refactor(guard): extract RunLabelAgentForAgent to eliminate duplicate LabelAgent init pattern

[Copilot]

AgentRegistry.GetOrCreate(agentID) followed by RunLabelAgent(...) was duplicated verbatim in both internal/proxy/proxy.go (initGuardPolicy) and internal/server/guard_init.go (ensureGuardInitialized), creating a silent divergence risk for DIFC enforcement semantics.

Changes

• internal/guard/label_agent.go — New RunLabelAgentForAgent helper accepts a *difc.AgentRegistry + agentID instead of a pre-resolved *difc.AgentLabels; internally calls GetOrCreate then delegates to RunLabelAgent:

  func RunLabelAgentForAgent(
      ctx context.Context,
      g Guard,
      payload interface{},
      backend BackendCaller,
      caps *difc.Capabilities,
      registry *difc.AgentRegistry,
      agentID string,
      defaultMode difc.EnforcementMode,
  ) (difc.EnforcementMode, *LabelAgentResult, error) {
      agentLabels := registry.GetOrCreate(agentID)
      return RunLabelAgent(ctx, g, payload, backend, caps, agentLabels, defaultMode)
  }

• internal/proxy/proxy.go and internal/server/guard_init.go — Replace the two-step GetOrCreate + RunLabelAgent pair with RunLabelAgentForAgent. Each caller retains its own session caching, guardInitialized flag, and post-call mode update logic.

• internal/guard/init_test.go — Two new tests cover RunLabelAgentForAgent success path (registry population verified) and error propagation.

[Copilot]

Pull request overview

This PR refactors DIFC guard initialization by extracting a shared RunLabelAgentForAgent helper, eliminating duplicated AgentRegistry.GetOrCreate(agentID) + RunLabelAgent(...) sequences across the proxy and unified server paths to reduce divergence risk in label initialization semantics.

Changes:

• Added guard.RunLabelAgentForAgent wrapper to resolve agent labels via AgentRegistry before delegating to RunLabelAgent.
• Updated proxy and unified server guard initialization code paths to use the new helper.
• Added unit tests covering the helper’s success path (registry population) and error propagation.

Show a summary per file

File	Description
internal/guard/label_agent.go	Adds RunLabelAgentForAgent wrapper that performs registry.GetOrCreate(agentID) then calls RunLabelAgent.
internal/proxy/proxy.go	Uses RunLabelAgentForAgent during proxy guard policy initialization to avoid duplicated label lookup logic.
internal/server/guard_init.go	Uses RunLabelAgentForAgent during session guard initialization to keep behavior aligned with proxy init path.
internal/guard/init_test.go	Adds tests for RunLabelAgentForAgent success and error propagation behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 1