[Repo Assist] refactor(proxy): extract writeDIFCForbidden helper

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Extracts a writeDIFCForbidden package-level helper in internal/proxy/handler.go, replacing two inline httputil.WriteJSONResponse 403 calls that used an identical map[string]string{"message": ...} body shape.

Problem

As identified in #3053, handler.go had two near-identical inline 403 response blocks for DIFC policy violations (Phase 2 write-blocked and Phase 5 strict-mode block). If the response shape for DIFC violations changes (e.g. adding a code field), both call sites would need to be updated separately.

Change

Added writeDIFCForbidden(w http.ResponseWriter, message string) — a small private helper that centralises the DIFC 403 response — and replaced the two inline call sites with it.

// Before (duplicated in two places):
httputil.WriteJSONResponse(w, http.StatusForbidden, map[string]string{
    "message": fmt.Sprintf("DIFC policy violation: %s", reason),
})

// After:
writeDIFCForbidden(w, fmt.Sprintf("DIFC policy violation: %s", reason))

No behaviour change. The third 403 response in handler.go (line ~71, GraphQL shape with errors + data fields) uses a different body structure and is intentionally left as-is.

Test Status

⚠️ Infrastructure limitation: The CI build environment cannot download Go modules (network proxy access is blocked), so make agent-finished could not be run. The changes are:

• Syntactically valid (gofmt clean)
• No new imports added
• Pure refactor — zero behaviour change

Closes #3053

Generated by Repo Assist · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

This PR refactors internal/proxy/handler.go to reduce duplicate DIFC 403 response handling by extracting a small helper function.

Changes:

• Added a private writeDIFCForbidden(w, message) helper to centralize DIFC policy violation 403 JSON responses.
• Replaced two duplicated inline httputil.WriteJSONResponse(..., http.StatusForbidden, map[string]string{"message": ...}) blocks with calls to the new helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.