refactor: rename guard/init.go, relocate expandTracingVariables, consolidate collaborator_permission helpers

internal/config/config_tracing.go

@@ -188,3 +188,43 @@ func init() {
 		}
 	})
 }
+
+// expandTracingVariables expands ${VAR} expressions in TracingConfig fields.
+// This is called for TOML-loaded configs before validation, mirroring the
+// stdin JSON path where ExpandRawJSONVariables handles expansion.
+func expandTracingVariables(cfg *TracingConfig) error {
+	if cfg == nil {
+		return nil
+	}
+
+	logValidation.Printf("Expanding tracing config variables: hasEndpoint=%v, hasTraceID=%v, hasSpanID=%v, hasHeaders=%v",
+		cfg.Endpoint != "", cfg.TraceID != "", cfg.SpanID != "", cfg.Headers != "")
+
+	fields := []struct {
+		name     string
+		jsonPath string
+		value    *string
+	}{
+		{name: "endpoint", jsonPath: "gateway.opentelemetry.endpoint", value: &cfg.Endpoint},
+		{name: "traceId", jsonPath: "gateway.opentelemetry.traceId", value: &cfg.TraceID},
+		{name: "spanId", jsonPath: "gateway.opentelemetry.spanId", value: &cfg.SpanID},
+		{name: "headers", jsonPath: "gateway.opentelemetry.headers", value: &cfg.Headers},
+	}
+
+	for _, field := range fields {
+		if *field.value == "" {
+			continue
+		}
+
+		expanded, err := expandVariables(*field.value, field.jsonPath)
+		if err != nil {
+			return err
+		}
+
+		logValidation.Printf("Expanded tracing %s variable", field.name)
+		*field.value = expanded
+	}
+
+	logValidation.Print("Tracing config variable expansion completed")
+	return nil
+}

internal/config/expand.go

@@ -88,43 +88,3 @@ func expandEnvVariables(env map[string]string, serverName string) (map[string]st
 	logValidation.Printf("Env variable expansion completed for server: %s", serverName)
 	return result, nil
 }
-
-// expandTracingVariables expands ${VAR} expressions in TracingConfig fields.
-// This is called for TOML-loaded configs before validation, mirroring the
-// stdin JSON path where ExpandRawJSONVariables handles expansion.
-func expandTracingVariables(cfg *TracingConfig) error {
-	if cfg == nil {
-		return nil
-	}
-
-	logValidation.Printf("Expanding tracing config variables: hasEndpoint=%v, hasTraceID=%v, hasSpanID=%v, hasHeaders=%v",
-		cfg.Endpoint != "", cfg.TraceID != "", cfg.SpanID != "", cfg.Headers != "")
-
-	fields := []struct {
-		name     string
-		jsonPath string
-		value    *string
-	}{
-		{name: "endpoint", jsonPath: "gateway.opentelemetry.endpoint", value: &cfg.Endpoint},
-		{name: "traceId", jsonPath: "gateway.opentelemetry.traceId", value: &cfg.TraceID},
-		{name: "spanId", jsonPath: "gateway.opentelemetry.spanId", value: &cfg.SpanID},
-		{name: "headers", jsonPath: "gateway.opentelemetry.headers", value: &cfg.Headers},
-	}
-
-	for _, field := range fields {
-		if *field.value == "" {
-			continue
-		}
-
-		expanded, err := expandVariables(*field.value, field.jsonPath)
-		if err != nil {
-			return err
-		}
-
-		logValidation.Printf("Expanded tracing %s variable", field.name)
-		*field.value = expanded
-	}
-
-	logValidation.Print("Tracing config variable expansion completed")
-	return nil
-}

internal/guard/init.go → internal/guard/label_agent.go

@@ -8,7 +8,7 @@ import (
 	"github.com/github/gh-aw-mcpg/internal/logger"
 )
 
-var logGuardInit = logger.New("guard:init")
+var logLabelAgent = logger.New("guard:label_agent")
 
 // RunLabelAgent executes the standard LabelAgent initialization pipeline:
 //  1. Calls the guard's LabelAgent method with the provided pre-built payload.
@@ -28,24 +28,24 @@ func RunLabelAgent(
 	agentLabels *difc.AgentLabels,
 	defaultMode difc.EnforcementMode,
 ) (difc.EnforcementMode, *LabelAgentResult, error) {
-	logGuardInit.Printf("Calling LabelAgent: guard=%s", g.Name())
+	logLabelAgent.Printf("Calling LabelAgent: guard=%s", g.Name())
 
 	result, err := g.LabelAgent(ctx, payload, backend, caps)
 	if err != nil {
-		logGuardInit.Printf("LabelAgent failed: guard=%s, error=%v", g.Name(), err)
+		logLabelAgent.Printf("LabelAgent failed: guard=%s, error=%v", g.Name(), err)
 		return defaultMode, nil, fmt.Errorf("LabelAgent failed: %w", err)
 	}
 	if result == nil {
-		logGuardInit.Printf("LabelAgent returned nil result: guard=%s", g.Name())
+		logLabelAgent.Printf("LabelAgent returned nil result: guard=%s", g.Name())
 		return defaultMode, nil, fmt.Errorf("LabelAgent returned nil result")
 	}
 
 	mode, err := ApplyLabelAgentResult(result, agentLabels, defaultMode)
 	if err != nil {
-		logGuardInit.Printf("LabelAgent result invalid: guard=%s, error=%v", g.Name(), err)
+		logLabelAgent.Printf("LabelAgent result invalid: guard=%s, error=%v", g.Name(), err)
 		return defaultMode, nil, fmt.Errorf("LabelAgent result invalid: %w", err)
 	}
 
-	logGuardInit.Printf("LabelAgent completed: guard=%s, mode=%s", g.Name(), mode)
+	logLabelAgent.Printf("LabelAgent completed: guard=%s, mode=%s", g.Name(), mode)
 	return mode, result, nil
 }

internal/mcp/collaborator_permission.go

@@ -1,7 +1,6 @@
 package mcp
 
 import (
-	"encoding/json"
 	"fmt"
 )
 
@@ -18,29 +17,3 @@ func ParseCollaboratorPermissionArgs(argsMap map[string]interface{}) (owner, rep
 	}
 	return
 }
-
-// LogAndWrapCollaboratorPermission parses the raw GitHub API response body for a
-// get_collaborator_permission request, logs the resolved permission level for
-// observability, and returns the body wrapped in MCP text-response format.
-//
-// This helper is shared between the server and proxy packages to eliminate
-// duplicated parse/log/wrap logic. Callers pass their own debug logger's Printf
-// method so that log lines appear under the correct namespace.
-func LogAndWrapCollaboratorPermission(
-	body []byte,
-	owner, repo, username string,
-	statusCode int,
-	logPrintf func(format string, args ...interface{}),
-) interface{} {
-	var permResp map[string]interface{}
-	if jsonErr := json.Unmarshal(body, &permResp); jsonErr == nil {
-		if perm, ok := permResp["permission"].(string); ok {
-			logPrintf("get_collaborator_permission: %s/%s user %s → permission=%q (HTTP %d)", owner, repo, username, perm, statusCode)
-		} else {
-			logPrintf("get_collaborator_permission: %s/%s user %s → HTTP %d, permission field missing from response", owner, repo, username, statusCode)
-		}
-	} else {
-		logPrintf("get_collaborator_permission: %s/%s user %s → HTTP %d, %d bytes (JSON parse failed: %v)", owner, repo, username, statusCode, len(body), jsonErr)
-	}
-	return BuildMCPTextResponse(string(body))
-}

internal/mcp/tool_result.go

@@ -196,3 +196,29 @@ func BuildMCPTextResponse(text string) map[string]interface{} {
 		},
 	}
 }
+
+// LogAndWrapCollaboratorPermission parses the raw GitHub API response body for a
+// get_collaborator_permission request, logs the resolved permission level for
+// observability, and returns the body wrapped in MCP text-response format.
+//
+// This helper is shared between the server and proxy packages to eliminate
+// duplicated parse/log/wrap logic. Callers pass their own debug logger's Printf
+// method so that log lines appear under the correct namespace.
+func LogAndWrapCollaboratorPermission(
+	body []byte,
+	owner, repo, username string,
+	statusCode int,
+	logPrintf func(format string, args ...interface{}),
+) interface{} {
+	var permResp map[string]interface{}
+	if jsonErr := json.Unmarshal(body, &permResp); jsonErr == nil {
+		if perm, ok := permResp["permission"].(string); ok {
+			logPrintf("get_collaborator_permission: %s/%s user %s → permission=%q (HTTP %d)", owner, repo, username, perm, statusCode)
+		} else {
+			logPrintf("get_collaborator_permission: %s/%s user %s → HTTP %d, permission field missing from response", owner, repo, username, statusCode)
+		}
+	} else {
+		logPrintf("get_collaborator_permission: %s/%s user %s → HTTP %d, %d bytes (JSON parse failed: %v)", owner, repo, username, statusCode, len(body), jsonErr)
+	}
+	return BuildMCPTextResponse(string(body))
+}