github
diff --git a/‎internal/cmd/proxy.go‎
Lines changed: 1 addition & 1 deletion b/‎internal/cmd/proxy.go‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎internal/config/expand.go‎
Lines changed: 133 additions & 0 deletions b/‎internal/config/expand.go‎
Lines changed: 133 additions & 0 deletions
diff --git a/‎internal/config/validation.go‎
Lines changed: 0 additions & 119 deletions b/‎internal/config/validation.go‎
Lines changed: 0 additions & 119 deletions
diff --git a/‎internal/envutil/github.go‎
Lines changed: 51 additions & 0 deletions b/‎internal/envutil/github.go‎
Lines changed: 51 additions & 0 deletions
@@ -189,7 +189,7 @@ func runProxy(cmd *cobra.Command, args []string) error {
 	// Resolve GitHub API URL: flag → env vars → default
 	apiURL := proxyAPIURL
 	if apiURL == "" {
-		apiURL = proxy.DeriveGitHubAPIURL()
+		apiURL = envutil.DeriveGitHubAPIURL("")
 	}
 	if apiURL == "" {
 		apiURL = proxy.DefaultGitHubAPIBase
 
@@ -0,0 +1,133 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+
+	"github.com/github/gh-aw-mcpg/internal/config/rules"
+)
+
+// Variable expression pattern: ${VARIABLE_NAME}
+var varExprPattern = regexp.MustCompile(`\$\{([A-Za-z_][A-Za-z0-9_]*)\}`)
+
+// expandVariablesCore is the shared implementation for variable expansion.
+// It works with byte slices and handles the core expansion logic, tracking undefined variables.
+// This eliminates code duplication between expandVariables and ExpandRawJSONVariables.
+// It returns the expanded bytes, a slice of undefined variable names, and an error
+// (currently always nil).
+func expandVariablesCore(data []byte, contextDesc string) ([]byte, []string, error) {
+	logValidation.Printf("Expanding variables: context=%s", contextDesc)
+	var undefinedVars []string
+
+	result := varExprPattern.ReplaceAllFunc(data, func(match []byte) []byte {
+		// Extract variable name (remove ${ and })
+		varName := string(match[2 : len(match)-1])
+
+		if envValue, exists := os.LookupEnv(varName); exists {
+			logValidation.Printf("Expanded variable: %s (found in environment)", varName)
+			return []byte(envValue)
+		}
+
+		// Track undefined variable
+		undefinedVars = append(undefinedVars, varName)
+		logValidation.Printf("Undefined variable: %s", varName)
+		return match // Keep original if undefined
+	})
+
+	logValidation.Printf("Variable expansion completed: context=%s, undefined_count=%d", contextDesc, len(undefinedVars))
+	return result, undefinedVars, nil
+}
+
+// expandVariables expands variable expressions in a string.
+// value is the source string and jsonPath identifies the config location for errors.
+// It returns the expanded string and an error if any variable is undefined.
+func expandVariables(value, jsonPath string) (string, error) {
+	result, undefinedVars, _ := expandVariablesCore([]byte(value), fmt.Sprintf("jsonPath=%s", jsonPath))
+
+	if len(undefinedVars) > 0 {
+		logValidation.Printf("Variable expansion failed: undefined variables=%v", undefinedVars)
+		return "", rules.UndefinedVariable(undefinedVars[0], jsonPath)
+	}
+
+	return string(result), nil
+}
+
+// ExpandRawJSONVariables expands all ${VAR} expressions in JSON data before schema validation.
+// This ensures the schema validates the expanded values, not the variable syntax.
+// It collects undefined variables and reports the first undefined variable as an error.
+func ExpandRawJSONVariables(data []byte) ([]byte, error) {
+	result, undefinedVars, _ := expandVariablesCore(data, "raw JSON data")
+
+	if len(undefinedVars) > 0 {
+		logValidation.Printf("Variable expansion failed: undefined variables=%v", undefinedVars)
+		return nil, rules.UndefinedVariable(undefinedVars[0], "configuration")
+	}
+
+	return result, nil
+}
+
+// expandEnvVariables expands all variable expressions in an env map.
+// env is the map to expand and serverName is used for config-path error context.
+// It returns a new map with expanded values or an error if any variable is undefined.
+func expandEnvVariables(env map[string]string, serverName string) (map[string]string, error) {
+	logValidation.Printf("Expanding env variables for server: %s, count=%d", serverName, len(env))
+	result := make(map[string]string, len(env))
+
+	for key, value := range env {
+		jsonPath := fmt.Sprintf("mcpServers.%s.env.%s", serverName, key)
+
+		expanded, err := expandVariables(value, jsonPath)
+		if err != nil {
+			return nil, err
+		}
+
+		result[key] = expanded
+	}
+
+	logValidation.Printf("Env variable expansion completed for server: %s", serverName)
+	return result, nil
+}
+
+// expandTracingVariables expands ${VAR} expressions in TracingConfig fields.
+// This is called for TOML-loaded configs before validation, mirroring the
+// stdin JSON path where ExpandRawJSONVariables handles expansion.
+func expandTracingVariables(cfg *TracingConfig) error {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Endpoint != "" {
+		expanded, err := expandVariables(cfg.Endpoint, "gateway.opentelemetry.endpoint")
+		if err != nil {
+			return err
+		}
+		cfg.Endpoint = expanded
+	}
+
+	if cfg.TraceID != "" {
+		expanded, err := expandVariables(cfg.TraceID, "gateway.opentelemetry.traceId")
+		if err != nil {
+			return err
+		}
+		cfg.TraceID = expanded
+	}
+
+	if cfg.SpanID != "" {
+		expanded, err := expandVariables(cfg.SpanID, "gateway.opentelemetry.spanId")
+		if err != nil {
+			return err
+		}
+		cfg.SpanID = expanded
+	}
+
+	if cfg.Headers != "" {
+		expanded, err := expandVariables(cfg.Headers, "gateway.opentelemetry.headers")
+		if err != nil {
+			return err
+		}
+		cfg.Headers = expanded
+	}
+
+	return nil
+}
@@ -16,9 +16,6 @@ import (
 // ValidationError is an alias for rules.ValidationError for backward compatibility
 type ValidationError = rules.ValidationError
 
-// Variable expression pattern: ${VARIABLE_NAME}
-var varExprPattern = regexp.MustCompile(`\$\{([A-Za-z_][A-Za-z0-9_]*)\}`)
-
 // W3C trace context patterns (spec §4.1.3.6)
 var (
 	traceIDPattern = regexp.MustCompile(`^[0-9a-f]{32}$`)
@@ -45,122 +42,6 @@ func logValidateServerFailed(name, reason string) {
 	logValidation.Printf("Validation failed: %s, name=%s", reason, name)
 }
 
-// expandVariablesCore is the shared implementation for variable expansion.
-// It works with byte slices and handles the core expansion logic, tracking undefined variables.
-// This eliminates code duplication between expandVariables and ExpandRawJSONVariables.
-func expandVariablesCore(data []byte, contextDesc string) ([]byte, []string, error) {
-	logValidation.Printf("Expanding variables: context=%s", contextDesc)
-	var undefinedVars []string
-
-	result := varExprPattern.ReplaceAllFunc(data, func(match []byte) []byte {
-		// Extract variable name (remove ${ and })
-		varName := string(match[2 : len(match)-1])
-
-		if envValue, exists := os.LookupEnv(varName); exists {
-			logValidation.Printf("Expanded variable: %s (found in environment)", varName)
-			return []byte(envValue)
-		}
-
-		// Track undefined variable
-		undefinedVars = append(undefinedVars, varName)
-		logValidation.Printf("Undefined variable: %s", varName)
-		return match // Keep original if undefined
-	})
-
-	logValidation.Printf("Variable expansion completed: context=%s, undefined_count=%d", contextDesc, len(undefinedVars))
-	return result, undefinedVars, nil
-}
-
-// expandVariables expands variable expressions in a string
-// Returns the expanded string and error if any variable is undefined
-func expandVariables(value, jsonPath string) (string, error) {
-	result, undefinedVars, _ := expandVariablesCore([]byte(value), fmt.Sprintf("jsonPath=%s", jsonPath))
-
-	if len(undefinedVars) > 0 {
-		logValidation.Printf("Variable expansion failed: undefined variables=%v", undefinedVars)
-		return "", rules.UndefinedVariable(undefinedVars[0], jsonPath)
-	}
-
-	return string(result), nil
-}
-
-// ExpandRawJSONVariables expands all ${VAR} expressions in JSON data before schema validation.
-// This ensures the schema validates the expanded values, not the variable syntax.
-// It collects all undefined variables and reports them in a single error.
-func ExpandRawJSONVariables(data []byte) ([]byte, error) {
-	result, undefinedVars, _ := expandVariablesCore(data, "raw JSON data")
-
-	if len(undefinedVars) > 0 {
-		logValidation.Printf("Variable expansion failed: undefined variables=%v", undefinedVars)
-		return nil, rules.UndefinedVariable(undefinedVars[0], "configuration")
-	}
-
-	return result, nil
-}
-
-// expandEnvVariables expands all variable expressions in an env map
-func expandEnvVariables(env map[string]string, serverName string) (map[string]string, error) {
-	logValidation.Printf("Expanding env variables for server: %s, count=%d", serverName, len(env))
-	result := make(map[string]string, len(env))
-
-	for key, value := range env {
-		jsonPath := fmt.Sprintf("mcpServers.%s.env.%s", serverName, key)
-
-		expanded, err := expandVariables(value, jsonPath)
-		if err != nil {
-			return nil, err
-		}
-
-		result[key] = expanded
-	}
-
-	logValidation.Printf("Env variable expansion completed for server: %s", serverName)
-	return result, nil
-}
-
-// expandTracingVariables expands ${VAR} expressions in TracingConfig fields.
-// This is called for TOML-loaded configs before validation, mirroring the
-// stdin JSON path where ExpandRawJSONVariables handles expansion.
-func expandTracingVariables(cfg *TracingConfig) error {
-	if cfg == nil {
-		return nil
-	}
-
-	if cfg.Endpoint != "" {
-		expanded, err := expandVariables(cfg.Endpoint, "gateway.opentelemetry.endpoint")
-		if err != nil {
-			return err
-		}
-		cfg.Endpoint = expanded
-	}
-
-	if cfg.TraceID != "" {
-		expanded, err := expandVariables(cfg.TraceID, "gateway.opentelemetry.traceId")
-		if err != nil {
-			return err
-		}
-		cfg.TraceID = expanded
-	}
-
-	if cfg.SpanID != "" {
-		expanded, err := expandVariables(cfg.SpanID, "gateway.opentelemetry.spanId")
-		if err != nil {
-			return err
-		}
-		cfg.SpanID = expanded
-	}
-
-	if cfg.Headers != "" {
-		expanded, err := expandVariables(cfg.Headers, "gateway.opentelemetry.headers")
-		if err != nil {
-			return err
-		}
-		cfg.Headers = expanded
-	}
-
-	return nil
-}
-
 // validateMounts validates mount specifications using centralized rules
 func validateMounts(mounts []string, jsonPath string) error {
 	for i, mount := range mounts {
 
@@ -1,6 +1,8 @@
 package envutil
 
 import (
+	"fmt"
+	"net/url"
 	"os"
 	"strings"
 
@@ -9,6 +11,9 @@ import (
 
 var logGitHub = logger.New("envutil:github")
 
+// DefaultGitHubAPIBaseURL is the default GitHub API base URL.
+const DefaultGitHubAPIBaseURL = "https://api.github.com"
+
 // LookupGitHubToken searches environment variables for a GitHub token using
 // a canonical priority order. It returns the first non-empty (trimmed) value
 // found, or an empty string if none is set.
@@ -49,3 +54,49 @@ func LookupGitHubAPIURL(defaultURL string) string {
 	logGitHub.Printf("GitHub API URL using default: %s", url)
 	return url
 }
+
+// DeriveGitHubAPIURL resolves the GitHub API URL from environment variables:
+//  1. GITHUB_API_URL
+//  2. GITHUB_SERVER_URL (derived)
+//  3. defaultURL
+func DeriveGitHubAPIURL(defaultURL string) string {
+	if apiURL := LookupGitHubAPIURL(""); apiURL != "" {
+		return apiURL
+	}
+	if serverURL := strings.TrimSpace(os.Getenv("GITHUB_SERVER_URL")); serverURL != "" {
+		derived := deriveAPIFromServerURL(serverURL)
+		if derived != "" {
+			logGitHub.Printf("GitHub API URL derived from GITHUB_SERVER_URL=%s: %s", serverURL, derived)
+			return derived
+		}
+	}
+	return strings.TrimRight(strings.TrimSpace(defaultURL), "/")
+}
+
+// deriveAPIFromServerURL converts a GITHUB_SERVER_URL to the corresponding API endpoint.
+// GHEC tenants (*.ghe.com): https://tenant.ghe.com → https://copilot-api.tenant.ghe.com
+// GitHub.com: https://github.com → https://api.github.com
+// GHES (all others): https://github.example.com → https://github.example.com/api/v3
+func deriveAPIFromServerURL(serverURL string) string {
+	parsed, err := url.Parse(strings.TrimRight(serverURL, "/"))
+	if err != nil || parsed.Host == "" {
+		return ""
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return ""
+	}
+
+	hostname := strings.ToLower(parsed.Hostname())
+
+	switch {
+	case hostname == "github.com" || hostname == "www.github.com":
+		return DefaultGitHubAPIBaseURL
+	case strings.HasSuffix(hostname, ".ghe.com"):
+		if port := parsed.Port(); port != "" {
+			return fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port)
+		}
+		return fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname)
+	default:
+		return fmt.Sprintf("%s://%s/api/v3", parsed.Scheme, parsed.Host)
+	}
+}
Original file line number	Diff line number	Diff line change
`@@ -189,7 +189,7 @@ func runProxy(cmd *cobra.Command, args []string) error {`
`189`	`189`	`// Resolve GitHub API URL: flag → env vars → default`
`190`	`190`	`apiURL := proxyAPIURL`
`191`	`191`	`if apiURL == "" {`
`192`		`- apiURL = proxy.DeriveGitHubAPIURL()`
	`192`	`+ apiURL = envutil.DeriveGitHubAPIURL("")`
`193`	`193`	`}`
`194`	`194`	`if apiURL == "" {`
`195`	`195`	`apiURL = proxy.DefaultGitHubAPIBase`