Refactor duplicate label-agent guard initialization into shared helper

[Copilot]

internal/server/guard_init.go and internal/proxy/proxy.go both implemented the same two-step label-agent init flow (BuildLabelAgentPayload + RunLabelAgentForAgent), with small argument drift over time. This PR centralizes that flow to reduce API-change risk and keep server/proxy behavior aligned.

• Shared guard init abstraction

  • Added guard.RunLabelAgentInit(...) in internal/guard/label_agent.go.
  • Encapsulates payload construction and label-agent execution in one call.

• Server path now uses shared helper

  • Replaced direct RunLabelAgentForAgent(...) invocation in internal/server/guard_init.go.
  • Preserves existing semantics: server still passes trustedUsers=nil, and session policy-hash caching remains unchanged.

• Proxy path now uses shared helper

  • Replaced inline payload-build + run sequence in internal/proxy/proxy.go.
  • Keeps proxy-specific behavior intact, including explicit trustedUsers injection and mode override handling.

• Focused unit coverage

  • Added/updated guard tests to validate that the helper:
    • injects trusted-bots and trusted-users correctly,
    • preserves existing allow-only policy fields.

mode, result, err := guard.RunLabelAgentInit(
    ctx, g, policy, trustedBots, trustedUsers,
    backend, caps, registry, agentID, defaultMode,
)

[Copilot]

Pull request overview

This PR centralizes the common “build label_agent payload + execute LabelAgent for an agent” initialization sequence into a shared helper in internal/guard, then updates both the unified server guard-init path and the proxy guard-init path to use it to keep behavior aligned and reduce drift risk.

Changes:

• Added guard.RunLabelAgentInit(...) to encapsulate BuildLabelAgentPayload(...) + RunLabelAgentForAgent(...).
• Updated server (internal/server/guard_init.go) and proxy (internal/proxy/proxy.go) to call the shared helper instead of duplicating the sequence.
• Added unit coverage to ensure the helper produces payloads that correctly inject trusted-bots and trusted-users while preserving existing policy fields.

Show a summary per file

File	Description
internal/server/guard_init.go	Switches unified server guard initialization to call the shared label-agent init helper.
internal/proxy/proxy.go	Replaces inline payload-build + label-agent run with the shared helper, preserving proxy-specific inputs.
internal/guard/label_agent.go	Introduces RunLabelAgentInit helper that composes payload creation and agent label initialization.
internal/guard/init_test.go	Extends guard init tests to validate helper-driven payload construction and execution wiring.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 1