[Repo Assist] refactor: simplify TruncateSecret and extract HTTP client clone helper

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Two small, low-risk refactors that reduce code duplication and cross-package coupling.

1. internal/sanitize: Inline TruncateSecret logic

Previously, TruncateSecret delegated to util.TruncateWithSuffix(input, 4, "...") for the len > 4 case. That cross-package call was unnecessary: the operation is just input[:4] + "...", a single expression that is more readable than the indirection.

Changes:

• Remove import of internal/util from sanitize package
• Replace util.TruncateWithSuffix(input, 4, "...") with input[:prefixLen] + "..."
• Introduce named constant prefixLen = 4 for clarity
• Behaviour is identical for all inputs

2. internal/mcp: Extract cloneHTTPClientWithTransport / resolveBaseTransport helpers

buildHTTPClientWithHeaders and buildHTTPClientWithOIDC shared an identical 4-line pattern:

base := baseClient.Transport
if base == nil {
    base = http.DefaultTransport
}
clone := *baseClient
clone.Transport = <new transport>
return &clone

This pattern was identified as duplicate code in issue #9100. The helpers centralise this idiom, making each builder function a concise 2–3 liner.

Trade-offs

• Both changes are purely mechanical refactors with no behavioural change.
• The sanitize change removes a dependency edge (sanitize → util), which slightly reduces coupling.
• The mcp change adds two tiny unexported helpers; they are package-private and easy to remove if the transport logic ever diverges.

Test Status

Network access to proxy.golang.org is blocked in this sandbox, preventing go build and go test from downloading modules. The changes are syntactically valid (confirmed with gofmt -l). Both modified functions are covered by existing tests (sanitize_test.go, http_transport_client_test.go) which will run in CI.

Partially addresses #9100 (the per-logger boilerplate pattern in #9099 is a separate, larger refactor).

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · 240.5 AIC · ⊞ 10.8K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

Refactors secret truncation and HTTP client transport wrapping without changing behavior.

Changes:

• Inlines four-byte secret truncation.
• Extracts HTTP client cloning and transport resolution helpers.

Show a summary per file

File	Description
internal/sanitize/sanitize.go	Removes unnecessary utility dependency.
internal/mcp/http_transport_client.go	Deduplicates HTTP client wrapping logic.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium