fix: resolve duplicate test functions, nil panic, and missing Makefile target (#2267)

## Problem

Main is broken — `make test` fails due to 3 issues introduced by recent
PRs:

1. **Duplicate test functions** in `internal/server/` — PR #2092 and
#2096 both added `validAllowOnlyPolicy()` and overlapping
`TestNormalizeScopeKind_*` tests
2. **Nil pointer dereference** in `ParseToolArguments` — PR #2061 added
a log line that accesses `req.Params.Name` before the nil check
3. **Missing Makefile target** — `test-container-proxy` target and
container test file were lost in the squash merge of PR #2231

## Fixes

- Remove duplicate `validAllowOnlyPolicy()` from
`resolve_guard_policy_test.go` (keep `ensure_guard_initialized_test.go`
version)
- Remove duplicate `TestNormalizeScopeKind_*` tests from
`ensure_guard_initialized_test.go` (keep the more comprehensive set in
`resolve_guard_policy_test.go`)
- Fix test using string repos pattern (`"github/gh-aw*"`) — must be
`[]interface{}` array
- Fix assertion expecting `"approved"` — now correctly matches the
shared helper's `IntegrityNone`
- Move `ParseToolArguments` log line after the nil check
- Restore `test-container-proxy` Makefile target and
`proxy_container_test.go` (8 container integration tests)

## Verification

- `make agent-finished` ✅ all checks pass
- `make test-container-proxy` ✅ 7 pass, 1 skip (macOS gh CLI TLS —
expected)

Author: lpcox

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build lint test test-unit test-integration test-all test-serena test-serena-gateway coverage test-ci format clean install release help agent-finished
+.PHONY: build lint test test-unit test-integration test-container-proxy test-all test-serena test-serena-gateway coverage test-ci format clean install release help agent-finished
 
 # Default target
 .DEFAULT_GOAL := help
@@ -60,6 +60,14 @@ test-integration:
 	fi
 	@go test -v ./test/integration/...
 
+# Run container proxy integration tests (requires Docker and gh CLI)
+test-container-proxy:
+	@echo "Running container proxy integration tests..."
+	@echo "This will build a Docker image and test proxy mode with TLS."
+	@echo "Requires: Docker daemon, GitHub token (GITHUB_TOKEN, GH_TOKEN, or gh auth login)"
+	@echo ""
+	@go test -v -tags=container -run TestContainerProxy -timeout 10m ./test/integration/...
+
 # Run format, build, lint, and all tests (for agents before completion)
 # Optimized: single go mod tidy, no redundant clean/vet/gofmt-check
 agent-finished:

internal/mcp/tool_result.go

@@ -108,16 +108,16 @@ func ConvertToCallToolResult(data interface{}) (*sdk.CallToolResult, error) {
 // ParseToolArguments extracts and unmarshals tool arguments from a CallToolRequest.
 // Returns the parsed arguments as a map, or an error if parsing fails.
 func ParseToolArguments(req *sdk.CallToolRequest) (map[string]interface{}, error) {
-	logToolResult.Printf("Parsing arguments for tool: %s", req.Params.Name)
 	var toolArgs map[string]interface{}
 	if req.Params != nil && req.Params.Arguments != nil {
+		logToolResult.Printf("Parsing arguments for tool: %s", req.Params.Name)
 		if err := json.Unmarshal(req.Params.Arguments, &toolArgs); err != nil {
 			return nil, fmt.Errorf("failed to parse arguments: %w", err)
 		}
 	} else {
 		// No arguments provided, use empty map
 		toolArgs = make(map[string]interface{})
 	}
-	logToolResult.Printf("Parsed %d arguments for tool: %s", len(toolArgs), req.Params.Name)
+	logToolResult.Printf("Parsed %d arguments", len(toolArgs))
 	return toolArgs, nil
 }

