Repository navigation

feat: Add GitHub DIFC enforcement with WASM guards, guard policies, and LabelAgent integration - #1674

Merged

lpcox merged 58 commits into

mainfrom

lpcox/github-difc

Mar 8, 2026

Merged

feat: Add GitHub DIFC enforcement with WASM guards, guard policies, and LabelAgent integration#1674
lpcox merged 58 commits into
mainfrom
lpcox/github-difc

Commits on Mar 8, 2026
- feat(difc): add propagate enforcement mode and --difc-mode flag
  lpcox
  committed
  8ca2e1d
- feat: add config extensions for session labels
  lpcox
  committed
  953548f
- feat: Add DIFC config extensions with schema bypass
  lpcox
  committed
  1fb9c69
- docs: Add DIFC environment variables, flags, and config extensions reference
  lpcox
  committed
  6aa8fd9
- refactor: Centralize DIFC mode string constants in difc package
  lpcox
  committed
  f9edbf1
- feat: Load guards from config instead of always using NoopGuard
  lpcox
  committed
  0615448
- feat: Restore WASM guard support and path-based labeling
  lpcox
  committed
  bac03ef
- test: Add GitHub WASM guard integration tests
  lpcox
  committed
  52e77dc
- fix: Load WASM guards from config path instead of factory lookup
  lpcox
  committed
  43856c9
- fix: Skip coarse-grained DIFC check for reads in filter/propagate mode
  lpcox
  committed
  d6db366
- fix: Correct DIFC propagate mode label semantics
  lpcox
  committed
  34cacd2
- added doc
  lpcox
  committed
  ee64df9
- docs: Update GUARD_RESPONSE_LABELING with DIFC rules and fix NoopGuard
  lpcox
  committed
  3e51134
- Fix strict mode DIFC implementation and lint issues
  lpcox
  committed
  4da3476
- fix: Unwrap MCP responses before applying path-based labels
  lpcox
  committed
  e7b2b91
- debug: Add logging for tool args passed to guard LabelResource
  lpcox
  committed
  57ad274
- fixed guard bugs
  lpcox
  committed
  d59e427
- Propagate tool_args to DIFC LabelResponse
  lpcox
  committed
  cdc4e18
- Allow read operations to proceed for response labeling
  lpcox
  committed
  087d0a8
- Set DIFC agent ID from session context
  lpcox
  committed
  1674e0d
- Harden label_agent payload and fail-closed handling
  lpcox
  committed
  e83cb57
- Add AllowOnly policy and label_agent session integration
  lpcox
  committed
  74e6653
- Align AllowOnly integrity baseline to None
  lpcox
  committed
  3563b54
- Align allowonly validation with updated schema regex
  lpcox
  committed
  d66b27b
- Send strict top-level allowonly payload to label_agent
  lpcox
  committed
  4439226
- Normalize guard normalized_policy scope_kind to lowercase
  lpcox
  committed
  a590c05
- Add DIFC sink-aware agent tag snapshots to RPC JSONL logs
  lpcox
  committed
  a7f5a62
- Add configurable DIFC sink server IDs and fix lint/test issues
  lpcox
  committed
  bc2e92b
- Update JSONL logger changes
  lpcox
  committed
  9eeb53c
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  7ac52ff
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  5db2f25
- Refactor: Extract wrapWithMiddleware helper to eliminate duplicate code
  
  Claude
  and
  lpcox
  committed
  83c7aec
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  3a6c829
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  dfa58a4
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  3acbce1
- Initial plan
  
  Claude
  authored and
  lpcox
  committed
  79077bb
- Refactor: consolidate function clustering - move Docker utils, replace stdlib reimplementation, add strutil package
  
  Claude
  and
  lpcox
  committed
  4ace630
- feat: Add DIFC config extensions with schema bypass
  lpcox
  committed
  2f408b8
- Set DIFC agent ID from session context
  lpcox
  committed
  5e0d928
- Fix agent-finished failures in mcp and integration tests
  lpcox
  committed
  3d0acbd
- Resolve rebase conflicts and restore passing test suite
  lpcox
  committed
  1221e4b
- Resolve post-rebase MCP test and transport conflicts
  lpcox
  committed
  acdcb2a
- chore: update root command handling
  lpcox
  committed
  d972693
- docs: add LabelAgent documentation to GUARD_RESPONSE_LABELING.md
  lpcox
  committed
  3ff7307
- docs: add end-to-end GitHub guard scoping example
  lpcox
  committed
  95b932b
- updated labeling doc
  lpcox
  committed
  556b378
- add MCP_GATEWAY_WASM_GUARDS_DIR guard discovery and fix lint
  lpcox
  committed
  25a3903
- log MCP_GATEWAY_WASM_GUARDS_DIR at unified startup
  lpcox
  committed
  fa7277c
- log MCP_GATEWAY_WASM_GUARDS_DIR in container entrypoint
  lpcox
  committed
  ff61042
- log per-server guard policies at startup
  lpcox
  committed
  010f172
- fix DIFC guard policy resolution and label_agent init
  lpcox
  committed
  07f3788
- rebase: restore setupSessionCallback lost during rebase onto main
  
  lpcox
  and
  Copilot
  committed
  e166e65
- rename integrity labels: reader→unapproved, writer→approved
  
  lpcox
  and
  Copilot
  committed
  39850f4
- gitignore: exclude gateway.log and pdf files
  
  lpcox
  and
  Copilot
  committed
  725728f
- refactor: rename guard policy field 'integrity' → 'min-integrity'
  
  lpcox
  and
  Copilot
  committed
  8ee5e8d
- fix: eliminate data race in AgentLabels bulk tag mutations
  
  Copilot
  and
  lpcox
  committed
  afc0f6a
- fix: ephemeral ports in difc_config_test and use resolveGuardPolicy in requireGuardPolicyIfGuardEnabled
  
  Copilot
  and
  lpcox
  committed
  fe18d88
- feat: hide sys tools from MCP SDK; accept allow-only (with dash) as canonical guard policy key
  
  Copilot
  and
  lpcox
  committed
  b07b623

Commits

Commits on Mar 8, 2026