Align proxy --policy default with shared env config helpers

[Copilot]

The proxy subcommand was the one place in internal/cmd still reading MCP_GATEWAY_GUARD_POLICY_JSON via a raw os.Getenv call. This updates it to follow the same env-default pattern used by the rest of the CLI and ties the flag to the shared config constant.

• Proxy flag default

  • Switch --policy default wiring from a string literal + os.Getenv(...) to envutil.GetEnvString(config.EnvGuardPolicyJSON, "")
  • Reuse the canonical config.EnvGuardPolicyJSON constant instead of duplicating the env var name

• Test alignment

  • Update proxy command tests to reference config.EnvGuardPolicyJSON so the coverage follows the same source of truth as production code

• Result

  • Keeps proxy flag registration consistent with the rest of the codebase
  • Preserves existing behavior while centralizing env var naming and lookup

cmd.Flags().StringVar(
    &proxyPolicy,
    "policy",
    envutil.GetEnvString(config.EnvGuardPolicyJSON, ""),
    "Guard policy JSON",
)

• Fixes [go-fan] Go Module Review: spf13/cobra #9776

[Copilot]

Pull request overview

Aligns the proxy policy environment default with shared configuration helpers, resolving issue #9776.

Changes:

• Uses envutil.GetEnvString and config.EnvGuardPolicyJSON.
• Updates tests to use the canonical environment variable constant.

Show a summary per file

File	Description
internal/cmd/proxy.go	Centralizes proxy policy default lookup.
internal/cmd/proxy_test.go	Aligns tests with the shared constant.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pulls, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	gateway error [-32602] unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — rejected	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — rejected	BLOCKED	✅

Overall: PASS

Part B gateway error: MCP JSON-RPC Error [-32602]: unknown tool — gateway-enforced refusal (tool not permitted in read-only mode).
Parts D & E: gh CLI unauthenticated; all REST/GraphQL writes rejected at transport level.

References: §29830711641

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool (~30–48ms, gateway-filtered)	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (6 attempts via gh api)	gh unauthenticated — all rejected	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — all rejected	BLOCKED	✅

Part B note: Write tool rejections at ~30–48ms confirm gateway-level tool filtering (read round-trips ~800ms). Error [-32602]: unknown tool is the MCP gateway refusing before forwarding — not a backend config gap.

Overall: PASS

References: §29830711625

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	✅

Overall: PASS

Run §29830711561
Part B gateway error: Error [-32602]: unknown tool "<write_tool>" — gateway strips all write tools from the MCP surface.
Parts D/E: gh CLI is unauthenticated in this runtime; REST and GraphQL writes rejected before reaching GitHub API.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime