Fix safe-inputs MCP server mode mismatch causing tool registration failure

[Copilot]

The smoke test workflow failed when the MCP gateway attempted to list tools from the safe-inputs HTTP server, receiving:

{"error":{"code":-32001,"message":"Session not found"},"id":2}

This prevented the safeinputs-gh tool from being registered, making GitHub CLI operations unavailable to agents.

Root Cause

Safe-inputs MCP HTTP server ran in stateful mode, requiring session initialization before tools/list RPC calls. The MCP gateway connects to HTTP servers expecting stateless mode (no session required).

Changes

Changed safe-inputs server from stateful to stateless mode:

// pkg/workflow/safe_inputs_generator.go
startHttpServer(configPath, {
  port: port,
  stateless: true,  // was: false
  logDir: "/opt/gh-aw/safe-inputs/logs"
})

Recompiled all 134 workflow lock files to propagate the change.

Impact

• MCP gateway can now successfully list safe-inputs tools without session establishment
• safeinputs-gh tool becomes available for authenticated GitHub CLI operations
• Smoke test "Safe Inputs GH CLI Testing" requirement should pass

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/21252861974/job/61159106886

Review gateway and safeinputs logs to determine why it failed.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.