTarget.startsWith(absBase + sep) && absTarget !== absBase) { throw ... }

// AFTER: relative-path check handles drive-letter casing
const rel = relative(absBase, absTarget);
if (rel === '..' || rel.startsWith('..' + sep)) { throw ... }

API Changes

// BEFORE: inner was a concrete *mcpclient.Client
type Client struct {
    inner  *mcpclient.Client
    config Config
}

// AFTER: interface + subprocess handle retained
type Client struct {
    inner     innerClient  // interface: testable without live server
    config    Config
    serverCmd *exec.Cmd    // captured via transport.WithCommandFunc()
}

Output Format Changes

// BEFORE: printSummary always showed 0 skipped
Results: 5 passed, 0 failed, 0 skipped (of 5 total)

// AFTER: accurate skipped count
Results: 4 passed, 0 failed, 1 skipped (of 5 total)

🧪 Testing & Validation

Test Coverage Updates

• Existing Tests: All pass (1298 server TS; all Go unit tests)
• New Test Cases: TestClose_KillsSubprocessOnTimeout (re-exec pattern); TestRewriteRelativeOutputPaths; TestCleanStaleOutputAbsolutePathWithinBase; TestCleanStaleOutputRejectsAbsolutePathOutsideBase; should accept a valid logDir even when base path is a prefix of another path segment
• Regression Tests: hangCloser stub + re-exec subprocess guards against subprocess leak regression
• Edge Case Tests: Windows drive-letter path containment; absolute path sandbox boundaries; traversal rejection

Validation Scenarios

1. Subprocess kill on timeout: re-exec + hangCloser; proc.Wait() returns within 2 s of Close() timeout
2. Skipped result recording: fixture dir with codeql_pack_install; NoInstallPacks=true; asserts 1 skipped
3. Relative output sandboxing: params with bare "query-results.bqrs" rewritten to absolute path under tmpBase
4. Path containment: sibling-prefix dir rejected; traversal rejected; valid subdir accepted

Test Results

• Unit Tests: All pass (1298 TS / all Go)
• Integration Tests: Validated via CI workflow
• Manual Testing: Validated with real scenarios
• Performance Testing: No regressions detected

📋 Implementation Details

Files Modified

• Go client core: client/internal/mcp/client.go, client/internal/mcp/client_test.go
• Go integration runner: client/internal/testing/runner.go, client/internal/testing/runner_test.go
• Build orchestration: client/Makefile
• CLI flags: client/cmd/integration_tests.go
• Server lib: server/src/lib/log-directory-manager.ts
• Type Definitions: server/src/types/monitoring.ts
• Tests: server/test/src/lib/log-directory-manager.test.ts, server/test/src/tools/annotation-tools.test.ts
• VS Code extension: extensions/vscode/package.json, extensions/vscode/test/suite/mcp-tool-e2e.integration.test.ts
• Documentation: CHANGELOG.md

Code Changes Summary

• Algorithm Improvements: filepath.Rel-based path containment; per-test output sandboxing
• Error Handling: CloseTimeoutErr message accurate; cleanStaleOutput handles absolute paths safely
• Type Safety: innerClient interface decouples Client from concrete *mcpclient.Client
• Input Validation: Schema default aligned with runtime default
• Output Format: printSummary() accurately reflects skipped count

Dependencies

• No New Dependencies: Update uses existing dependencies only

🔍 Quality Improvements

Bug Fixes

• Subprocess leak: Close() left the MCP server process running after 3 s timeout. Root cause: no *exec.Cmd handle retained. Fix: capture via transport.WithCommandFunc(); kill on timeout. Prevention: TestClose_KillsSubprocessOnTimeout.
• Skipped count: printSummary() always 0 skipped. Root cause: early return without recording result. Fix: record TestResult with skipped: prefix.
• Repo-root pollution: relative output/interpretedOutput params written to CWD. Root cause: no path rewriting before tool call. Fix: rewriteRelativeOutputPaths() redirects to tmpBase.
• Path containment fragility: startsWith incorrect on Windows. Root cause: drive-letter casing differences. Fix: filepath.Rel check.

Code Quality Enhancements

• Readability: innerClient interface documents the mcp-go surface used by the client
• Maintainability: test-integration vs test-integration-with-packs make intent explicit
• Testability: innerClient + TestMain re-exec pattern enable isolated subprocess tests on all platforms
• Reusability: rewriteRelativeOutputPaths applied uniformly before every tool call

🔗 References

Related Issues/PRs

• Related PRs: Rewrite ql-mcp-client in Go as a gh CLI extension for Code Scanning SARIF management #207 (parent), ql-mcp-client Phase 1: Update documentation and GitHub config for Go-based client #216, ql-mcp-client Phase 2: Replace JavaScript client with Go binary and integration test runner #217

🚀 Compatibility & Migration

Backward Compatibility

• Fully Compatible: No breaking changes to MCP server API or tool contracts

API Evolution

• Maintained Contracts: Core API contracts preserved
• Better Error Messages: printSummary() accurate; CloseTimeoutErr truthful

👥 Review Guidelines

For Reviewers

Please verify:

• ⚠️ SCOPE COMPLIANCE: PR contains only server implementation, Go client, and extension files
• ⚠️ NO UNRELATED FILES: No temporary, output, or unrelated files
• ⚠️ BACKWARD COMPATIBILITY: Existing functionality preserved
• Functionality: Subprocess killed on timeout; output paths sandboxed; skipped count accurate
• Test Coverage: 1298 TS + all Go pass; new TDD tests cover subprocess kill, output rewriting, path containment
• Performance: No regressions
• Code Quality: innerClient interface; filepath.Rel containment check
• Documentation: CHANGELOG, schema comment, VS Code setting accurately reflect behavior

Testing Instructions

# Full server test suite
npm install && npm run build && npm test --workspace=server

# Go client unit tests
cd client && go test ./... -timeout 30s

# Integration tests (pack install skipped by default)
make -C client test-integration

# Integration tests WITH pack installation
make -C client test-integration-with-packs

# Lint
npm run lint

📊 Impact Assessment

Server Impact

• Startup Time: No significant impact
• Runtime Stability: Subprocess leak on Close() timeout eliminated
• Resource Usage: Reasonable
• Concurrent Usage: Safe

AI Assistant Impact

• Improved Reliability: More reliable subprocess cleanup in stdio mode
• Enhanced User Experience: Accurate test summary output in CI logs

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 6 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 89cff05.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

client/go.mod

Package	Version	License	Issue Type
github.com/google/uuid	1.6.0	Null	Unknown License
github.com/inconshreveable/mousetrap	1.1.0	Null	Unknown License
github.com/mark3labs/mcp-go	0.47.0	Null	Unknown License
github.com/spf13/cast	1.7.1	Null	Unknown License
github.com/spf13/cobra	1.10.2	Null	Unknown License
github.com/spf13/pflag	1.0.9	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-go	40f1582b2485089dde7abd97c1529aa768e1baff	🟢 6.1	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
gomod/github.com/google/jsonschema-go	0.4.2	Unknown	Unknown
gomod/github.com/google/uuid	1.6.0	Unknown	Unknown
gomod/github.com/inconshreveable/mousetrap	1.1.0	Unknown	Unknown
gomod/github.com/mark3labs/mcp-go	0.47.0	Unknown	Unknown
gomod/github.com/spf13/cast	1.7.1	Unknown	Unknown
gomod/github.com/spf13/cobra	1.10.2	Unknown	Unknown
gomod/github.com/spf13/pflag	1.0.9	Unknown	Unknown
gomod/github.com/yosida95/uritemplate/v3	3.0.2	⚠️ 2.6	Details Check Score Reason Dangerous-Workflow ⚠️ -1 no workflows found Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 4 Found 9/19 approved changesets -- score normalized to 4 Token-Permissions ⚠️ -1 No tokens found Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Pinned-Dependencies ⚠️ -1 no dependencies found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/lint-and-format.yml
• client/go.mod
• client/package.json

[Copilot]

Pull request overview

This PR updates the repository’s tooling, CI, and documentation to transition the client/ from the legacy Node.js ql-mcp-client.js workflow to a Go-based gh-ql-mcp-client workflow (including using make -C client ... targets for build/test/lint).

Changes:

• Updated root npm scripts to delegate client build/test/lint/clean to make -C client.
• Updated CI workflows to set up Go and run client integration tests via make -C client test-integration.
• Rewrote multiple docs/instructions to describe the new Go client CLI and Go-based integration test runner.

Show a summary per file

File	Description
package.json	Switches client build/test/lint/clean scripts from npm workspace to make -C client targets and removes client from workspaces.
package-lock.json	Removes client from workspace list but retains an extraneous client package entry.
docs/testing.md	Updates testing strategy docs to describe Go client-based integration tests and make commands.
client/README.md	Rewrites client README to describe gh-ql-mcp-client usage, commands, and Go module structure.
client/CLI-USAGE.md	Rewrites CLI usage guide to describe Go CLI subcommands and flags.
client/integration-tests/README.md	Updates integration test docs to describe Go runner parameter resolution and invocation.
client/Makefile	Adds a Makefile defining build/test/lint targets for the (intended) Go client.
client/.gitignore	Updates ignores for Go build artifacts and SARIF downloads.
.github/workflows/lint-and-format.yml	Adds actions/setup-go using client/go.mod.
.github/workflows/client-integration-tests.yml	Adds Go setup and switches test execution to make -C client test-integration.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates prompt guidance to use Go client and shell scripts for server management.
.github/instructions/client_go.instructions.md	Adds new Go client Copilot instruction file.
.github/instructions/client_src_js.instructions.md	Retargets the old JS instructions file to Go.
.github/instructions/client_integration_tests.instructions.md	Updates integration test instructions to reference the Go-based workflow.
.github/agents/ql-mcp-tool-*.md / ql-agent-skills-developer.md	Updates agent docs to reference Go client usage.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/client-integration-tests.yml:120

• make -C client test-integration can currently succeed without running any tests because the Makefile treats missing go.mod as “skip integration tests” and exits 0. In CI this can produce false-green runs. Prefer failing fast when Go sources aren’t present (or ensure go.mod is committed as part of this PR).

      ## Run integration tests. This script builds the server bundle and runs tests.
      ## We do NOT use 'npm run build-and-test' as it runs query unit tests which
      ## have a dedicated workflow (query-unit-tests.yml).
      - name: MCP Integration Tests - Run integration tests
        shell: bash
        run: make -C client test-integration

• Files reviewed: 52/54 changed files
• Comments generated: 10

[Copilot]

Pull request overview

This PR replaces the legacy JavaScript ql-mcp-client (previously used mainly as an MCP integration test harness) with a new Go-based CLI binary (gh-ql-mcp-client) and updates repo scripts, CI workflows, and docs to build/test via make -C client.

Changes:

• Remove the Node.js client/ workspace (package, ESLint config, and client/src/** implementation) and introduce a new Go module + Cobra CLI under client/.
• Port the integration test runner to Go and switch root scripts/CI to invoke make -C client ....
• Update documentation/instructions/agents/prompts to reference the Go client and new test workflows.

Show a summary per file

File	Description
package.json	Removes client workspace usage; routes build/test/lint through make -C client.
package-lock.json	Removes client from workspace list; still contains legacy client package metadata marked extraneous.
docs/testing.md	Updates testing layer docs and commands to reference Go client + Make targets.
client/scripts/run-integration-tests.sh	Builds Go client binary and runs integration tests via gh-ql-mcp-client instead of Node.
client/README.md	Rewrites client README around gh-ql-mcp-client and new workflows.
client/CLI-USAGE.md	Rewrites CLI usage docs for the Go client.
client/.gitignore	Replaces JS-era ignores with Go build artifacts + SARIF downloads; keeps node_modules ignored.
client/Makefile	Adds standardized Go build/test/lint targets and cross-compile support.
client/main.go	Adds Go entrypoint calling Cobra cmd.Execute().
client/go.mod	Introduces Go module and dependencies (cobra, mcp-go).
client/go.sum	Locks Go dependencies for the new module.
client/cmd/root.go	Adds Cobra root command and persistent flags (--mode, --host, --port, --format).
client/cmd/root_test.go	Adds unit tests for root command help/version/default flags.
client/cmd/helpers.go	Adds helper parseRepo for future NWO parsing.
client/cmd/helpers_test.go	Adds unit tests for parseRepo.
client/cmd/integration_tests.go	Adds integration-tests command wiring to the Go runner.
client/internal/mcp/client.go	Adds MCP client wrapper (stdio/http) with tool timeout policy.
client/internal/mcp/client_test.go	Adds unit tests for MCP client timeout behavior/constants.
client/internal/testing/runner.go	Adds Go integration test discovery/execution logic.
client/internal/testing/runner_test.go	Adds unit tests for runner utilities and mock execution.
client/internal/testing/params.go	Adds parameter resolution logic (test-config / monitoring-state / defaults).
client/internal/testing/params_test.go	Adds unit tests for param resolution helpers.
client/integration-tests/README.md	Updates integration test fixture docs to Go runner conventions and param precedence.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Updates fixture logDir target path for Go-based runner.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Updates fixture logDir target path for Go-based runner.
.github/workflows/lint-and-format.yml	Adds Go toolchain setup for lint/format workflow.
.github/workflows/client-integration-tests.yml	Adds Go toolchain setup; switches integration tests to make -C client test-integration.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates troubleshooting/build/test guidance to use Go client + Make.
.github/instructions/client_src_js.instructions.md	Repurposes instructions file to Go (applyTo client/**/*.go).
.github/instructions/client_integration_tests.instructions.md	Updates integration test instructions for Go runner/Make-based workflow.
.github/instructions/client_go.instructions.md	Adds new Go-specific Copilot instructions for client/**/*.go.
.github/agents/ql-mcp-tool-tester.md	Updates agent guidance from JS client to Go client usage.
.github/agents/ql-mcp-tool-developer.md	Updates tool developer testing guidance to Make/Go client.
.github/agents/ql-agent-skills-developer.md	Updates command example to use gh-ql-mcp-client.
client/package.json	Removes client npm package/workspace definition.
client/eslint.config.mjs	Removes JS lint config for the deleted Node client.
client/src/ql-mcp-client.js	Removes legacy Node CLI entrypoint.
client/src/lib/validate-source-root.js	Removes JS helper module (client rewrite).
client/src/lib/test-logger.js	Removes JS helper module (client rewrite).
client/src/lib/server-manager.js	Removes JS helper module (client rewrite).
client/src/lib/resolve-all-queries.js	Removes JS helper module (client rewrite).
client/src/lib/queries-filter-metadata.js	Removes JS helper module (client rewrite).
client/src/lib/process-query-metadata.js	Removes JS helper module (client rewrite).
client/src/lib/monitoring-integration-test-runner.js	Removes JS monitoring runner (client rewrite).
client/src/lib/mcp-test-suite.js	Removes JS MCP connectivity test suite (client rewrite).
client/src/lib/mcp-client-utils.js	Removes JS helper module (client rewrite).
client/src/lib/file-utils.js	Removes JS helper module (client rewrite).
client/src/lib/commands/query-commands.js	Removes JS command implementation (client rewrite).
client/src/lib/commands/metadata-commands.js	Removes JS command implementation (client rewrite).
client/src/lib/commands/basic-commands.js	Removes JS command implementation (client rewrite).
client/src/lib/command-handler.js	Removes JS CLI command router (client rewrite).
client/src/lib/cli-parser.js	Removes JS CLI parsing/validation (client rewrite).
client/src/lib/aggregate-query-metadata.js	Removes JS helper module (client rewrite).

Copilot's findings

Comments suppressed due to low confidence (3)

client/internal/testing/params.go:168

• For codeql_database_create, the generated params use an output key, but the server tool schema expects database (the database path/name to create). This default parameter logic likely won’t work if a fixture relies on runner defaults for this tool; align the key name with the tool’s input schema.

	case "codeql_database_create":
		params["language"] = "javascript"
		params["source-root"] = filepath.Join(staticPath, "test", "ExampleQuery1")
		params["output"] = filepath.Join(repoRoot, ".tmp", "test-db-create")

client/README.md:64

• The README documents code-scanning and sarif command groups (and related files like cmd/code_scanning.go, cmd/sarif.go), but the current client/cmd/ only implements integration-tests. This makes the usage/architecture documentation inaccurate for the code in this PR. Recommend either implementing the documented commands/files or trimming the README to only describe what’s implemented in Phase 2.

### Commands

#### `code-scanning` (alias: `cs`)

Interact with the GitHub Code Scanning REST API.

```bash
# List analyses for a repository
gh-ql-mcp-client code-scanning list-analyses --repo owner/repo

# List alerts with filters
gh-ql-mcp-client code-scanning list-alerts --repo owner/repo --state open --severity high

# Download a SARIF analysis
gh-ql-mcp-client code-scanning download-analysis --repo owner/repo --analysis-id 12345

sarif

SARIF analysis and alert comparison tools (delegates to MCP server tools).

gh-ql-mcp-client sarif --help

**client/CLI-USAGE.md:135**
* The global flags table lists `--mode` default as `http`, but `cmd/root.go` sets the default to `stdio`. The doc also suggests environment variables like `MCP_MODE` control transport, but the CLI currently relies on flags only. Update defaults/config docs (or implement env var binding) to avoid misleading users.

Global Flags

These flags are available on all commands:

Flag	Default	Description
--mode	http	MCP server transport (stdio/http)
--host	localhost	MCP server host (http mode)
--port	3000	MCP server port (http mode)
--format	text	Output format (text/json)

</details>


- **Files reviewed:** 52/54 changed files
- **Comments generated:** 7

[Copilot]

Pull request overview

This PR completes Phases 1 & 2 of the ql-mcp-client rewrite by removing the legacy Node.js-based client/src/ql-mcp-client.js integration test CLI and replacing it with a Go-based gh-ql-mcp-client binary (also usable as a gh extension), along with updated build/test workflows, CI wiring, and documentation across the repo.

Changes:

• Replaces the JS client + npm workspace with a Go module (client/) implementing an MCP client wrapper and a Go integration test runner.
• Switches root/CI workflows from npm -w client ... to make -C client ... for build/lint/test (including integration tests).
• Updates docs/instructions/prompts/agents to reference the Go client and new test runner conventions (including test-config.json usage and {{tmpdir}}).

Show a summary per file

File	Description
package.json	Removes client from workspaces; routes build/lint/test to make -C client ....
package-lock.json	Removes workspace listing but still retains an extraneous client package entry.
docs/testing.md	Updates integration test layer to reference Go client and new commands.
client/src/ql-mcp-client.js	Deletes legacy JS CLI entrypoint.
client/src/lib/validate-source-root.js	Deletes legacy JS helper.
client/src/lib/test-logger.js	Deletes legacy JS helper.
client/src/lib/server-manager.js	Deletes legacy JS helper.
client/src/lib/resolve-all-queries.js	Deletes legacy JS helper.
client/src/lib/queries-filter-metadata.js	Deletes legacy JS helper.
client/src/lib/process-query-metadata.js	Deletes legacy JS helper.
client/src/lib/monitoring-integration-test-runner.js	Deletes legacy JS monitoring test runner.
client/src/lib/mcp-test-suite.js	Deletes legacy JS MCP connectivity suite.
client/src/lib/mcp-client-utils.js	Deletes legacy JS helper.
client/src/lib/file-utils.js	Deletes legacy JS helper.
client/src/lib/commands/query-commands.js	Deletes legacy JS query command implementation.
client/src/lib/commands/metadata-commands.js	Deletes legacy JS metadata command implementation.
client/src/lib/commands/basic-commands.js	Deletes legacy JS basic command implementation.
client/src/lib/command-handler.js	Deletes legacy JS CLI dispatcher.
client/src/lib/cli-parser.js	Deletes legacy JS arg parsing/validation.
client/src/lib/aggregate-query-metadata.js	Deletes legacy JS metadata aggregation utility.
client/scripts/run-integration-tests.sh	Builds Go binary and runs integration tests via gh-ql-mcp-client.
client/README.md	Rewrites client README for Go binary usage, flags, and testing.
client/package.json	Deletes the client npm workspace package.
client/Makefile	Adds Make targets for build/lint/test/unit/integration/cross-compile.
client/main.go	Adds Go CLI entrypoint.
client/internal/testing/runner.go	Adds Go integration test runner (fixture discovery + tool calls).
client/internal/testing/runner_test.go	Adds unit tests for runner helpers.
client/internal/testing/params.go	Adds parameter resolution logic (test-config → monitoring params → defaults).
client/internal/testing/params_test.go	Adds unit tests for parameter resolution helpers.
client/internal/mcp/client.go	Adds Go MCP client wrapper for stdio/HTTP.
client/internal/mcp/client_test.go	Adds unit tests for MCP client utilities/timeouts.
client/integration-tests/README.md	Updates integration test fixture requirements for Go runner.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} for runtime-safe temp output.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} for runtime-safe temp output.
client/go.mod	Introduces Go module + dependencies (cobra, mcp-go).
client/go.sum	Adds Go dependency lockfile.
client/eslint.config.mjs	Deletes JS lint config (client no longer JS).
client/cmd/root.go	Adds Cobra root command and persistent flags.
client/cmd/root_test.go	Adds unit tests for root command help/defaults/version.
client/cmd/integration_tests.go	Adds integration-tests Cobra subcommand wiring.
client/cmd/helpers.go	Adds CLI helper(s).
client/cmd/helpers_test.go	Adds tests for CLI helper(s).
client/CLI-USAGE.md	Rewrites CLI usage docs for Go CLI and new commands.
client/.gitignore	Updates ignore rules for Go artifacts and SARIF downloads.
.github/workflows/lint-and-format.yml	Adds Go setup step for lint/format workflow.
.github/workflows/client-integration-tests.yml	Uses make -C client test-integration; adds Go toolchain setup and env.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates prompt guidance to use Go client + Make targets.
.github/instructions/client_src_js.instructions.md	Removes JS client instructions (client/src is deleted).
.github/instructions/client_integration_tests.instructions.md	Updates integration-test instructions for Go runner + Make usage.
.github/instructions/client_go.instructions.md	Adds new Go client instruction file for client/**/*.go.
.github/agents/ql-mcp-tool-tester.md	Updates agent guidance to use Go client for testing.
