[test] Add tests for guard.callWasmFunction buffer retry logic

[github-actions]

Test Coverage Improvement: callWasmFunction

Function Analyzed

• Package: internal/guard
• Function: callWasmFunction (in wasm_parse.go)
• Previous Coverage: 0% (test was t.Skip'd with TODO)
• Complexity: High — adaptive retry loop with buffer-size protocol, multiple error paths, WASM trap detection

Why This Function?

TestBufferRetryLogic was explicitly skipped in wasm_test.go with:

t.Skip("TODO: implement buffer retry behavior test against callWasmFunction/tryCallWasmFunction")

callWasmFunction was recently added as part of the oversized WASM call_backend response handling (size-hint protocol + larger guard buffers). It has high cyclomatic complexity with a 3-attempt retry loop, two distinct growth strategies (hint-based and doubling), a hard 16MB ceiling, and permanent-failure semantics on WASM traps.

Tests Added

• ✅ Function not exported from WASM module → "not exported from WASM module" error
• ✅ Module has no memory section → "WASM module has no memory" error
• ✅ Input exceeds 8MB maximum → "input too large" error (fires before any WASM call)
• ✅ Buffer doubling exhausts 16MB cap → "exceeds maximum" error after 3 retries (4MB→8MB→16MB→32MB>cap)
• ✅ Size-hint retry path → WASM returns 5MB hint on first call, retries with 5MB buffer, succeeds with empty output
• ✅ Failed guard (prior trap) → immediately returns "unavailable after a previous trap" error wrapping original

New WASM Fixtures

Three new minimal WASM binary fixtures added alongside the test:

Fixture	Behaviour
alwaysNeg2GuardWasm	Exports label_agent+memory; always returns −2 with no hint
retryWithHint5MBGuardWasm	Returns −2 with 5 242 880-byte hint until buffer ≥ 5 MB, then returns 0
funcNoMemoryGuardWasm	Exports label_agent but has no memory section

Test Execution

Tests were verified to parse correctly with gofmt -e. Full execution requires Go 1.25.0 toolchain (the environment only has 1.24.13 with a blocked module proxy).

---

Generated by Test Coverage Improver

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Test Coverage Improver · ● 11.4M · ◷

[Copilot]

Pull request overview

Adds concrete unit tests for internal/guard.(*WasmGuard).callWasmFunction to cover its adaptive buffer-retry behavior and key error paths, replacing the previously skipped TODO test. This improves confidence in the guard’s size-hint protocol handling, buffer growth strategy, and permanent-failure semantics after traps.

Changes:

• Added three minimal WASM binary fixtures to deterministically exercise retry behaviors (no-hint doubling, size-hint retry, and “no memory” module).
• Implemented TestBufferRetryLogic subtests covering: missing export, missing memory, max input rejection, buffer cap exhaustion, size-hint retry success, and failed-guard immediate refusal.

Show a summary per file

File	Description
internal/guard/wasm_test.go	Adds new WASM fixtures and replaces the skipped retry-logic test with subtests validating callWasmFunction retry/error behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1