Fix extractIndexFromPath RFC 6901 prefix matching and clean up test comments

[Copilot]

extractIndexFromPath had a buggy third HasPrefix branch that matched /items3 against itemsPath /items, incorrectly associating it as index 3. Per RFC 6901, /items3 is a distinct key — only paths separated by / (e.g., /items/3) should match.

Changes

• path_labels.go: Remove the erroneous third branch; valid matches now require itemsPath + "/" prefix
• path_labels_coverage_test.go:
  • Rename TestExtractIndexFromPath_ThirdHasPrefix → TestExtractIndexFromPath_NoSlashSeparator; flip expectation from success to error
  • Fix TestPathLabeledData_ResolveNotCalledTwice comment — the guard being exercised is in GetItems(), not inside resolve()
• labels_test.go, agent_test.go: Remove stale historical coverage percentages from test comments

// Before: "/items3" incorrectly matched itemsPath "/items" → index 3
} else if strings.HasPrefix(path, itemsPath+"/") {
    remainder = strings.TrimPrefix(path, itemsPath)
} else if strings.HasPrefix(path, itemsPath) && len(path) > len(itemsPath) { // removed
    remainder = path[len(itemsPath):]                                          // removed
} else {

// After: only explicit "/" separator matches
} else if strings.HasPrefix(path, itemsPath+"/") {
    remainder = strings.TrimPrefix(path, itemsPath)
} else {

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build2263365615/b336/launcher.test /tmp/go-build2263365615/b336/launcher.test -test.testlogfile=/tmp/go-build2263365615/b336/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2263365615/b234/vet.cfg 64/src/runtime/c-c=4 64/src/vendor/go-nolocalimports x_amd64/vet (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build2263365615/b318/config.test /tmp/go-build2263365615/b318/config.test -test.testlogfile=/tmp/go-build2263365615/b318/testlog.txt -test.paniconexit0 -test.timeout=10m0s conf�� 64/src/runtime/c-c=4 user.name x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build2263365615/b336/launcher.test /tmp/go-build2263365615/b336/launcher.test -test.testlogfile=/tmp/go-build2263365615/b336/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2263365615/b234/vet.cfg 64/src/runtime/c-c=4 64/src/vendor/go-nolocalimports x_amd64/vet (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build2263365615/b336/launcher.test /tmp/go-build2263365615/b336/launcher.test -test.testlogfile=/tmp/go-build2263365615/b336/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2263365615/b234/vet.cfg 64/src/runtime/c-c=4 64/src/vendor/go-nolocalimports x_amd64/vet (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build2263365615/b345/mcp.test /tmp/go-build2263365615/b345/mcp.test -test.testlogfile=/tmp/go-build2263365615/b345/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2263365615/b243/vet.cfg p/go-build test/improve-dif-nolocalimports x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR tightens JSON Pointer path matching for DIFC PathLabeledData to follow RFC 6901 semantics, ensuring item-path matching only occurs on proper /-delimited segments (and not on raw string prefixes like /items3 matching /items).

Changes:

• Remove the extractIndexFromPath branch that treated itemsPath as a raw prefix without requiring a / separator.
• Update coverage tests to assert an error for the no-slash-separator case (items3 vs items).
• Minor test comment cleanups (remove coverage-percentage notes / improve wording).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
internal/difc/path_labels.go	Enforces strict itemsPath + "/" matching when extracting an index from a JSON Pointer path.
internal/difc/path_labels_coverage_test.go	Updates/renames a test to validate the corrected no-slash-separator behavior; clarifies resolve caching test comments.
internal/difc/labels_test.go	Minor comment cleanup and formatting in TestLabel_Intersect.
internal/difc/agent_test.go	Minor comment cleanup in TestAgentLabels_AddIntegrityTags.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.