.github/agents/ql-mcp-tool-developer.md	Updates developer agent guidance to use Go client + Make integration tests.
.github/agents/ql-agent-skills-developer.md	Updates tool listing command to use Go client.

Copilot's findings

Comments suppressed due to low confidence (1)

client/internal/testing/runner.go:289

• resolvePathPlaceholders only replaces {{tmpdir}} in top-level string values. Tool params can include nested maps (e.g., alertA/alertB) and arrays (e.g., tests, files) where placeholders may appear, which would currently not be rewritten. Consider making placeholder resolution recursive over maps/slices so fixtures can safely use {{tmpdir}} anywhere in the parameter structure.

// resolvePathPlaceholders replaces {{tmpdir}} in parameter values.
func resolvePathPlaceholders(params map[string]any, tmpBase string) map[string]any {
	if err := os.MkdirAll(tmpBase, 0o750); err != nil {
		fmt.Fprintf(os.Stderr, "warning: cannot create tmp dir %s: %v\n", tmpBase, err)
	}
	result := make(map[string]any, len(params))
	for k, v := range params {
		if s, ok := v.(string); ok && strings.Contains(s, "{{tmpdir}}") {
			result[k] = strings.ReplaceAll(s, "{{tmpdir}}", tmpBase)
		} else {
			result[k] = v
		}
	}
	return result

• Files reviewed: 52/54 changed files
• Comments generated: 4

[Copilot]

Pull request overview

This PR migrates the repository’s client integration test harness from the legacy Node.js client/src/ql-mcp-client.js implementation to a new Go-based CLI (gh-ql-mcp-client), and updates build/test workflows, CI, and documentation accordingly.

Changes:

• Replace root npm workspace usage of client/ with make -C client ... targets, and update CI to set up Go and run Go-based client integration tests.
• Add a new Go module under client/ implementing an MCP client wrapper + integration test runner.
• Remove the legacy JavaScript client sources and client workspace package configuration, and update docs/instructions to reference the Go client.

Show a summary per file

File	Description
package.json	Switch client build/lint/test scripts from npm workspace to make -C client.
package-lock.json	Remove client from workspace list, but still retains an extraneous client package entry.
docs/testing.md	Update testing-layer documentation to reference the Go client runner.
.github/workflows/lint-and-format.yml	Add Go toolchain setup for lint/format workflow.
.github/workflows/client-integration-tests.yml	Add Go toolchain setup, update integration test invocation, and set annotation tools env.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Update prompt guidance to use the Go client and make-based workflows.
.github/instructions/client_integration_tests.instructions.md	Update Copilot instructions to reflect Go-based test running for integration tests.
.github/instructions/client_go.instructions.md	Add new Copilot instructions for Go client code in client/**/*.go.
.github/instructions/client_src_js.instructions.md	Remove deprecated JS client instructions file.
.github/agents/ql-mcp-tool-tester.md	Update agent documentation to reference the Go client.
.github/agents/ql-mcp-tool-developer.md	Update agent documentation to reference Go client integration tests.
.github/agents/ql-agent-skills-developer.md	Update agent documentation to reference Go client CLI usage.
client/Makefile	Add make-based Go build/test/lint targets for the new client.
client/go.mod	Introduce Go module definition for the Go client.
client/go.sum	Add Go dependency checksums.
client/main.go	Add Go entry point invoking Cobra command execution.
client/cmd/root.go	Add Cobra root command and global flags.
client/cmd/root_test.go	Add unit tests for root command help/version/default flags.
client/cmd/helpers.go	Add CLI helper (repo parsing).
client/cmd/helpers_test.go	Add tests for CLI helper.
client/cmd/integration_tests.go	Add integration-tests Cobra command wiring + MCP client adapter.
client/internal/mcp/client.go	Add Go MCP client wrapper (stdio/http connect, tool calls, list calls).
client/internal/mcp/client_test.go	Add unit tests for MCP client timeouts/constants/config.
client/internal/testing/runner.go	Add Go integration test runner (fixture discovery, tool availability enforcement).
client/internal/testing/runner_test.go	Add unit tests for runner behavior and helper functions.
client/internal/testing/params.go	Add parameter resolution logic (test-config.json, monitoring-state.json, tool defaults).
client/internal/testing/params_test.go	Add unit tests for parameter resolution and SARIF injection behavior.
client/scripts/run-integration-tests.sh	Update integration test script to build Go binary and execute Go CLI.
client/README.md	Rewrite client README to describe gh-ql-mcp-client usage and workflows.
client/CLI-USAGE.md	Rewrite CLI usage guide to reference the Go CLI.
client/integration-tests/README.md	Update integration test fixture documentation for Go runner parameter resolution.
client/.gitignore	Update ignores for Go artifacts and SARIF downloads; keep legacy node_modules/dist ignores.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Update fixture to use {{tmpdir}}-based log directory.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Update fixture to use {{tmpdir}}-based log directory.
client/package.json	Remove the legacy client npm workspace package.
client/eslint.config.mjs	Remove legacy client ESLint config.
client/src/ql-mcp-client.js	Remove legacy JS CLI entrypoint.
client/src/lib/validate-source-root.js	Remove legacy JS helper.
client/src/lib/test-logger.js	Remove legacy JS helper.
client/src/lib/server-manager.js	Remove legacy JS helper.
client/src/lib/resolve-all-queries.js	Remove legacy JS helper.
client/src/lib/queries-filter-metadata.js	Remove legacy JS helper.
client/src/lib/process-query-metadata.js	Remove legacy JS helper.
client/src/lib/monitoring-integration-test-runner.js	Remove legacy JS helper.
client/src/lib/mcp-test-suite.js	Remove legacy JS helper.
client/src/lib/mcp-client-utils.js	Remove legacy JS helper.
client/src/lib/file-utils.js	Remove legacy JS helper.
client/src/lib/commands/query-commands.js	Remove legacy JS command module.
client/src/lib/commands/metadata-commands.js	Remove legacy JS command module.
client/src/lib/commands/basic-commands.js	Remove legacy JS command module.
client/src/lib/command-handler.js	Remove legacy JS command module.
client/src/lib/cli-parser.js	Remove legacy JS CLI parser.
client/src/lib/aggregate-query-metadata.js	Remove legacy JS helper.

Copilot's findings

Comments suppressed due to low confidence (4)

docs/testing.md:45

• Docs say transport mode is controlled by --mode or MCP_MODE, but the Go CLI currently only reads the --mode flag (no env binding for MCP_MODE). Either wire MCP_MODE into the flag default or update the docs to avoid implying env var support.
  client/README.md:101
• The environment variable table lists MCP_MODE as supported, but earlier the README states the CLI does not read MCP_MODE. Either remove/clarify MCP_MODE here as unsupported, or implement env var binding so behavior matches the documentation.

| `MCP_SERVER_URL`  | Override MCP server URL (http mode)                     | `http://localhost:3000/mcp`  |
| `MCP_SERVER_PATH` | Override path to MCP server JS entry point (stdio mode) | Auto-detected from repo root |
| `MCP_MODE`        | Transport mode (`stdio`/`http`)                         | `http`                       |
| `HTTP_HOST`       | Server host                                             | `localhost`                  |
| `HTTP_PORT`       | Server port                                             | `3000`                       |

client/CLI-USAGE.md:160

• The environment variable table lists MCP_MODE, but the Go CLI currently does not read MCP_MODE (mode is only set via --mode). Either remove MCP_MODE here or implement env var binding so the documentation matches behavior.

| `MCP_SERVER_URL`  | Override MCP server URL (http mode)                     | `http://localhost:3000/mcp`  |
| `MCP_SERVER_PATH` | Override path to MCP server JS entry point (stdio mode) | Auto-detected from repo root |
| `MCP_MODE`        | Transport mode (`stdio`/`http`)                         | `http`                       |
| `HTTP_HOST`       | Server host                                             | `localhost`                  |
| `HTTP_PORT`       | Server port                                             | `3000`                       |

client/README.md:112

• The architecture tree lists cmd/code_scanning.go / cmd/code_scanning_*.go, but those files aren’t present in this PR. Please update the tree to match the current implementation, or add the missing command stubs so the documented layout is accurate.

│   ├── root.go                 # Root command + global flags
│   ├── code_scanning.go        # code-scanning subcommand group
│   ├── code_scanning_*.go      # Individual code-scanning subcommands
│   ├── sarif.go                # sarif subcommand group

• Files reviewed: 52/54 changed files
• Comments generated: 10

[Copilot]

Pull request overview

Migrates the repository’s MCP client + integration test runner from the legacy JavaScript implementation to a new Go-based CLI (gh-ql-mcp-client), updating build/test orchestration (Make + scripts), CI workflows, and related documentation to match the new client architecture.

Changes:

• Replaces the JS client workspace with a Go module + Cobra CLI and ports the integration test runner to Go.
• Updates build/test entrypoints (package.json, client/Makefile, client/scripts/run-integration-tests.sh) and CI workflows to build/run the Go client.
• Refreshes docs/instructions/agent guides to reference the Go client and updated integration test configuration patterns.

Show a summary per file

File	Description
package.json	Switches client build/lint/test to make -C client … and removes client workspace.
package-lock.json	Updates workspaces metadata after removing client workspace (still contains stale client package entry).
docs/testing.md	Updates testing layer docs to reference Go client and new commands.
client/.gitignore	Updates ignore rules for Go binaries/coverage and SARIF downloads.
client/CLI-USAGE.md	Rewrites CLI usage for Go client (currently documents commands not implemented in this PR).
client/Makefile	Adds Make targets for building/testing/linting the Go client and running integration tests.
client/README.md	Rewrites README for Go CLI (currently documents commands/files not implemented in this PR).
client/main.go	Adds Go CLI entrypoint.
client/go.mod	Introduces Go module for the client.
client/go.sum	Adds dependency lockfile for Go module.
client/scripts/run-integration-tests.sh	Updates integration test orchestration to build/run Go binary (and extract test DBs).
client/cmd/root.go	Adds Cobra root command + persistent flags.
client/cmd/root_test.go	Unit tests for root command help/version/default flags.
client/cmd/helpers.go	Adds small CLI helper(s) (e.g., parsing owner/repo).
client/cmd/helpers_test.go	Unit tests for helpers.
client/cmd/integration_tests.go	Adds integration-tests Cobra command wiring to Go runner + MCP client.
client/internal/mcp/client.go	Adds MCP client wrapper using mcp-go for stdio/HTTP.
client/internal/mcp/client_test.go	Unit tests for MCP client helper logic (timeouts/constants).
client/internal/testing/runner.go	Implements Go integration test runner (fixture discovery + tool calls).
client/internal/testing/runner_test.go	Unit tests for runner utilities/behaviors.
client/internal/testing/params.go	Implements fixture parameter resolution (test-config → monitoring params → defaults).
client/internal/testing/params_test.go	Unit tests for parameter resolution utilities.
client/integration-tests/README.md	Updates integration test authoring docs for Go runner + test-config.json preference.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} placeholder for Go runner.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} placeholder for Go runner.
.github/workflows/lint-and-format.yml	Adds Go toolchain setup for repo lint/format workflow.
.github/workflows/client-integration-tests.yml	Adds Go toolchain setup and switches integration tests to make -C client test-integration.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates build/test guidance to Go client + Make targets.
.github/instructions/client_integration_tests.instructions.md	Updates integration test contribution guidance to Go-based workflow.
.github/instructions/client_go.instructions.md	Adds new Go-specific Copilot instructions for client/**/*.go.
.github/agents/ql-mcp-tool-tester.md	Updates agent guidance to use Go client for integration tests.
.github/agents/ql-mcp-tool-developer.md	Updates agent guidance for running integration tests with Go client/Make.
.github/agents/ql-agent-skills-developer.md	Updates tool discovery example to Go client (but references an unimplemented command).
client/package.json	Removes legacy JS client workspace package definition.
client/eslint.config.mjs	Removes legacy JS client lint config.
.github/instructions/client_src_js.instructions.md	Removes JS-client Copilot instructions.
client/src/lib/validate-source-root.js	Removes legacy JS client code.
client/src/lib/test-logger.js	Removes legacy JS client code.
client/src/lib/server-manager.js	Removes legacy JS client code.
client/src/lib/resolve-all-queries.js	Removes legacy JS client code.
client/src/lib/queries-filter-metadata.js	Removes legacy JS client code.
client/src/lib/process-query-metadata.js	Removes legacy JS client code.
client/src/lib/monitoring-integration-test-runner.js	Removes legacy JS client code.
client/src/lib/mcp-test-suite.js	Removes legacy JS client code.
client/src/lib/mcp-client-utils.js	Removes legacy JS client code.
client/src/lib/file-utils.js	Removes legacy JS client code.
client/src/lib/commands/query-commands.js	Removes legacy JS client code.
client/src/lib/commands/metadata-commands.js	Removes legacy JS client code.
client/src/lib/commands/basic-commands.js	Removes legacy JS client code.
client/src/lib/command-handler.js	Removes legacy JS client code.
client/src/lib/cli-parser.js	Removes legacy JS client code.
client/src/lib/aggregate-query-metadata.js	Removes legacy JS client code.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/client-integration-tests.yml:43

• The workflow sets ENABLE_ANNOTATION_TOOLS: 'true', but client/scripts/run-integration-tests.sh interprets this as “annotation tools ONLY” and skips the default integration test suite. If the intent is to run default + annotation coverage in CI, avoid setting this env var globally (or adjust the script to separate “enable tools” from “select mode”).

    env:
      ENABLE_ANNOTATION_TOOLS: 'true'
      HTTP_HOST: 'localhost'
      HTTP_PORT: '3000'
      MCP_MODE: ${{ matrix.mcp-mode }}
      TIMEOUT_SECONDS: '30'

• Files reviewed: 52/54 changed files
• Comments generated: 3

[Copilot]

Pull request overview

This PR completes Phases 1 & 2 of the client rewrite by replacing the legacy Node.js client/src/ql-mcp-client.js integration-test CLI with a Go-based gh-ql-mcp-client (Cobra + mcp-go), and updating repo scripts/CI/docs to build and run the Go client.

Changes:

• Remove the client/ npm workspace + JS client implementation and switch root scripts to make -C client ....
• Add the Go CLI, MCP client wrapper, and a Go integration test runner that discovers fixtures under client/integration-tests/.
• Update documentation, prompts, and GitHub Actions workflows to reflect the new Go client and invocation paths.

Show a summary per file

File	Description
package.json	Switch root build/lint/test scripts from -w client to make -C client ...; remove client workspace.
package-lock.json	Update workspace list (but still retains an extraneous client package entry).
docs/testing.md	Update testing layer docs and commands to reference the Go client.
client/scripts/run-integration-tests.sh	Build Go binary, extract test DBs, and run tests via gh-ql-mcp-client with updated mode selection.
client/README.md	Rewrite client README for gh-ql-mcp-client usage, build, and test commands.
client/CLI-USAGE.md	Rewrite CLI usage docs for the Go command structure.
client/integration-tests/README.md	Update integration test fixture guidance and runner parameter resolution behavior.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Move logDir to {{tmpdir}}-based location.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Move logDir to {{tmpdir}}-based location.
client/.gitignore	Replace JS-era ignores with Go build artifacts and related outputs.
.github/workflows/lint-and-format.yml	Add Go toolchain setup for workflows that run client linting.
.github/workflows/client-integration-tests.yml	Add Go toolchain setup; run integration tests via make -C client test-integration.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Update instructions to use the Go client + scripts for server start/stop.
.github/instructions/client_integration_tests.instructions.md	Update integration test contribution guidance for Go runner and Make targets.
.github/instructions/client_go.instructions.md	New Copilot instructions for Go client code under client/**/*.go.
.github/instructions/client_src_js.instructions.md	Remove deprecated JS-client Copilot instructions (since JS client is removed).
.github/agents/ql-mcp-tool-tester.md	Update agent docs to reference Go client usage.
.github/agents/ql-mcp-tool-developer.md	Update tool developer docs to run integration tests via Go client/Make targets.
.github/agents/ql-agent-skills-developer.md	Update agent docs to use gh-ql-mcp-client list ... commands.
client/Makefile	New Make targets for building/testing/linting the Go client.
client/go.mod	New Go module for the client implementation.
client/go.sum	Dependency lockfile for Go module.
client/main.go	Go entrypoint wiring to Cobra commands.
client/cmd/root.go	Root Cobra command + global flags and version.
client/cmd/root_test.go	Unit tests for root command help/version/default flags.
client/cmd/list.go	Implement list tools/prompts/resources commands.
client/cmd/list_test.go	Unit tests ensuring list commands appear in help output.
client/cmd/integration_tests.go	integration-tests command wiring (filters, timeout flag, runner invocation).
client/cmd/helpers.go	Shared CLI helper(s) (e.g., owner/repo parsing).
client/cmd/helpers_test.go	Unit tests for helper(s).
client/internal/mcp/client.go	MCP client wrapper supporting stdio + HTTP transports and tool calls.
client/internal/mcp/client_test.go	Unit tests for timeouts/constants and basic client behavior.
client/internal/testing/runner.go	Go integration test runner (fixture discovery + tool execution + assertions).
client/internal/testing/runner_test.go	Unit tests for runner utilities and basic runner behavior.
client/internal/testing/params.go	Fixture parameter resolution logic (test-config.json / monitoring-state / defaults).
client/internal/testing/params_test.go	Unit tests for parameter resolution logic.
client/package.json	Remove the client npm package.
client/eslint.config.mjs	Remove client-specific ESLint config for JS implementation.
client/src/lib/validate-source-root.js	Remove legacy JS client source.
client/src/lib/test-logger.js	Remove legacy JS client source.
client/src/lib/server-manager.js	Remove legacy JS client source.
client/src/lib/resolve-all-queries.js	Remove legacy JS client source.
client/src/lib/queries-filter-metadata.js	Remove legacy JS client source.
client/src/lib/process-query-metadata.js	Remove legacy JS client source.
client/src/lib/monitoring-integration-test-runner.js	Remove legacy JS client source.
client/src/lib/mcp-test-suite.js	Remove legacy JS client source.
client/src/lib/mcp-client-utils.js	Remove legacy JS client source.
client/src/lib/file-utils.js	Remove legacy JS client source.
client/src/lib/commands/query-commands.js	Remove legacy JS client source.
client/src/lib/commands/metadata-commands.js	Remove legacy JS client source.
client/src/lib/commands/basic-commands.js	Remove legacy JS client source.
client/src/lib/command-handler.js	Remove legacy JS client source.
client/src/lib/cli-parser.js	Remove legacy JS client source.
client/src/lib/aggregate-query-metadata.js	Remove legacy JS client source.

Copilot's findings

• Files reviewed: 54/56 changed files
• Comments generated: 3

[Copilot]

Pull request overview

This PR advances the ql-mcp-client migration by replacing the legacy Node.js client/integration test runner with a Go-based CLI (gh-ql-mcp-client), updating build/test workflows accordingly, and changing annotation-related server tools to be registered by default.

Changes:

• Added a Go CLI client (gh-ql-mcp-client) with MCP connectivity plus integration-test discovery/execution; removed the legacy client/src/** JavaScript implementation.
• Updated repo scripts, docs, and CI workflows to build/lint/test the Go client via make -C client ....
• Changed annotation/audit/cache/SARIF tool enablement defaults (server + extension tests/docs updated to match).

Show a summary per file

File	Description
server/test/src/tools/sarif-tools.test.ts	Updates SARIF tool registration tests to assume default registration.
server/test/src/tools/cache-tools.test.ts	Updates cache tool registration tests to assume default registration.
server/test/src/tools/audit-tools.test.ts	Updates audit tool registration tests to assume default registration.
server/test/src/tools/annotation-tools.test.ts	Updates annotation tool registration tests to assume default registration.
server/src/tools/sarif-tools.ts	Removes opt-in gate and updates header comment for SARIF tools.
server/src/tools/cache-tools.ts	Removes opt-in gate and updates header comment for cache tools.
server/src/tools/audit-tools.ts	Removes opt-in gate and updates header comment for audit tools.
server/src/tools/annotation-tools.ts	Removes opt-in gate and updates header comment for annotation tools.
server/src/lib/session-data-manager.ts	Defaults ENABLE_ANNOTATION_TOOLS to true.
server/src/lib/log-directory-manager.ts	Makes log-directory base-path validation portable via path.sep.
server/dist/codeql-development-mcp-server.js	Regenerated bundled output reflecting server source changes.
package.json	Switches client scripts from npm workspace to make -C client ...; removes client workspace.
package-lock.json	Updates lockfile after workspace change (still contains an extraneous client package entry).
extensions/vscode/test/suite/mcp-tool-e2e.integration.test.ts	Updates e2e test expectation: annotation/audit/cache tools appear by default.
extensions/vscode/test/bridge/environment-builder.test.ts	Updates tests to reflect server default enablement (no explicit ENABLE_ANNOTATION_TOOLS set).
extensions/vscode/src/bridge/environment-builder.ts	Stops explicitly setting ENABLE_ANNOTATION_TOOLS; still sets MONITORING_STORAGE_LOCATION.
docs/testing.md	Updates testing docs to reference Go client runner and make -C client targets.
client/scripts/start-server.sh	Aligns server tmp base with Go runner {{tmpdir}} expectations in HTTP mode.
client/scripts/run-integration-tests.sh	Reworks orchestration for Go binary build + test DB extraction + updated mode semantics.
client/README.md	Rewrites client README for Go CLI usage and Makefile workflows.
client/Makefile	Adds Go build/test/lint/cross-compile targets and integration test wrapper.
client/main.go	Adds Go CLI entrypoint.
client/cmd/root.go	Adds Cobra root command and persistent transport/output flags.
client/cmd/root_test.go	Adds unit tests for root command help/version/default flags.
client/cmd/list.go	Implements list tools/prompts/resources commands.
client/cmd/list_test.go	Adds unit tests verifying list commands are present in help.
client/cmd/integration_tests.go	Implements integration-tests command wiring to the Go runner + MCP client.
client/cmd/helpers.go	Adds shared helper(s) (e.g., repo parsing).
client/cmd/helpers_test.go	Adds unit tests for helpers.
client/internal/mcp/client.go	Adds MCP client wrapper for stdio/HTTP, timeouts, and server path resolution.
client/internal/mcp/client_test.go	Adds unit tests for MCP client constants/timeout selection.
client/internal/testing/runner.go	Adds Go integration test runner (fixture discovery, tool calls, assertions).
client/internal/testing/runner_test.go	Adds unit tests for runner utilities and assertion logic.
client/internal/testing/params.go	Adds Go param resolution logic for fixtures and tool-specific defaults.
client/internal/testing/params_test.go	Adds unit tests for param resolution logic.
client/integration-tests/README.md	Updates integration test fixture documentation for Go runner param resolution.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Updates fixture to use {{tmpdir}} for logDir.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Updates fixture to use {{tmpdir}} for logDir.
client/go.mod	Introduces Go module definition and dependencies.
client/go.sum	Adds Go dependency checksums.
client/.gitignore	Updates ignores for Go artifacts and removes legacy JS coverage ignores.
.github/workflows/lint-and-format.yml	Adds Go toolchain setup to lint/format workflow.
.github/workflows/client-integration-tests.yml	Updates CI to set up Go and run make -C client test-integration.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates prompt guidance to use Go client + new scripts/commands.
.github/instructions/client_integration_tests.instructions.md	Updates integration test instructions to Go make -C client test.
.github/instructions/client_go.instructions.md	Adds new Copilot instructions for client/**/*.go.
.github/instructions/client_src_js.instructions.md	Removes JS client Copilot instructions (client JS removed).
.github/agents/ql-mcp-tool-tester.md	Updates agent doc to reference Go client usage.
.github/agents/ql-mcp-tool-developer.md	Updates agent doc to reference Go client + make-based integration tests.
.github/agents/ql-agent-skills-developer.md	Updates agent doc to use Go client for tool/prompt/resource listing.
CHANGELOG.md	Documents Go client rewrite and updated default enablement behavior in Unreleased highlights.
client/package.json	Removes legacy JS client package definition (deleted).
client/eslint.config.mjs	Removes JS lint config (deleted).
client/src/ql-mcp-client.js	Removes legacy JS client entrypoint (deleted).
client/src/lib/**	Removes legacy JS client library modules (deleted).

Copilot's findings

• Files reviewed: 69/73 changed files
• Comments generated: 7

[Copilot]

Pull request overview

This PR advances the Go rewrite of the ql-mcp-client by removing the legacy JS client workspace, introducing a Go-based CLI + integration test runner, and aligning server/extension behavior so annotation/audit/cache/SARIF tooling is always registered by default.

Changes:

• Replace the client/ npm workspace + JS runner with a Go module (gh-ql-mcp-client) and Make-based build/test targets.
• Remove ENABLE_ANNOTATION_TOOLS tool-registration gating across server, extension, and tests; keep the flag only for result-processing auto-caching behavior.
• Update CI/workflows and scripts to build the Go client and run integration tests via make -C client ....

Show a summary per file

File	Description
server/test/src/tools/sarif-tools.test.ts	Updates SARIF tool registration tests to match “always registered” behavior.
server/test/src/tools/cache-tools.test.ts	Updates cache tool registration tests to match “always registered” behavior.
server/test/src/tools/audit-tools.test.ts	Updates audit tool registration tests to match “always registered” behavior.
server/test/src/tools/annotation-tools.test.ts	Removes opt-in gating assertions; keeps registration + schema/handler coverage.
server/src/types/monitoring.ts	Sets enableAnnotationTools schema default to true and clarifies it controls caching behavior.
server/src/tools/sarif-tools.ts	Removes opt-in gating and updates module header docs.
server/src/tools/cache-tools.ts	Removes opt-in gating and updates module header docs.
server/src/tools/audit-tools.ts	Removes opt-in gating and updates module header docs.
server/src/tools/annotation-tools.ts	Removes opt-in gating and updates module header docs.
server/src/lib/session-data-manager.ts	Changes env default for ENABLE_ANNOTATION_TOOLS to true.
server/src/lib/log-directory-manager.ts	Makes log-dir validation path-separator-aware (sep) for cross-platform correctness.
server/scripts/extract-test-databases.sh	Expands default extraction to include server/ql/*/tools databases used by integration fixtures.
server/dist/codeql-development-mcp-server.js	Updates bundled output to reflect server-side changes (gating removal/defaults/path checks).
package.json	Removes client workspace usage and switches scripts to make -C client ....
package-lock.json	Removes workspace link entry but still retains a stale packages["client"] entry marked extraneous.
extensions/vscode/test/suite/mcp-tool-e2e.integration.test.ts	Updates expectations: annotation/audit/cache/SARIF tools appear by default; removes ENABLE_ANNOTATION_TOOLS from env.
extensions/vscode/test/bridge/environment-builder.test.ts	Updates tests to reflect that the extension no longer sets ENABLE_ANNOTATION_TOOLS.
extensions/vscode/src/bridge/environment-builder.ts	Stops mapping a VS Code setting to ENABLE_ANNOTATION_TOOLS; always prefers scratch dir for monitoring storage when available.
extensions/vscode/package.json	Removes codeql-mcp.enableAnnotationTools contributed setting (was no-op).
docs/testing.md	Updates testing docs to describe the Go client runner and new commands.
client/src/lib/validate-source-root.js	Removed as part of JS client deprecation.
client/src/lib/test-logger.js	Removed as part of JS client deprecation.
client/src/lib/server-manager.js	Removed as part of JS client deprecation.
client/src/lib/resolve-all-queries.js	Removed as part of JS client deprecation.
client/src/lib/queries-filter-metadata.js	Removed as part of JS client deprecation.
client/src/lib/process-query-metadata.js	Removed as part of JS client deprecation.
client/src/lib/mcp-test-suite.js	Removed as part of JS client deprecation.
client/src/lib/mcp-client-utils.js	Removed as part of JS client deprecation.
client/src/lib/file-utils.js	Removed as part of JS client deprecation.
client/src/lib/commands/query-commands.js	Removed as part of JS client deprecation.
client/src/lib/commands/metadata-commands.js	Removed as part of JS client deprecation.
client/src/lib/commands/basic-commands.js	Removed as part of JS client deprecation.
client/src/lib/command-handler.js	Removed as part of JS client deprecation.
client/src/lib/cli-parser.js	Removed as part of JS client deprecation.
client/src/lib/aggregate-query-metadata.js	Removed as part of JS client deprecation.
client/scripts/start-server.sh	Aligns CODEQL_MCP_TMP_DIR to repo .tmp to match Go runner placeholder expectations in HTTP mode.
client/scripts/run-integration-tests.sh	Reworks mode semantics and runs Go binary; adds DB extraction; avoids annotation-only mode logic.
client/README.md	Rewrites README for Go CLI usage, build/test workflows, and architecture.
client/package.json	Removed (client no longer an npm workspace).
client/Makefile	Adds Make-based build/test/lint/install/cross-compile targets for the Go client.
client/main.go	Adds Go CLI entrypoint.
client/internal/testing/runner_test.go	Adds unit tests for runner behavior, assertions, skipping, and path safety helpers.
client/internal/testing/params.go	Implements tool parameter resolution (test-config.json → monitoring-state → defaults).
client/internal/testing/params_test.go	Adds unit tests for parameter resolution behavior.
client/internal/mcp/client.go	Adds MCP client wrapper with stdio/http connect, tool listing, and Close kill-on-timeout behavior.
client/internal/mcp/client_test.go	Adds unit tests, including the Close timeout/kill regression test.
client/integration-tests/README.md	Updates fixture/documentation to reflect Go runner behavior and test-config.json preference.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} so it’s under the allowed tmp base.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Switches logDir to {{tmpdir}} so it’s under the allowed tmp base.
client/go.sum	Adds Go dependency lockfile.
client/go.mod	Adds Go module definition for the client.
client/eslint.config.mjs	Removed (JS tooling no longer applicable).
client/cmd/root.go	Adds Cobra root command + persistent flags.
client/cmd/root_test.go	Adds tests for help/version/default flags.
client/cmd/list.go	Adds list tools/prompts/resources commands.
client/cmd/list_test.go	Adds help/command registration tests for list.
client/cmd/integration_tests.go	Adds integration-tests command wiring (filters, timeout flag, no-install flag).
client/cmd/helpers.go	Adds helper parsing utilities.
client/cmd/helpers_test.go	Adds helper unit tests.
client/.gitignore	Updates ignores for Go build artifacts and removes legacy JS coverage ignores.
CHANGELOG.md	Updates Unreleased highlights and extension notes for always-enabled tools + Go client rewrite.
.github/workflows/lint-and-format.yml	Adds Go toolchain setup for workflows.
.github/workflows/client-integration-tests.yml	Updates workflow to setup Go and run integration tests via Make.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates prompt guidance to use Go client and Make-based commands.
.github/instructions/client_src_js.instructions.md	Removed (JS client instructions no longer relevant).
.github/instructions/client_integration_tests.instructions.md	Updates guidance to use make -C client test and Go runner conventions.
.github/instructions/client_go.instructions.md	Adds Go-specific Copilot contribution instructions for client/**/*.go.
.github/agents/ql-mcp-tool-tester.md	Updates agent docs to reference Go client usage.
.github/agents/ql-mcp-tool-developer.md	Updates agent docs to reference Go client + Make test targets.
.github/agents/ql-agent-skills-developer.md	Updates agent docs to list tools/prompts/resources using the Go CLI.

Copilot's findings

• Files reviewed: 72/76 changed files
• Comments generated: 6

[data-douser]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

All six issues addressed in commit 1f9e6b9:

1. server/src/lib/log-directory-manager.ts — Replaced the startsWith(absBase + sep) check with path.relative(absBase, absTarget), which correctly handles Windows drive-letter casing differences. Added a regression test for the "sibling prefix" edge case.

2. CHANGELOG.md — Replaced the two contradictory bullets (one saying the setting was added, one saying it was simplified) with a single accurate bullet noting the setting was removed in ql-mcp-client rewrite: Phases 1 & 2 — Replace ql-mcp-client.js with Go implementation #223.

3. client/cmd/integration_tests.go — --timeout help text now says "0 = use client defaults".

4. client/internal/mcp/client.go — CloseTimeoutErr now says "attempted to kill server subprocess" since Close() actually kills the process on timeout.

5. client/internal/mcp/client_test.go — Replaced the sleep 60 subprocess with a Go re-exec pattern: TestMain checks GO_TEST_HANG_SUBPROCESS=1 and blocks forever. TestClose_KillsSubprocessOnTimeout re-execs the test binary with that env var set — no external binary dependency, works on Windows.

6. client/internal/testing/runner.go — Added rewriteRelativeOutputPaths() that intercepts bare relative output/interpretedOutput/outputDir params (e.g. "query-results.bqrs") and redirects them to <tmpBase>/test-output/<toolName>/<testCase>/. Updated cleanStaleOutput to also clean absolute paths that resolve within baseDir (using filepath.Rel for CWE-22 safety), and switched its call site from "." to r.tmpBase.