[duplicate-code] Duplicate Code Pattern: Guard LabelAgent Initialization Pipeline

[github-actions]

Part of duplicate code analysis: #4711

Summary

The guard initialization / LabelAgent invocation sequence is implemented independently in both the MCP gateway server (internal/server/guard_init.go) and the proxy server (internal/proxy/proxy.go). Both call guard.BuildLabelAgentPayload, invoke g.LabelAgent, check for nil results, and call guard.ApplyLabelAgentResult — the same 4-step pattern, ~30 lines each.

Duplication Details

Pattern: Duplicated LabelAgent initialization pipeline

• Severity: High

• Occurrences: 2

• Locations:

  • internal/server/guard_init.go — ensureGuardInitialized() (lines ~323–396)
  • internal/proxy/proxy.go — initGuardPolicy() (lines ~149–213)

• Code Sample (server/guard_init.go):

  labelAgentPayload := guard.BuildLabelAgentPayload(policy, trustedBots, nil)
  // ...
  labelAgentResult, err := g.LabelAgent(ctx, labelAgentPayload, backendCaller, us.capabilities)
  if err != nil { ... }
  if labelAgentResult == nil { ... }
  agentLabels := us.agentRegistry.GetOrCreate(agentID)
  mode, err := guard.ApplyLabelAgentResult(labelAgentResult, agentLabels, defaultMode)

• Code Sample (proxy/proxy.go):

  payload := guard.BuildLabelAgentPayload(policy, trustedBots, trustedUsers)
  result, err := s.guard.LabelAgent(ctx, payload, backend, s.capabilities)
  if err != nil { return fmt.Errorf("LabelAgent failed: %w", err) }
  if result == nil { return fmt.Errorf("LabelAgent returned nil result") }
  agentLabels := s.agentRegistry.GetOrCreate("proxy")
  newMode, err := guard.ApplyLabelAgentResult(result, agentLabels, s.enforcementMode)

Impact Analysis

• Maintainability: Any bug fix or behaviour change (e.g. error message wording, nil-check handling) must be manually replicated in two places.
• Bug Risk: High — a divergence already exists: proxy.go logs via logProxy.Printf while guard_init.go uses logger.LogInfoWithServer, so debugging behavior differs.
• Code Bloat: ~60 duplicated lines with diverging log detail.

Refactoring Recommendations

1. Extract a shared helper into internal/guard/ (e.g. guard/init.go):
   • Function signature: func RunLabelAgent(ctx context.Context, g Guard, policy interface{}, trustedBots, trustedUsers []string, backend BackendCaller, caps *difc.Capabilities, registry *difc.AgentRegistry, agentID string, defaultMode difc.EnforcementMode) (difc.EnforcementMode, *LabelAgentResult, error)
   • Both callers reduce to a single call + their own session-caching logic.
   • Estimated effort: 2–3 hours
   • Benefits: single error-message source, single test surface

Implementation Checklist

• Review duplication findings
• Create internal/guard/init.go with shared RunLabelAgent helper
• Refactor server/guard_init.go to use shared helper
• Refactor proxy/proxy.go to use shared helper
• Update / add unit tests for the shared helper
• Verify no functionality broken

Parent Issue

See parent analysis report: #4711
Related to #4711

Generated by Duplicate Code Detector · ● 1M · ◷

• expires on May 5, 2026, 6:23 AM UTC