From 72f21fa2c9dc02fd5a8d4eea75a232b174b94adc Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:41:51 +0000
Subject: [PATCH 1/2] fix(rust-guard): remove dead .or_else() fallback in
 notifications arm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `.or_else(|| response.as_array())` on line 395 of response_items.rs
was always a no-op because `extract_mcp_response` returns either:
- `Cow::Owned(parsed)`: parsing succeeded, so `actual_response.as_array()`
  is already the result — the fallback is unreachable.
- `Cow::Borrowed(response)`: `actual_response` IS `response`, so the
  fallback checks the identical value twice.

This removes the dead fallback and makes the notifications arm consistent
with every other arm in the file (all of which use `actual_response`
directly, without a `response` fallback).

Adds three tests that previously had zero coverage for this arm:
- list_notifications_labels_each_item_as_private: verifies the
  private_user_label() secrecy assignment for each notification.
- list_notifications_description_includes_id: verifies the
  "notification:{id}" description format.
- get_notification_details_empty_array_returns_empty: verifies an
  empty array input produces no labeled items.

All 576 Rust tests pass after this change (was 573 before adding tests).

Closes #8921

🤖 Generated by Repo Assist

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../rust-guard/src/labels/response_items.rs   | 40 ++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/guards/github-guard/rust-guard/src/labels/response_items.rs b/guards/github-guard/rust-guard/src/labels/response_items.rs
index 2430b60b..717493e7 100644
--- a/guards/github-guard/rust-guard/src/labels/response_items.rs
+++ b/guards/github-guard/rust-guard/src/labels/response_items.rs
@@ -392,7 +392,7 @@ pub fn label_response_items(
 
         // === Notifications - all are private ===
         "list_notifications" | "get_notification_details" => {
-            let items = actual_response.as_array().or_else(|| response.as_array());
+            let items = actual_response.as_array();
 
             if let Some(items) = items {
                 let notif_secrecy = private_user_label();
@@ -522,4 +522,42 @@ mod tests {
         assert_eq!(items.len(), 1);
         assert_eq!(items[0].get("number").and_then(|v| v.as_u64()), Some(42));
     }
+
+    /// Notifications are labelled as private with a `notification:{id}` description.
+    #[test]
+    fn list_notifications_labels_each_item_as_private() {
+        let ctx = default_ctx();
+        let response = json!([
+            {"id": "1", "subject": {"title": "PR reviewed"}},
+            {"id": "2", "subject": {"title": "Mention"}}
+        ]);
+        let result = label_response_items("list_notifications", &json!({}), &response, &ctx);
+        assert_eq!(result.len(), 2);
+        for item in &result {
+            let secrecy: Vec<String> = item.labels.secrecy.iter().cloned().collect();
+            assert!(
+                secrecy.iter().any(|s| s.starts_with("private")),
+                "notification secrecy should contain a private label, got: {secrecy:?}"
+            );
+        }
+    }
+
+    /// The description field is formatted as `notification:{id}` for each item.
+    #[test]
+    fn list_notifications_description_includes_id() {
+        let ctx = default_ctx();
+        let response = json!([{"id": "42"}]);
+        let result = label_response_items("list_notifications", &json!({}), &response, &ctx);
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].labels.description, "notification:42");
+    }
+
+    /// An empty notifications array returns an empty result set.
+    #[test]
+    fn get_notification_details_empty_array_returns_empty() {
+        let ctx = default_ctx();
+        let result =
+            label_response_items("get_notification_details", &json!({}), &json!([]), &ctx);
+        assert!(result.is_empty());
+    }
 }

From b41ba5ee67f49e10fc1b1ea0f377e722d591378d Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Wed, 8 Jul 2026 06:58:29 -0700
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../github-guard/rust-guard/src/labels/response_items.rs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/guards/github-guard/rust-guard/src/labels/response_items.rs b/guards/github-guard/rust-guard/src/labels/response_items.rs
index 717493e7..868c59a5 100644
--- a/guards/github-guard/rust-guard/src/labels/response_items.rs
+++ b/guards/github-guard/rust-guard/src/labels/response_items.rs
@@ -533,11 +533,12 @@ mod tests {
         ]);
         let result = label_response_items("list_notifications", &json!({}), &response, &ctx);
         assert_eq!(result.len(), 2);
+        let expected_secrecy = private_user_label();
         for item in &result {
-            let secrecy: Vec<String> = item.labels.secrecy.iter().cloned().collect();
-            assert!(
-                secrecy.iter().any(|s| s.starts_with("private")),
-                "notification secrecy should contain a private label, got: {secrecy:?}"
+            assert_eq!(
+                item.labels.secrecy,
+                expected_secrecy,
+                "notification secrecy should be private:user"
             );
         }
     }