[Copilot]

Align HTTP proxy response handling with intended access controls while preserving supported formats and authorized behavior.

• Policy consistency: Apply resource-level authorization to responses without item-level filtering and preserve propagate-mode label accumulation.
• Format compatibility: Retain authorized text, binary, redirect, and bodyless responses; reject malformed structured responses and unsupported encodings.
• Regression coverage: Add denied-request cases and authorized compatibility controls across response formats and enforcement modes.

Merged implementation and release links remain maintainer follow-up before closure; sensitive coordination stays private.

• Fixes Review proxy response handling and expand regression coverage #15531

[Copilot]

🔵 Needs a closer look

These authorization-boundary changes need human review, and compatibility and operational regressions remain unresolved.

4 open issues

• Log and mark all response denials as failed · New
• Preserve rate-limit headers on coarse collection denials · New
• Allow bodyless responses with Content-Encoding · New
• Exclude GitHub raw media types from JSON parsing · New

What changed in this PR

Updates the GitHub HTTP proxy to enforce resource-level authorization when responses cannot be filtered per item, while preserving label propagation for permitted responses.

Changes:

• Adds authorization gates for artifacts, redirects, errors, and opaque responses.
• Validates structured response formats and encodings, and accumulates labels on fallback paths.
• Adds denied-request and authorized-compatibility tests across response formats and enforcement modes.

File	Description
internal/​proxy/​response_access_test.go	Adds format, authorization, encoding, and label-accumulation regressions.
internal/​proxy/​response_access_guard_test.go	Checks private-resource denial and public-resource compatibility using the real GitHub guard.
internal/​proxy/​handler.go	Adds response authorization, format validation, and fallback label accumulation.

_{Review effort: Max}

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (star_repository, issue_write, add_issue_comment, create_branch)	all -32602 unknown tool — absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	reads via github proxy	data returned	ALLOWED	✅
D	CLI	REST writes	gh not authenticated (not logged into any host)	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write of any kind leaked. Part B tools never appeared in the exposed 23-tool catalog, so refusal proves backend GITHUB_READ_ONLY=1 config rather than mcpg's own gateway-level DIFC/guard blocking (per the architectural note in the prompt, this is expected for every gh-aw tools.github: workflow). Parts D/E were not attempted because gh auth status reported no authenticated host in this runner, so the GitHub-token-scope boundary could not be independently exercised this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime