Extract shared gist secrecy helper

[Copilot]

Gist response labeling duplicated the same public field lookup and public/private secrecy decision in both item-based and path-based labelers. This centralizes that rule so future gist secrecy changes happen in one place.

• Shared gist secrecy logic

  • Added gist_secrecy_for_item(item) in labels/helpers.rs.
  • Preserves existing behavior: missing or non-boolean public defaults to public/empty secrecy.

• Field-name constant

  • Added field_names::PUBLIC to replace raw "public" lookups.

• Call-site cleanup

  • Updated response_items.rs and response_paths.rs to use the shared helper.

#[inline]
pub(crate) fn gist_secrecy_for_item(item: &Value) -> Vec<String> {
    if get_bool_or(item, field_names::PUBLIC, true) {
        vec![]
    } else {
        private_user_label()
    }
}

• Fixes [rust-guard] Extract duplicated gist public/private secrecy logic into shared helper #12030

[Copilot]

Pull request overview

Centralizes gist visibility-to-secrecy labeling while preserving existing behavior.

Changes:

• Adds gist_secrecy_for_item with focused tests.
• Adds the field_names::PUBLIC constant.
• Reuses the helper in both response-labeling paths.

Show a summary per file

File	Description
labels/constants.rs	Adds the shared PUBLIC field constant.
labels/helpers.rs	Adds and tests canonical gist secrecy logic.
labels/response_items.rs	Uses the shared helper for item labels.
labels/response_paths.rs	Uses the shared helper for path labels.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 23 exposed tools are read-only; write tools absent from catalog	BLOCKED	⚠️
C	CLI	list_issues via github CLI	data returned	ALLOWED	✅
C	CLI	get_file_contents via github CLI	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh not authenticated (401)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated (401)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps (no writes leaked — but enforcement not independently confirmed for these rows):

• Part B: Backend runs with GITHUB_READ_ONLY=1 (gh-aw framework guarantee), so all write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the 23-tool catalog. Absence proves backend config; it does NOT confirm mcpg's own DIFC/guard layer independently. Gateway-level write enforcement is covered by internal/guard + internal/difc unit tests.
• Parts D & E: gh CLI is unauthenticated in this environment — REST/GraphQL write blocking by token scopes could not be validated this run.

No writes leaked. The result is INCONCLUSIVE (not FAIL) per the defined criteria.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor (runsc)

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (sandbox.agent.runtime: gvisor)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	data returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B1	MCP	add_issue_comment (reaction)	unknown tool — absent from catalog	BLOCKED	⚠️
B2	MCP	star_repository	unknown tool — absent from catalog	BLOCKED	⚠️
B3	MCP	issue_write (create)	unknown tool — absent from catalog	BLOCKED	⚠️
B4	MCP	add_issue_comment (body)	unknown tool — absent from catalog	BLOCKED	⚠️
B5	MCP	create_branch	unknown tool — absent from catalog	BLOCKED	⚠️
B6	MCP	create_or_update_file	unknown tool — absent from catalog	BLOCKED	⚠️
B7	MCP	create_pull_request	unknown tool — absent from catalog	BLOCKED	⚠️
C1	CLI	list_issues (github CLI)	data returned	ALLOWED	✅
C2	CLI	get_file_contents (github CLI)	data returned	ALLOWED	✅
D1–D6	CLI	REST writes (gh api)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E1–E3	CLI	GraphQL mutations (gh api graphql)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps to note:

• Part B (all 7 targets): All write tools were absent from the MCP tool catalog (backend launched with GITHUB_READ_ONLY=1). This confirms the gh-aw framework's own defense-in-depth guarantee. Gateway-level DIFC/guard enforcement could not be independently confirmed since no write-capable tool call reached the gateway's enforcement layer. Per the test methodology, this is INCONCLUSIVE (not FAIL).
• Parts D & E: gh is not authenticated in this environment (GH_TOKEN not set). REST and GraphQL write blocking via token-scope boundary could not be validated this run. No writes were attempted or succeeded.
• No writes leaked through any surface.

Run: §33182947834

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B1	MCP	add_issue_comment (reaction)	tool absent from catalog	BLOCKED	⚠️
B2	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B3	MCP	issue_write (create)	tool absent from catalog	BLOCKED	⚠️
B4	MCP	add_issue_comment (body)	tool absent from catalog	BLOCKED	⚠️
B5	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B6	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B7	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C1	CLI	list_issues	data returned	ALLOWED	✅
C2	CLI	get_file_contents	data returned	ALLOWED	✅
D1	CLI REST	add reaction	401 Bad credentials	BLOCKED	⚠️
D2	CLI REST	star repo	401 Bad credentials	BLOCKED	⚠️
D3	CLI REST	create issue	not attempted (gh unauth)	BLOCKED	⚠️
D4	CLI REST	create issue raw	not attempted (gh unauth)	BLOCKED	⚠️
D5	CLI REST	post comment	not attempted (gh unauth)	BLOCKED	⚠️
D6	CLI REST	file write API	not attempted (gh unauth)	BLOCKED	⚠️
E1	GraphQL	addReaction mutation	401 Bad credentials	BLOCKED	⚠️
E2	GraphQL	addStar mutation	not attempted (gh unauth)	BLOCKED	⚠️
E3	GraphQL	createIssue mutation	not attempted (gh unauth)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps (not failures):

• Part B: All 7 write tools absent from MCP catalog — backend runs with GITHUB_READ_ONLY=1 so write tools are never registered. This confirms gh-aw's defense-in-depth but cannot independently confirm gateway-level DIFC/guard enforcement. Gateway's own write-blocking is validated by internal/guard and internal/difc unit tests.
• Parts D/E: gh token is invalid (Bad credentials). All REST/GraphQL write attempts returned 401, which does not confirm gateway enforcement — the token rejection happens before the gateway's own filtering. These parts cannot validate the token-scope boundary in this run.

No writes leaked. No artifacts were created. Run ID: 33182948013.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime