fix GetFlags check, move lockdown parsing in WithRequestConfig and fix broken tests

Author: kerobbi

pkg/github/dependencies.go

@@ -379,7 +379,7 @@ func (d *RequestDeps) GetT() translations.TranslationHelperFunc { return d.T }
 // GetFlags implements ToolDependencies.
 func (d *RequestDeps) GetFlags(ctx context.Context) FeatureFlags {
 	return FeatureFlags{
-		LockdownMode: ghcontext.IsLockdownMode(ctx),
+		LockdownMode: d.lockdownMode && ghcontext.IsLockdownMode(ctx),
 	}
 }
 

pkg/github/feature_flags_test.go

@@ -45,7 +45,7 @@ func HelloWorldTool(t translations.TranslationHelperFunc) inventory.ServerTool {
 			if deps.IsFeatureEnabled(ctx, RemoteMCPEnthusiasticGreeting) {
 				greeting += " Welcome to the future of MCP! 🎉"
 			}
-			if deps.GetFlags().InsiderMode {
+			if deps.GetFlags(ctx).InsiderMode {
 				greeting += " Experimental features are enabled! 🚀"
 			}
 

pkg/http/handler.go

@@ -106,10 +106,6 @@ func withToolset(next http.Handler) http.Handler {
 }
 
 func (h *HTTPMcpHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if relaxedParseBool(r.Header.Get(headers.MCPLockdownHeader)) {
-		r = r.WithContext(ghcontext.WithLockdownMode(r.Context(), true))
-	}
-
 	inventory, err := h.inventoryFactoryFunc(r)
 	if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)

pkg/http/middleware/request_config.go

@@ -22,6 +22,10 @@ func WithRequestConfig(next http.Handler) http.Handler {
 			ctx = ghcontext.WithToolsets(ctx, toolsets)
 		}
 
+		if relaxedParseBool(r.Header.Get(headers.MCPLockdownHeader)) {
+			ctx = ghcontext.WithLockdownMode(ctx, true)
+		}
+
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }