[plan] Fix context propagation in checkActorPermission to respect request lifecycle

[github-actions]

Objective

Fix context propagation in checkActorPermission in pkg/cli/mcp_server_helpers.go to use the caller's context instead of context.Background(), so permission checks respect request lifecycle cancellation.

Context

From discussion #18080 (go-sdk module review): When a tool handler's context is cancelled (e.g., client disconnects), the permission check currently still runs for up to 5 seconds against the GitHub API because it uses a fresh context.Background(). Using the parent context would respect request lifecycle and avoid unnecessary work.

File to Modify

pkg/cli/mcp_server_helpers.go — the checkActorPermission function

Change Required

Update checkActorPermission to accept a parent context parameter and use it as the base for the timeout:

// Before
func checkActorPermission(actor, repo string) error {
    ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
    defer cancel()
    permission, err := queryActorRole(ctx, actor, repo)
    ...
}

// After
func checkActorPermission(callerCtx context.Context, actor, repo string) error {
    permCtx, cancel := context.WithTimeout(callerCtx, 5*time.Second)
    defer cancel()
    permission, err := queryActorRole(permCtx, actor, repo)
    ...
}

All call sites must be updated to pass the tool handler's context.

Acceptance Criteria

• checkActorPermission accepts a context.Context parameter
• All call sites updated to pass the handler context
• make test-unit passes
• make agent-finish passes

Generated by Plan Command for issue #discussion #18080

• expires on Feb 27, 2026, 12:38 PM UTC