fix: deterministic MCPG config key ordering (HashMap -> BTreeMap) (#328)

Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/925fe165-d29e-4a57-b34a-424a56bc7862

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

Author: Copilot

src/compile/common.rs

@@ -1142,13 +1142,20 @@ fn nonempty_vec<T: Clone>(v: &[T]) -> Option<Vec<T>> {
     if v.is_empty() { None } else { Some(v.to_vec()) }
 }
 
-/// Returns `Some(m.clone())` when `m` is non-empty, otherwise `None`.
-fn nonempty_map<K, V>(m: &HashMap<K, V>) -> Option<HashMap<K, V>>
+/// Returns `Some(BTreeMap from m)` when `m` is non-empty, otherwise `None`.
+///
+/// Converts a `HashMap` source to a `BTreeMap` so JSON serialization is
+/// deterministic (keys are emitted in sorted order).
+fn nonempty_map<K, V>(m: &HashMap<K, V>) -> Option<std::collections::BTreeMap<K, V>>
 where
-    K: Clone + Eq + std::hash::Hash,
+    K: Clone + Eq + std::hash::Hash + Ord,
     V: Clone,
 {
-    if m.is_empty() { None } else { Some(m.clone()) }
+    if m.is_empty() {
+        None
+    } else {
+        Some(m.iter().map(|(k, v)| (k.clone(), v.clone())).collect())
+    }
 }
 
 /// Validate a container-based MCP entry and emit any warnings.
@@ -1200,7 +1207,7 @@ fn build_http_mcpg_server(url: &str, opts: &crate::compile::types::McpOptions) -
 fn try_add_user_mcp(
     name: &str,
     config: &McpConfig,
-    servers: &mut HashMap<String, McpgServerConfig>,
+    servers: &mut std::collections::BTreeMap<String, McpgServerConfig>,
 ) -> Result<()> {
     // Prevent user-defined MCPs from overwriting the reserved safeoutputs backend
     if name.eq_ignore_ascii_case("safeoutputs") {
@@ -1282,7 +1289,7 @@ pub fn generate_mcpg_config(
     ctx: &CompileContext,
     extensions: &[super::extensions::Extension],
 ) -> Result<McpgConfig> {
-    let mut mcp_servers = HashMap::new();
+    let mut mcp_servers = std::collections::BTreeMap::new();
 
     // Add extension-contributed MCPG server entries (safeoutputs, azure-devops, etc.)
     for ext in extensions {

src/compile/extensions/mod.rs

@@ -16,7 +16,7 @@
 
 use anyhow::Result;
 use serde::Serialize;
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 
 use super::types::FrontMatter;
 
@@ -51,10 +51,10 @@ pub struct McpgServerConfig {
     pub url: Option<String>,
     /// HTTP headers (e.g., Authorization)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub headers: Option<HashMap<String, String>>,
+    pub headers: Option<BTreeMap<String, String>>,
     /// Environment variables for the server process
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub env: Option<HashMap<String, String>>,
+    pub env: Option<BTreeMap<String, String>>,
     /// Tool allow-list (if empty or absent, all tools are allowed)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub tools: Option<Vec<String>>,
@@ -74,7 +74,7 @@ pub struct McpgGatewayConfig {
 #[derive(Debug, Serialize, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct McpgConfig {
-    pub mcp_servers: HashMap<String, McpgServerConfig>,
+    pub mcp_servers: BTreeMap<String, McpgServerConfig>,
     pub gateway: McpgGatewayConfig,
 }
 

src/compile/extensions/safe_outputs.rs

@@ -1,6 +1,6 @@
 use super::{CompileContext, CompilerExtension, ExtensionPhase, McpgServerConfig};
 use anyhow::Result;
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 
 // ─── SafeOutputs (always-on, internal) ───────────────────────────────
 
@@ -34,7 +34,7 @@ impl CompilerExtension for SafeOutputsExtension {
                 mounts: None,
                 args: None,
                 url: Some("http://localhost:${SAFE_OUTPUTS_PORT}/mcp".to_string()),
-                headers: Some(HashMap::from([(
+                headers: Some(BTreeMap::from([(
                     "Authorization".to_string(),
                     "Bearer ${SAFE_OUTPUTS_API_KEY}".to_string(),
                 )])),

src/tools/azure_devops/extension.rs

@@ -9,7 +9,7 @@ use crate::compile::{
 };
 use crate::compile::types::AzureDevOpsToolConfig;
 use anyhow::Result;
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 
 /// Azure DevOps first-party tool extension.
 ///
@@ -107,7 +107,7 @@ impl CompilerExtension for AzureDevOpsExtension {
         let (auth_flag, token_var) = ("envvar", "ADO_MCP_AUTH_TOKEN");
         entrypoint_args.extend(["-a".to_string(), auth_flag.to_string()]);
 
-        let env = Some(HashMap::from([(
+        let env = Some(BTreeMap::from([(
             token_var.to_string(),
             String::new(), // Passthrough from MCPG process env
         )]));