From 1f20322aea65ad4e15e48dad5e410e2e9f4b5935 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 23:54:36 +0000
Subject: [PATCH 1/2] Improve tests for guard package: cover WASM
 alloc/dealloc/call error paths

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 internal/guard/wasm_parse_coverage_test.go | 62 ++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/internal/guard/wasm_parse_coverage_test.go b/internal/guard/wasm_parse_coverage_test.go
index 5a80bf702..dfa2fd570 100644
--- a/internal/guard/wasm_parse_coverage_test.go
+++ b/internal/guard/wasm_parse_coverage_test.go
@@ -265,3 +265,65 @@ func TestWasmMemorySize_NilMemory(t *testing.T) {
 	assert.False(t, ok, "nil memory should return ok=false")
 	assert.Equal(t, uint32(0), size, "nil memory should return size=0")
 }
+
+// TestWasmAlloc_CallError covers the error path in wasmAlloc when the
+// underlying allocFn.Call itself returns an error (e.g. because the module
+// has already been closed), as opposed to returning a null pointer or no
+// result.
+func TestWasmAlloc_CallError(t *testing.T) {
+	g, cleanup := setupWasmGuard(t, allocGuardWasm, "alloc-call-error-test")
+	defer cleanup() // closing an already-closed module is a documented no-op
+
+	allocFn := g.module.ExportedFunction("alloc")
+	require.NotNil(t, allocFn)
+
+	// Close the module to force fn.Call to fail, then verify wasmAlloc
+	// surfaces that error rather than panicking.
+	ctx := context.Background()
+	require.NoError(t, g.module.Close(ctx))
+
+	_, err := g.wasmAlloc(ctx, allocFn, 4)
+	require.Error(t, err, "calling alloc on a closed module should return an error")
+}
+
+// TestWasmDealloc_CallErrorIsLoggedNotPanicked covers the error-logging branch
+// in wasmDealloc (when deallocFn.Call returns an error) and verifies it does
+// not panic.
+func TestWasmDealloc_CallErrorIsLoggedNotPanicked(t *testing.T) {
+	g, cleanup := setupWasmGuard(t, allocGuardWasm, "dealloc-call-error-test")
+	defer cleanup() // closing an already-closed module is a documented no-op
+
+	deallocFn := g.module.ExportedFunction("dealloc")
+	require.NotNil(t, deallocFn)
+
+	ctx := context.Background()
+	require.NoError(t, g.module.Close(ctx))
+
+	// Should not panic even though the underlying call fails because the
+	// module has been closed.
+	assert.NotPanics(t, func() {
+		g.wasmDealloc(ctx, deallocFn, 256, 128)
+	})
+}
+
+// TestDecodeWasmCallResult_FunctionCallError covers the branch in
+// decodeWasmCallResult where fn.Call itself returns an error (e.g. because
+// the module has been closed), distinct from the module returning a negative
+// result code.
+func TestDecodeWasmCallResult_FunctionCallError(t *testing.T) {
+	g, cleanup := setupWasmGuard(t, allocGuardWasm, "decode-call-error-test")
+	defer cleanup() // closing an already-closed module is a documented no-op
+
+	fn := g.module.ExportedFunction("label_agent")
+	mem := g.module.Memory()
+	require.NotNil(t, fn)
+	require.NotNil(t, mem)
+
+	ctx := context.Background()
+	require.NoError(t, g.module.Close(ctx))
+
+	_, requiredSize, err := decodeWasmCallResult(ctx, fn, mem, 0, 0, 256, 4096)
+	require.Error(t, err, "calling a function on a closed module should return an error")
+	assert.ErrorContains(t, err, "WASM function call failed")
+	assert.Equal(t, uint32(0), requiredSize)
+}

From 93597fe1f71f5b80d2d6c6b79cbfa399e41e1f48 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Sun, 16 Aug 2026 08:59:05 -0700
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 internal/guard/wasm_parse_coverage_test.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/internal/guard/wasm_parse_coverage_test.go b/internal/guard/wasm_parse_coverage_test.go
index dfa2fd570..8e0dae1d3 100644
--- a/internal/guard/wasm_parse_coverage_test.go
+++ b/internal/guard/wasm_parse_coverage_test.go
@@ -286,10 +286,10 @@ func TestWasmAlloc_CallError(t *testing.T) {
 	require.Error(t, err, "calling alloc on a closed module should return an error")
 }
 
-// TestWasmDealloc_CallErrorIsLoggedNotPanicked covers the error-logging branch
-// in wasmDealloc (when deallocFn.Call returns an error) and verifies it does
+// TestWasmDealloc_CallErrorDoesNotPanic covers the call-error branch in
+// wasmDealloc (when deallocFn.Call returns an error) and verifies it does
 // not panic.
-func TestWasmDealloc_CallErrorIsLoggedNotPanicked(t *testing.T) {
+func TestWasmDealloc_CallErrorDoesNotPanic(t *testing.T) {
 	g, cleanup := setupWasmGuard(t, allocGuardWasm, "dealloc-call-error-test")
 	defer cleanup() // closing an already-closed module is a documented no-op