Refactor duplicate validation into shared utility

[Copilot]

Duplicate detection was reimplemented across configuration validators. This adds a reusable generic helper and migrates the agent-policy and gateway agent-ID paths.

• Shared utility
  • Add util.FindDuplicate[T comparable] to return the first repeated value.

if duplicate, found := util.FindDuplicate(agentIDs); found {
    return fmt.Errorf("... duplicate agent ID %q", duplicate)
}

• Validation migration

  • Replace inline duplicate loops for gateway agent IDs.
  • Replace agent-policy server and tool duplicate loops.
  • Preserve trimmed values in agent-policy duplicate errors.

• Coverage

  • Add utility tests for nil, unique, repeated, and zero-value items.

• Fixes [duplicate-code] Duplicate Code Pattern: Repeated seen-map duplicate-validation loop across config/enclavegithub/proxy #12207

[Copilot]

🟢 Approval recommended

The focused refactor preserves validation behavior and includes appropriate utility coverage.

Pull request overview

Adds a generic duplicate-detection utility and applies it to configuration validation.

Changes:

• Introduces and tests util.FindDuplicate.
• Refactors gateway agent ID and agent-policy duplicate validation.
• Preserves existing validation errors and normalized values.

File summaries

File	Description
internal/util/collections.go	Adds the generic duplicate helper.
internal/util/collections_test.go	Covers duplicate and no-duplicate cases.
internal/config/validation_gateway.go	Uses the helper for agent IDs.
internal/config/agent_policy.go	Uses the helper for servers and tools.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues (3 items returned)	data	ALLOWED	✅
A2	MCP	list_pull_requests (3 items returned)	data	ALLOWED	✅
A3	MCP	get_file_contents README.md	data	ALLOWED	✅
A4	MCP	list_commits (3 items returned)	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	list_issues via github CLI (3 items)	data	ALLOWED	✅
C	CLI	get_file_contents via github CLI	data	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B — INCONCLUSIVE: The github CLI catalog exposes exactly 23 read-only tools. None of the targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) appear in the catalog. Per the architectural note, GITHUB_READ_ONLY=1 is unconditionally set by gh-aw's tools.github: frontmatter, so the backend never registers write tools. Tool-absent refusals confirm backend defense-in-depth but do not exercise mcpg's own DIFC/guard enforcement layer — a dedicated probe outside gh-aw's tools.github: wrapper is needed to confirm that independently.

⚠️ Parts D/E — INCONCLUSIVE: gh CLI is not authenticated in this sandbox (GH_TOKEN not set). All REST write attempts and GraphQL mutations would return 401 Bad credentials regardless of token scopes or gateway enforcement — this is not evidence of blocked writes. The token-scope boundary cannot be validated in this run.

No write leaked through any surface. No FAIL conditions observed.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool not found	BLOCKED	⚠️
C	CLI	reads (list issues, get file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B — All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the gateway's exposed tool catalog (Error [-32602]: unknown tool). This confirms the backend's GITHUB_READ_ONLY=1 defense-in-depth, but cannot independently confirm mcpg's own DIFC/guard enforcement layer since no write-capable tool reached the gateway proxy.

⚠️ Parts D/E — gh is not authenticated in this sandbox (GH_TOKEN not set). All REST/GraphQL write attempts returned "not authenticated". No write was attempted and no write succeeded, but the token-scope boundary cannot be validated without authentication.

No write leaked. No objects were created.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the MCP tool catalog (23 read-only tools exposed). Backend launched with GITHUB_READ_ONLY=1 — this confirms the gh-aw framework's own defense-in-depth guarantee but does NOT independently confirm mcpg's DIFC/guard enforcement layer, since no write-capable backend was reached.

⚠️ Parts D & E: gh CLI is unauthenticated in this environment (GH_TOKEN invalid — 401 Bad credentials on all calls). Token-scope boundary could not be validated. All REST and GraphQL write attempts failed with 401, not with a gateway-enforced error. No writes leaked, but this is not confirmed gateway enforcement.

No writes leaked in any part. The enforcement holds, but the methodology gaps above mean gateway-level write blocking cannot be independently confirmed for this run.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime