agentHost: cover GraphQL mutation roots and null merge permission

[Benjamin Christopher Simmonds (benibenj)]

Follow-up to #331712, addressing two review comments that arrived after auto-merge had already landed that PR.

The mutation fix had no regression coverage

The existing mutation tests only match operation names and variables, so reintroducing the invalid root-level rateLimit selection would still have passed. That is precisely why the original bug survived.

ProgrammableGitHubServer now rejects any mutation that selects a Query-root-only field at the mutation root. Putting the check in the fake server rather than in per-test assertions means every current and future mutation test enforces it automatically, with no opt-in required.

Verified by temporarily reintroducing the bug — it now fails with a direct diagnostic instead of silently passing:

GraphQL mutation selected rateLimit on the Mutation root, which GitHub only exposes on Query

The root-field parser handles aliases (pullRequest: __type(...)), arguments containing braces (orderBy: { field: UPDATED_AT }), and nested selections, so a nested rateLimit is correctly ignored.

The permission test only covered READ

viewerPermission is null under GitHub App authentication, which deliberately disables Agent Merge. That fail-closed path could previously have regressed independently of the ordinary read-only case.

The test now snapshots the whole RepositoryPermission range including null, in a single assertion:

{ ADMIN: true, MAINTAIN: true, WRITE: true, TRIAGE: false, READ: false, null: false }

Verification

• All 92 platform/github tests pass against current main
• typecheck-client and eslint clean
• Test-only change; no production code touched

[Copilot]

Pull request overview

Adds regression coverage for Agent Merge GraphQL mutations and repository merge permissions.

Changes:

• Validates mutation root selections against query-only fields.
• Tests all repository permission values, including null.

Show a summary per file

File	Description
pullRequestQueryService.test.ts	Expands merge-permission coverage.
programmableGitHubServer.ts	Adds mutation-root validation.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced