Function getDIFCProxyPolicyJSON

pkg/workflow/compiler_difc_proxy.go:171–210

getDIFCProxyPolicyJSON returns a JSON-encoded guard policy for the DIFC proxy. Unlike the gateway policy (which includes dynamic blocked-users and approval-labels from step outputs), the proxy policy only includes the static fields available at compile time: min-integrity and repos. This is because

(githubTool map[string]any, data *WorkflowData, gatewayConfig *MCPGatewayRuntimeConfig)

//
// Returns an empty string if no guard policy fields are found.
func getDIFCProxyPolicyJSON(githubTool map[string]any, data *WorkflowData, gatewayConfig *MCPGatewayRuntimeConfig) string {
	policy := make(map[string]any)

	// Support both 'allowed-repos' (preferred) and deprecated 'repos'
	repos, hasRepos := githubTool["allowed-repos"]
	if !hasRepos {
		repos, hasRepos = githubTool["repos"]
	}
	integrity, hasIntegrity := githubTool["min-integrity"]

	if !hasRepos && !hasIntegrity {
		return ""
	}

	if hasRepos {
		policy["repos"] = normalizeGitHubRepositoryInReposScope(repos)
	} else {
		// Default repos to "all" when min-integrity is specified without repos
		policy["repos"] = "all"
	}

	if hasIntegrity {
		policy["min-integrity"] = integrity
	}

	// Inject reaction fields when the feature flag is enabled and MCPG supports it.
	injectIntegrityReactionFields(policy, githubTool, data, gatewayConfig)

	guardPolicy := map[string]any{
		"allow-only": policy,
	}

	jsonBytes, err := json.Marshal(guardPolicy)
	if err != nil {
		difcProxyLog.Printf("Failed to marshal DIFC proxy policy: %v", err)
		return ""
	}

	return string(jsonBytes)
}

// resolveProxyContainerImage returns the full container image reference (container:version)
// for the DIFC/CLI proxy, falling back to the default MCP gateway version if none is configured.