[po-et]

Summary

Correct list_pull_requests output for merged pull requests when the REST list endpoint omits the merged boolean. Use a nonzero merged_at as a fallback while preserving an explicit boolean.

Why

An agent listing closed PRs currently sees merged: false even for merged changes, which can corrupt contribution summaries. The regression uses raw REST JSON from the list response.

Fixes #3467

What changed

• Fall back to the merge timestamp only when the API omits merged.
• Cover merged, closed unmerged, open, explicit true/false, and zero timestamp entries, with and without field selection.
• Verify legacy text output and modern MCP structured output.

MCP impact

• Tool schema or behavior changed

The existing merged output now correctly describes list entries. No input or output fields are added.

Prompts tested (tool changes only)

Regression calls use list_pull_requests with owner, repo, and state: "all", both with all fields and with fields: ["number", "merged", "merged_at"]. No natural-language model prompts were run.

Security / limits

• No security or limits impact

The conversion uses data already returned by the API and adds no requests.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

Validated against main b98d115bbb080e9555466a96656ec4df605aea21 on macOS arm64:

• Go 1.27.3: script/lint with golangci-lint 2.14.0 (0 issues), script/test (go test -race ./...; 30 packages passed, six without tests), go mod tidy -diff, and the server build passed.
• Focused list-PR tests passed with UPDATE_TOOLSNAPS=true, including 12 merged-state/field-selection cases through text and SDK structured output. All 141 schema snapshots stayed unchanged.
• script/generate-docs passed; all five generated documents stayed unchanged.
• Node 26.12.1: fresh npm ci, type checking, and 11 UI tests passed. Four embedded pages built with the current Vite configuration through a reviewed helper that preserves output renaming and omits recursive directory cleanup. The standard npm run build command was not run.

npm audit reports four high-severity dependency entries. Main's exact package and lock files produce the same vulnerability graph; this change leaves them unchanged.

Authenticated GitHub E2E tests and rendered MCP-host UI checks were not run. Local results do not establish upstream CI success.

Codex assisted with the code and tests. A separate Codex agent reviewed the merged-state conversion and both output paths.

Docs

• Not needed

This corrects an existing field without changing the tool schema.

[IrynaKulakova]

Reviewed commit 4dbf51a. No actionable findings: the merged_at fallback preserves explicit merged values and is shared by text and structured output. Local lint and tests could not run because the installed Go binaries fail with "Bad CPU type in executable"; this approval is based on code inspection.