Fix invalid JSON escapes in GitHub remote MCP gateway config generation (#41864)

Author: Copilot

.github/workflows/github-remote-mcp-auth-test.lock.yml

@@ -65,6 +65,38 @@ function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+/**
+ * Builds targeted context for a JSON.parse error so logs can point at the likely key.
+ *
+ * @param {string} jsonText
+ * @param {string} parseErrorMessage
+ * @returns {{line: number, column: number, lineText: string, key: string | null} | null}
+ */
+function getJSONParseErrorContext(jsonText, parseErrorMessage) {
+  const posMatch = parseErrorMessage.match(/position\s+(\d+)/i);
+  if (!posMatch) {
+    return null;
+  }
+
+  const pos = Number(posMatch[1]);
+  if (!Number.isFinite(pos) || pos < 0) {
+    return null;
+  }
+
+  const safePos = Math.min(pos, Math.max(0, jsonText.length - 1));
+  const before = jsonText.slice(0, safePos);
+  const line = before.split("\n").length;
+  const lineStart = before.lastIndexOf("\n") + 1;
+  const lineEnd = jsonText.indexOf("\n", safePos);
+  const resolvedLineEnd = lineEnd === -1 ? jsonText.length : lineEnd;
+  const lineText = jsonText.slice(lineStart, resolvedLineEnd);
+  const column = safePos - lineStart + 1;
+  const keyMatch = lineText.match(/"([^"]+)"\s*:/);
+  const key = keyMatch ? keyMatch[1] : null;
+
+  return { line, column, lineText, key };
+}
+
 /**
  * Normalizes GH_AW_OTLP_IF_MISSING to a supported mode.
  * @param {string | undefined} value
@@ -367,7 +399,16 @@ async function main() {
     core.error("ERROR: Configuration is not valid JSON");
     core.error("");
     core.error("JSON validation error:");
-    core.error(/** @type {Error} */ err.message);
+    const parseMessage = /** @type {Error} */ err.message;
+    core.error(parseMessage);
+    const parseContext = getJSONParseErrorContext(mcpConfig, parseMessage);
+    if (parseContext) {
+      core.error(`Likely offending location: line ${parseContext.line}, column ${parseContext.column}`);
+      if (parseContext.key) {
+        core.error(`Likely offending key: ${parseContext.key}`);
+      }
+      core.error(`Context line: ${parseContext.lineText}`);
+    }
     core.error("");
     core.error("Configuration content:");
     const lines = mcpConfig.split("\n");
@@ -909,5 +950,6 @@ module.exports = {
   getOTLPIfMissingMode,
   hasNonEmptyOTLPHeaders,
   isOTLPIfMissingIgnore,
+  getJSONParseErrorContext,
   resolveCopilotConfigPaths,
 };

actions/setup/js/start_mcp_gateway.cjs

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { applyOTLPIgnoreIfMissing, detectEngineType, getOTLPIfMissingMode, hasNonEmptyOTLPHeaders, resolveCopilotConfigPaths } from "./start_mcp_gateway.cjs";
+import { applyOTLPIgnoreIfMissing, detectEngineType, getJSONParseErrorContext, getOTLPIfMissingMode, hasNonEmptyOTLPHeaders, resolveCopilotConfigPaths } from "./start_mcp_gateway.cjs";
 
 describe("start_mcp_gateway OTLP if-missing helpers", () => {
   let originalWarning;
@@ -197,3 +197,27 @@ describe("start_mcp_gateway detectEngineType", () => {
     expect(detectEngineType(configDir, env, existsSync)).toBe("copilot");
   });
 });
+
+describe("start_mcp_gateway getJSONParseErrorContext", () => {
+  it("extracts line/column and key for invalid escape values", () => {
+    const invalidConfig = `{
+  "mcpServers": {
+    "github": {
+      "env": {
+        "GITHUB_HOST": "\\https://github.com"
+      }
+    }
+  }
+}`;
+    let parseErrorMessage = "";
+    try {
+      JSON.parse(invalidConfig);
+    } catch (err) {
+      parseErrorMessage = /** @type {Error} */ err.message;
+    }
+    const context = getJSONParseErrorContext(invalidConfig, parseErrorMessage);
+    expect(context).toBeTruthy();
+    expect(context?.key).toBe("GITHUB_HOST");
+    expect(context?.lineText).toContain(`"GITHUB_HOST"`);
+  });
+});

