Return compact response types for workflow run and workflow job lists while retaining diagnostic, step, and runner metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0eecbca7-7271-4a04-8d28-d952c27ed9c1

Return compact response shapes for pull request statuses, review comment replies, and individual workflow runs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: d6786153-698a-4563-97ad-a8221c40e306

* Add basic project view management

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c6f8ede6-efee-4191-900d-59a1bb0af000

* Harden project view mutations

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c6f8ede6-efee-4191-900d-59a1bb0af000

* Resolve project view fields by name

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c6f8ede6-efee-4191-900d-59a1bb0af000

* Clear project view filters with explicit null

Align the filter parameter with the nullable-parameter convention: omit
to preserve, pass null to clear. Empty strings are now rejected rather
than treated as a clear sentinel. The GraphQL and REST wire format is
unchanged, since the API still clears a filter with an empty string.

Also replace the "<nil>" string comparison in deleteProjectView with a
direct nil check on the returned ID.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Use caller-specific project field hints

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c6f8ede6-efee-4191-900d-59a1bb0af000

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c6f8ede6-efee-4191-900d-59a1bb0af000

* Add visible fields to project views

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1421a5d5-fdce-4c0e-9528-56d555ec30d4

* Fail fast and surface orphaned views on project view writes

Reject roadmap layouts before enumerating project fields in both the
create and update paths, and verify view ownership before resolving
visible fields on update, so rejected requests no longer pay for a
paginated field listing.

Skip the follow-up filter mutation when the filter is explicitly null,
since a new view has no filter to clear, and include the created view ID
when cleanup after a failed filter mutation also fails so the caller can
recover the orphaned view.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1421a5d5-fdce-4c0e-9528-56d555ec30d4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9cdeefb9-91cd-4f65-8eb2-089c9e00a2b8

…text credentials

GHES hosts accepted an http:// scheme, which was interpolated into every
REST/GraphQL/upload/raw/authorization URL. Authenticated requests would then
carry the bearer token/PAT over cleartext http, exposing it to network
interception and replay.

Add a central HTTPS check in parseAPIHost so no deployment can build
authenticated URLs over http, mirroring the existing GHEC behaviour. Permit
http only for loopback hosts (localhost, 127.0.0.1, ::1) so local development
against a dev server still works.

Closes github/copilot-mcp-core#1815

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Address review: the loopback exception accepted http://localhost:3000 and
http://[::1], but newGHESHost built URLs from u.Hostname(), which drops the
port (silently retargeting the dev server to port 80) and strips IPv6 brackets
(producing an unusable URL such as http://::1/api/v3/).

Derive the base-host REST/GraphQL/upload/raw/authorization URLs from u.Host so
the port and IPv6 brackets are preserved. Subdomain-isolation URLs keep using
the bare hostname, since a label cannot be prepended to a host:port or an IP
literal. Add tests for the ::1 case and for port preservation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>