fix: redact Gitea web links from MCP PR output

tests/test_mcp_server.py

@@ -48,15 +48,24 @@ class TestCreateIssue(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_creates_issue(self, _auth, mock_api):
         mock_api.return_value = {"number": 1, "html_url": "https://gitea.example.com/issues/1"}
-        result = gitea_create_issue(title="Test issue", body="body text")
+        with patch.dict(os.environ, {}, clear=True):
+            result = gitea_create_issue(title="Test issue", body="body text")
         self.assertEqual(result["number"], 1)
-        self.assertIn("issues/1", result["url"])
+        self.assertNotIn("url", result)
         mock_api.assert_called_once()
         # Verify payload
         call_args = mock_api.call_args
         self.assertEqual(call_args[0][0], "POST")
         self.assertEqual(call_args[0][3]["title"], "Test issue")
 
+    @patch("mcp_server.api_request")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_create_issue_reveal_opt_in_includes_url(self, _auth, mock_api):
+        mock_api.return_value = {"number": 1, "html_url": "https://gitea.example.com/issues/1"}
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            result = gitea_create_issue(title="Test issue", body="body text")
+        self.assertIn("issues/1", result["url"])
+
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_creates_on_prgs(self, _auth, mock_api):
@@ -77,12 +86,22 @@ class TestCreatePR(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_creates_pr(self, _auth, mock_api):
         mock_api.return_value = {"number": 3, "html_url": "https://example.com/pulls/3"}
-        result = gitea_create_pr(title="feat: X", head="feat/x", base="main")
+        with patch.dict(os.environ, {}, clear=True):
+            result = gitea_create_pr(title="feat: X", head="feat/x", base="main")
         self.assertEqual(result["number"], 3)
+        self.assertNotIn("url", result)
         payload = mock_api.call_args[0][3]
         self.assertEqual(payload["head"], "feat/x")
         self.assertEqual(payload["base"], "main")
 
+    @patch("mcp_server.api_request")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_create_pr_reveal_opt_in_includes_url(self, _auth, mock_api):
+        mock_api.return_value = {"number": 3, "html_url": "https://example.com/pulls/3"}
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            result = gitea_create_pr(title="feat: X", head="feat/x", base="main")
+        self.assertIn("pulls/3", result["url"])
+
 
 # ---------------------------------------------------------------------------
 # Close Issue
@@ -158,11 +177,25 @@ class TestViewIssue(unittest.TestCase):
             "assignee": {"login": "jason"},
             "html_url": "https://gitea.prgs.cc/issues/7",
         }
-        result = gitea_view_issue(issue_number=7, remote="prgs")
+        with patch.dict(os.environ, {}, clear=True):
+            result = gitea_view_issue(issue_number=7, remote="prgs")
         self.assertEqual(result["number"], 7)
         self.assertEqual(result["body"], "Build it")
         self.assertEqual(result["labels"], ["important"])
         self.assertEqual(result["assignee"], "jason")
+        self.assertNotIn("url", result)
+
+    @patch("mcp_server.api_request")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_view_issue_reveal_opt_in_includes_url(self, _auth, mock_api):
+        mock_api.return_value = {
+            "number": 7, "title": "MCP server", "body": "Build it",
+            "state": "open", "labels": [], "assignee": None,
+            "html_url": "https://gitea.prgs.cc/issues/7",
+        }
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            result = gitea_view_issue(issue_number=7, remote="prgs")
+        self.assertIn("issues/7", result["url"])
 
 
 # ---------------------------------------------------------------------------
@@ -272,10 +305,26 @@ class TestListPRs(unittest.TestCase):
                 "html_url": "http://url1", "mergeable": True
             }
         ]
-        result = gitea_list_prs()
+        with patch.dict(os.environ, {}, clear=True):
+            result = gitea_list_prs()
         self.assertEqual(len(result), 1)
         self.assertEqual(result[0]["number"], 1)
         self.assertEqual(result[0]["head"], "branch1")
+        self.assertNotIn("url", result[0])
+
+    @patch("mcp_server.api_get_all")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_list_prs_reveal_opt_in_includes_url(self, _auth, mock_api):
+        mock_api.return_value = [
+            {
+                "number": 1, "title": "PR 1", "state": "open",
+                "head": {"ref": "branch1"}, "base": {"ref": "main"},
+                "html_url": "http://url1", "mergeable": True
+            }
+        ]
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            result = gitea_list_prs()
+        self.assertEqual(result[0]["url"], "http://url1")
 
 
 # ---------------------------------------------------------------------------
@@ -292,10 +341,25 @@ class TestViewPR(unittest.TestCase):
             "html_url": "http://url1", "mergeable": True, "body": "description",
             "user": {"login": "user1"}
         }
-        result = gitea_view_pr(pr_number=1)
+        with patch.dict(os.environ, {}, clear=True):
+            result = gitea_view_pr(pr_number=1)
         self.assertEqual(result["number"], 1)
         self.assertEqual(result["body"], "description")
         self.assertEqual(result["user"], "user1")
+        self.assertNotIn("url", result)
+
+    @patch("mcp_server.api_request")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    def test_view_pr_reveal_opt_in_includes_url(self, _auth, mock_api):
+        mock_api.return_value = {
+            "number": 1, "title": "PR 1", "state": "open",
+            "head": {"ref": "branch1"}, "base": {"ref": "main"},
+            "html_url": "http://url1", "mergeable": True, "body": "description",
+            "user": {"login": "user1"}
+        }
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            result = gitea_view_pr(pr_number=1)
+        self.assertEqual(result["url"], "http://url1")
 
 
 # ---------------------------------------------------------------------------
@@ -1674,9 +1738,30 @@ class TestTrackerHygieneCleanup(unittest.TestCase):
             return {}
         self.mock_api.side_effect = api_side_effect
 
-        res = gitea_edit_pr(pr_number=1, state="closed")
+        with patch.dict(os.environ, {}, clear=True):
+            res = gitea_edit_pr(pr_number=1, state="closed")
         self.assertTrue(res["success"])
         self.assertEqual(res["cleanup_status"].get(123), "released")
+        self.assertNotIn("url", res)
+
+    def test_edit_pr_reveal_opt_in_includes_url(self):
+        def api_side_effect(method, url, auth, payload=None):
+            if method == "PATCH" and "pulls/1" in url:
+                return {
+                    "number": 1,
+                    "title": "My PR",
+                    "state": "open",
+                    "html_url": "http://url1",
+                    "body": "No issue link",
+                    "head": {"ref": "feat/my-branch"}
+                }
+            return {}
+        self.mock_api.side_effect = api_side_effect
+
+        with patch.dict(os.environ, {"GITEA_MCP_REVEAL_ENDPOINTS": "1"}, clear=True):
+            res = gitea_edit_pr(pr_number=1, title="Updated")
+        self.assertTrue(res["success"])
+        self.assertEqual(res["url"], "http://url1")
 
     def test_multiple_linked_issues(self):
         def api_side_effect(method, url, auth, payload=None):