internal/server/ensure_guard_initialized_test.go

@@ -93,77 +93,8 @@ func validAllowOnlyPolicy() *config.GuardPolicy {
 	}
 }
 
-// ─── normalizeScopeKind ───────────────────────────────────────────────────────
-
-func TestNormalizeScopeKind_Nil(t *testing.T) {
-	result := normalizeScopeKind(nil)
-	assert.Nil(t, result)
-}
-
-func TestNormalizeScopeKind_EmptyMap(t *testing.T) {
-	result := normalizeScopeKind(map[string]interface{}{})
-	require.NotNil(t, result)
-	assert.Empty(t, result)
-}
-
-func TestNormalizeScopeKind_NoScopeKindField(t *testing.T) {
-	input := map[string]interface{}{
-		"min-integrity": "none",
-		"repos":         "public",
-	}
-	result := normalizeScopeKind(input)
-	require.NotNil(t, result)
-	assert.Equal(t, "none", result["min-integrity"])
-	assert.Equal(t, "public", result["repos"])
-	assert.NotContains(t, result, "scope_kind")
-}
-
-func TestNormalizeScopeKind_ScopeKindAlreadyLowercase(t *testing.T) {
-	input := map[string]interface{}{
-		"scope_kind": "composite",
-	}
-	result := normalizeScopeKind(input)
-	assert.Equal(t, "composite", result["scope_kind"])
-}
-
-func TestNormalizeScopeKind_ScopeKindUppercase(t *testing.T) {
-	input := map[string]interface{}{
-		"scope_kind": "COMPOSITE",
-	}
-	result := normalizeScopeKind(input)
-	assert.Equal(t, "composite", result["scope_kind"])
-}
-
-func TestNormalizeScopeKind_ScopeKindMixedCaseWithWhitespace(t *testing.T) {
-	input := map[string]interface{}{
-		"scope_kind": "  Scoped  ",
-	}
-	result := normalizeScopeKind(input)
-	assert.Equal(t, "scoped", result["scope_kind"])
-}
-
-func TestNormalizeScopeKind_NonStringScopeKind(t *testing.T) {
-	// Non-string values must be preserved as-is (the type assertion fails silently).
-	input := map[string]interface{}{
-		"scope_kind": 42,
-		"other":      "value",
-	}
-	result := normalizeScopeKind(input)
-	assert.Equal(t, 42, result["scope_kind"])
-	assert.Equal(t, "value", result["other"])
-}
-
-func TestNormalizeScopeKind_DoesNotMutateInput(t *testing.T) {
-	input := map[string]interface{}{
-		"scope_kind": "Composite",
-	}
-	original := input["scope_kind"]
-	normalizeScopeKind(input)
-	// The original map must not be modified — normalizeScopeKind returns a copy.
-	assert.Equal(t, original, input["scope_kind"])
-}
-
 // ─── ensureGuardInitialized ───────────────────────────────────────────────────
+// normalizeScopeKind tests live in resolve_guard_policy_test.go
 
 // TestEnsureGuardInitialized_PolicyNil checks that when resolveGuardPolicy returns nil
 // (no guard policy configured for the server) the evaluator default mode is returned.

internal/server/resolve_guard_policy_test.go

@@ -8,17 +8,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// validAllowOnlyPolicy returns a valid AllowOnly guard policy for use in tests.
-// Uses repos="all" which is one of the two accepted string values ("all" or "public").
-func validAllowOnlyPolicy() *config.GuardPolicy {
-	return &config.GuardPolicy{
-		AllowOnly: &config.AllowOnlyPolicy{
-			Repos:        "all",
-			MinIntegrity: "approved",
-		},
-	}
-}
-
 // validWriteSinkPolicy returns a valid WriteSink guard policy for use in tests.
 func validWriteSinkPolicy() *config.GuardPolicy {
 	return &config.GuardPolicy{
@@ -234,7 +223,7 @@ func TestResolveGuardPolicy_ServerWithValidGuardPolicies(t *testing.T) {
 				GuardPolicies: map[string]interface{}{
 					"allow-only": map[string]interface{}{
 						"min-integrity": "approved",
-						"repos":         "github/gh-aw*",
+						"repos":         []interface{}{"github/gh-aw*"},
 					},
 				},
 			},
@@ -387,7 +376,7 @@ func TestResolveGuardPolicy_GuardFieldSet_ValidGuardPolicy(t *testing.T) {
 	require.NotNil(t, policy)
 	assert.Equal(t, "config", source)
 	require.NotNil(t, policy.AllowOnly)
-	assert.Equal(t, "approved", policy.AllowOnly.MinIntegrity)
+	assert.Equal(t, config.IntegrityNone, policy.AllowOnly.MinIntegrity)
 }
 
 func TestResolveGuardPolicy_GuardFieldSet_WriteSinkGuardPolicy(t *testing.T) {