actions/setup/js/start_mcp_gateway.test.cjs

@@ -80,8 +80,8 @@ func TestRenderGitHubMCPRemoteConfig(t *testing.T) {
 				`"list_issues"`,
 				`"create_issue"`,
 				`"env": {`,
-				`"GITHUB_PERSONAL_ACCESS_TOKEN": "\\${GITHUB_MCP_SERVER_TOKEN}"`,
-				`"GITHUB_HOST": "\\${GITHUB_SERVER_URL}"`,
+				`"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}"`,
+				`"GITHUB_HOST": "${GITHUB_SERVER_URL}"`,
 			},
 			notExpected: []string{
 				`"X-MCP-Readonly"`,
@@ -104,8 +104,8 @@ func TestRenderGitHubMCPRemoteConfig(t *testing.T) {
 				`"Authorization": "Bearer \\${GITHUB_PERSONAL_ACCESS_TOKEN}"`,
 				`"X-MCP-Toolsets": "all"`,
 				`"env": {`,
-				`"GITHUB_PERSONAL_ACCESS_TOKEN": "\\${GITHUB_MCP_SERVER_TOKEN}"`,
-				`"GITHUB_HOST": "\\${GITHUB_SERVER_URL}"`,
+				`"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}"`,
+				`"GITHUB_HOST": "${GITHUB_SERVER_URL}"`,
 			},
 			notExpected: []string{
 				`"X-MCP-Readonly"`,
@@ -132,8 +132,8 @@ func TestRenderGitHubMCPRemoteConfig(t *testing.T) {
 				`"list_repositories"`,
 				`"get_repository"`,
 				`"env": {`,
-				`"GITHUB_PERSONAL_ACCESS_TOKEN": "\\${GITHUB_MCP_SERVER_TOKEN}"`,
-				`"GITHUB_HOST": "\\${GITHUB_SERVER_URL}"`,
+				`"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}"`,
+				`"GITHUB_HOST": "${GITHUB_SERVER_URL}"`,
 			},
 			notExpected: []string{},
 		},

pkg/workflow/github_remote_config_test.go

@@ -258,7 +258,7 @@ This is a test workflow for GitHub remote mode configuration.
 						if !strings.Contains(lockContent, `"Authorization": "Bearer \\${GITHUB_PERSONAL_ACCESS_TOKEN}"`) {
 							t.Errorf("Expected Authorization header with ${GITHUB_PERSONAL_ACCESS_TOKEN} syntax but didn't find it in:\n%s", lockContent)
 						}
-						if !strings.Contains(lockContent, `"GITHUB_PERSONAL_ACCESS_TOKEN": "\\${GITHUB_MCP_SERVER_TOKEN}"`) {
+						if !strings.Contains(lockContent, `"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}"`) {
 							t.Errorf("Expected env section with GITHUB_PERSONAL_ACCESS_TOKEN passthrough but didn't find it in:\n%s", lockContent)
 						}
 					} else {
@@ -460,7 +460,7 @@ This tests that GITHUB_PERSONAL_ACCESS_TOKEN is exported and passed to Docker.
 	}
 
 	// Check that the env section still defines the variable
-	if !strings.Contains(lockContent, `"GITHUB_PERSONAL_ACCESS_TOKEN": "\\${GITHUB_MCP_SERVER_TOKEN}"`) {
+	if !strings.Contains(lockContent, `"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}"`) {
 		t.Errorf("Expected env section with GITHUB_PERSONAL_ACCESS_TOKEN but didn't find it in lock file")
 	}
 }

pkg/workflow/github_remote_mode_test.go

@@ -305,7 +305,7 @@ func RenderGitHubMCPRemoteConfig(yaml *strings.Builder, options GitHubMCPRemoteO
 			yaml,
 			"                ",
 			"env",
-			buildGitHubMCPEnvVars("\\${GITHUB_MCP_SERVER_TOKEN}", "\\${GITHUB_SERVER_URL}", false, false, ""),
+			buildGitHubMCPEnvVars("${GITHUB_MCP_SERVER_TOKEN}", "${GITHUB_SERVER_URL}", false, false, ""),
 			hasGuardPolicies,
 		)
 	}