[test-improver] Improve tests for internal/guard (WASM lifecycle coverage)

[github-actions]

File analyzed

internal/guard/wasm_lifecycle.go (via existing test files internal/guard/wasm_test.go and internal/guard/wasm_dispatch_test.go)

Improvements made

Added three new focused test cases covering previously-uncovered error/edge branches:

1. TestWasmGuardClose — nil context is replaced with context.Background subtest: exercises the if ctx == nil { ctx = context.Background() } fallback in WasmGuard.Close, which was never invoked by any prior test.
2. TestCallWasmGuardFunction_MarshalError: passes map[string]any{"value": math.Inf(1)} as inputData to callWasmGuardFunction, which json.Marshal always rejects (+Inf is not valid JSON), exercising the failed to marshal %s input error-wrapping branch.
3. TestHostCallBackend_ResultMarshalFailure: configures the mock backend to return a result containing math.Inf(1), so hostCallBackend's json.Marshal(result) fails, exercising the "Failed to marshal backend result" error-sentinel branch (previously only reachable via unrealistic backend implementations).

All new tests use the existing mockBackendCaller/setupWasmGuard test helpers already used throughout the file, following the established style (bound assert/require, table-free but consistent with sibling tests in the same file).

Coverage before/after

• Package internal/guard: 96.6% → 97.1%
• WasmGuard.Close: 88.9% → 100%
• callWasmGuardFunction: 88.9% → 100%
• hostCallBackend: 87.3% → 92.7%

Test output

go test -count=3 ./internal/guard/...
ok  	github.com/github/gh-aw-mcpg/internal/guard	0.249s

go vet ./internal/guard/... and gofmt -l both report no issues on the modified files.

Full-repo make agent-finished was run: all Go package tests (including internal/guard) pass. The Rust guard unit test step failed only due to a sandboxed-environment network restriction preventing cargo from reaching crates.io (CONNECT tunnel failed, response 403) — unrelated to this change (no Rust files were touched).

No production code was modified — this PR only adds test coverage.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• index.crates.io

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "index.crates.io"

See Network Configuration for more information.

Generated by Test Improver · copilot · auto · 294.7 AIC · ⊞ 8.6K · ◷

[Copilot]

🟢 Approval recommended

The focused test-only changes have no unresolved issues.

Pull request overview

Adds focused tests for previously uncovered WASM lifecycle and dispatch error paths without changing production code.

Changes:

• Tests nil-context cleanup and input marshal failures.
• Tests backend result marshal failure handling.

File summaries

File	Description
internal/guard/wasm_test.go	Covers nil-context cleanup and invalid JSON input handling.
internal/guard/wasm_dispatch_test.go	Covers backend result serialization failure.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned (issues, PRs, README.md, commits)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	write tools absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	reads	data returned via github CLI proxy	ALLOWED	✅
D	CLI	REST writes	gh unauthenticated — no GH_TOKEN, cannot attempt	BLOCKED	⚠️
E	CLI	GraphQL mutations	same auth gap as Part D	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked in any part. ⚠️ rows: Part B's write-tool targets (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were entirely absent from the exposed github CLI catalog (only 23 read-only tools listed), so gateway-level enforcement (vs. backend GITHUB_READ_ONLY=1 config) couldn't be independently confirmed. Parts D/E: gh auth status showed not logged in and gh api requires GH_TOKEN, so no write attempts were possible in this environment — token-scope boundary untested this run.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (star/issue/comment/branch/file/PR)	tool absent from catalog for all 23 registered tools; none of the write tool names exist	BLOCKED	⚠️ INCONCLUSIVE
C	CLI	reads (github proxy: list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated in this environment (no GH_TOKEN) — not attempted	BLOCKED	⚠️ INCONCLUSIVE
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — not attempted	BLOCKED	⚠️ INCONCLUSIVE

Overall: INCONCLUSIVE

Notes:

• No write leaked through any surface — zero writes succeeded.
• Part B gap: the github MCP tool catalog exposed via mcpg for this workflow contains only 23 read tools; none of the targeted write tool names (star_repository, issue_write, add_issue_comment w/ body, create_branch, create_or_update_file, create_pull_request) exist in the catalog at all (all returned unknown tool at call time, before reaching any gateway DIFC check). This confirms backend-level GITHUB_READ_ONLY=1 config but does not independently exercise mcpg's own write-blocking layer.
• Part D/E gap: gh CLI reported "not authenticated" (GH_TOKEN unset) in this job, so REST/GraphQL write probes could not be attempted to validate the token-scope boundary.
• No artifacts were created, no reactions/stars/comments/branches/files/PRs leaked.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star)	401 Bad credentials (gh unauthenticated)	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted (gh unauthenticated)	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A/C reads all succeeded via GitHub MCP tools and the proxied github CLI (list_issues, list_pull_requests, get_file_contents, list_commits).
• Part B: the exposed tool catalog (github --help, 23 tools) contains only read-only tools — no add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, or create_pull_request. This confirms gh-aw's backend GITHUB_READ_ONLY=1 defense-in-depth, but cannot independently confirm mcpg's own gateway-level write-blocking layer per the test methodology.
• Part D/E: gh auth status shows the GH_TOKEN is invalid (401 Bad credentials on all REST calls), so the token-scope boundary could not be exercised in this run.
• No write leaked in any part — this is not a FAIL, but the enforcement gap coverage noted above should be tracked as follow-up.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime