[test] Add tests for guard.WasmGuard.LabelResponse

[github-actions]

Test Coverage Improvement: WasmGuard.LabelResponse

Function Analyzed

• Package: internal/guard
• Function: WasmGuard.LabelResponse (wasm.go:610)
• Previous Coverage: 59.1%
• New Coverage: 100.0%
• Guard package overall: 92.5% → 93.6%
• Complexity: High (multiple nested branches, WASM-invocation, JSON response parsing)

Why This Function?

WasmGuard.LabelResponse had the lowest coverage (59.1%) of any non-trivial function in the testable guard package. It contains three groups of uncovered branches: (1) context request-state extraction, (2) capabilities injection, and (3) three distinct JSON-response-parsing paths that each route to a different code path or final return.

Tests Added

• ✅ Context state with tool_args — exercises lines 619-621 (state map extraction)
• ✅ Non-map context state ignored — exercises line 619 false branch
• ✅ Non-nil *difc.Capabilities — exercises the caps != nil branch (line 626)
• ✅ Both state and capabilities together — combined input-preparation path
• ✅ labeled_paths JSON response — exercises parsePathLabeledResponse path (lines 647-649)
• ✅ items JSON response — exercises parseCollectionLabeledData path (lines 652-654), verifies returned *CollectionLabeledData
• ✅ Empty-object JSON response — exercises the final return nil, nil (line 657)

WASM Fixtures

Three new WASM binary fixtures write specific JSON payloads to the output buffer at runtime using i32.store instructions (4-byte little-endian stores, consistent with existing test WASM patterns):

Fixture	JSON Written	Purpose
labelResponseWritesEmptyObjectWasm	{}	No-labeling final return
labelResponseWritesItemsWasm	{"items":[{"data":"x"}]}	Items-based labeling path
labelResponseWritesLabeledPathsWasm	{"labeled_paths":[],"items_path":"/items"}	Path-based labeling path

Coverage Report

Before: WasmGuard.LabelResponse  59.1%
After:  WasmGuard.LabelResponse  100.0%
Improvement: +40.9%

Guard package: 92.5% → 93.6%

Test Execution

All 7 new tests pass:

--- PASS: TestLabelResponse_ContextStateWithToolArgs
--- PASS: TestLabelResponse_ContextStateNonMapIsIgnored
--- PASS: TestLabelResponse_WithCapabilities
--- PASS: TestLabelResponse_NoLabelingResponse
--- PASS: TestLabelResponse_ItemsResponse
--- PASS: TestLabelResponse_LabeledPathsResponse
--- PASS: TestLabelResponse_ContextStateAndCapabilities
PASS
ok  github.com/github/gh-aw-mcpg/internal/guard  0.015s  coverage: 93.6% of statements

---

Generated by Test Coverage Improver
Next run will target the next most complex under-tested function

Warning

Firewall blocked 11 domains

The following domains were blocked by the firewall during workflow execution:

• athens.azurefd.net
• go.opentelemetry.io
• go.yaml.in
• golang.org
• google.golang.org
• gopkg.in
• goproxy.cn
• goproxy.io
• mirrors.aliyun.com
• proxy.golang.org
• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "athens.azurefd.net"
    - "go.opentelemetry.io"
    - "go.yaml.in"
    - "golang.org"
    - "google.golang.org"
    - "gopkg.in"
    - "goproxy.cn"
    - "goproxy.io"
    - "mirrors.aliyun.com"
    - "proxy.golang.org"
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Generated by Test Coverage Improver · 707.6 AIC · ⊞ 7.1K · ◷