[test] Add tests for guard.WasmGuard.LabelResponse

[github-actions]

Test Coverage Improvement: WasmGuard.LabelResponse

Function Analyzed

• Package: internal/guard
• Function: WasmGuard.LabelResponse (wasm.go:610)
• Previous Coverage: 59.1%
• New Coverage: 100.0%
• Guard package overall: 92.5% → 93.6%
• Complexity: High (multiple nested branches, WASM-invocation, JSON response parsing)

Why This Function?

WasmGuard.LabelResponse had the lowest coverage (59.1%) of any non-trivial function in the testable guard package. It contains three groups of uncovered branches: (1) context request-state extraction, (2) capabilities injection, and (3) three distinct JSON-response-parsing paths that each route to a different code path or final return.

Tests Added

• ✅ Context state with tool_args — exercises lines 619-621 (state map extraction)
• ✅ Non-map context state ignored — exercises line 619 false branch
• ✅ Non-nil *difc.Capabilities — exercises the caps != nil branch (line 626)
• ✅ Both state and capabilities together — combined input-preparation path
• ✅ labeled_paths JSON response — exercises parsePathLabeledResponse path (lines 647-649)
• ✅ items JSON response — exercises parseCollectionLabeledData path (lines 652-654), verifies returned *CollectionLabeledData
• ✅ Empty-object JSON response — exercises the final return nil, nil (line 657)

WASM Fixtures

Three new WASM binary fixtures write specific JSON payloads to the output buffer at runtime using i32.store instructions (4-byte little-endian stores, consistent with existing test WASM patterns):

Fixture	JSON Written	Purpose
labelResponseWritesEmptyObjectWasm	{}	No-labeling final return
labelResponseWritesItemsWasm	{"items":[{"data":"x"}]}	Items-based labeling path
labelResponseWritesLabeledPathsWasm	{"labeled_paths":[],"items_path":"/items"}	Path-based labeling path

Coverage Report

Before: WasmGuard.LabelResponse  59.1%
After:  WasmGuard.LabelResponse  100.0%
Improvement: +40.9%

Guard package: 92.5% → 93.6%

Test Execution

All 7 new tests pass:

--- PASS: TestLabelResponse_ContextStateWithToolArgs
--- PASS: TestLabelResponse_ContextStateNonMapIsIgnored
--- PASS: TestLabelResponse_WithCapabilities
--- PASS: TestLabelResponse_NoLabelingResponse
--- PASS: TestLabelResponse_ItemsResponse
--- PASS: TestLabelResponse_LabeledPathsResponse
--- PASS: TestLabelResponse_ContextStateAndCapabilities
PASS
ok  github.com/github/gh-aw-mcpg/internal/guard  0.015s  coverage: 93.6% of statements

---

Generated by Test Coverage Improver
Next run will target the next most complex under-tested function

Warning

Firewall blocked 11 domains

The following domains were blocked by the firewall during workflow execution:

• athens.azurefd.net
• go.opentelemetry.io
• go.yaml.in
• golang.org
• google.golang.org
• gopkg.in
• goproxy.cn
• goproxy.io
• mirrors.aliyun.com
• proxy.golang.org
• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "athens.azurefd.net"
    - "go.opentelemetry.io"
    - "go.yaml.in"
    - "golang.org"
    - "google.golang.org"
    - "gopkg.in"
    - "goproxy.cn"
    - "goproxy.io"
    - "mirrors.aliyun.com"
    - "proxy.golang.org"
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Generated by Test Coverage Improver · 707.6 AIC · ⊞ 7.1K · ◷

[Copilot]

Pull request overview

Adds targeted unit tests in internal/guard to raise coverage for WasmGuard.LabelResponse, exercising its early-return, JSON parsing, and path/collection labeling branches using minimal WASM bytecode fixtures.

Changes:

• Introduces new LabelResponse coverage-focused tests for empty result, {} (no-labeling), "items" response parsing, and "labeled_paths" error propagation.
• Adds three new embedded WASM fixtures that write specific JSON payloads to the output buffer to drive the different LabelResponse parsing paths.
• Adds tests intended to cover context request-state extraction (tool_args) and capability injection paths.

Show a summary per file

File	Description
internal/guard/wasm_label_response_coverage_test.go	New tests + WASM fixtures to exercise WasmGuard.LabelResponse branches and improve guard package coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Low

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Both review points have been addressed:

1. WAT source comments — Added // Compiled from: WAT blocks to all three existing fixtures (labelResponseWritesEmptyObjectWasm, labelResponseWritesItemsWasm, labelResponseWritesLabeledPathsWasm) matching the pattern used elsewhere in the package.

2. Input-preparation tests now validate actual behavior — Added a new fixture labelResponseWritesItemsIfInputLargeWasm that produces {"items":[{"data":"x"}]} only when inLen > 50, otherwise {}. The baseline input ({"tool_name":"my_tool","tool_result":null}) is 42 bytes. Adding tool_args pushes it to 72 bytes, capabilities to 60 bytes, both to 97 bytes. The four input-preparation tests now assert require.NotNil on the result (input was injected → WASM returns items → non-nil) vs require.Nil for the non-map-state test (injection skipped → WASM returns {} → nil). These assertions will fail if the injection logic is removed.