extract shared marshal debug helper

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/ac7dc66f-a385-4612-8f8a-66a15160508c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

internal/guard/wasm.go

@@ -20,15 +20,6 @@ import (
 
 var logWasm = logger.New("guard:wasm")
 
-func logMarshaledForDebug(value interface{}, onMarshalSuccess func(string), onMarshalFailure func(error)) {
-	resultJSON, err := json.Marshal(value)
-	if err != nil {
-		onMarshalFailure(err)
-		return
-	}
-	onMarshalSuccess(string(resultJSON))
-}
-
 // globalCompilationCache is a process-level compilation cache shared across all
 // WasmGuard instances. wazero's cache is goroutine-safe and eliminates redundant
 // JIT compilation when multiple guards load the same WASM binary.
@@ -704,7 +695,7 @@ func (g *WasmGuard) LabelAgent(ctx context.Context, policy interface{}, backend
 		logWasm.Printf("LabelAgent normalizePolicyPayload failed: guard=%s, error=%v", g.name, err)
 		return nil, err
 	}
-	logMarshaledForDebug(
+	logger.LogMarshaledForDebug(
 		normalizedPolicy,
 		func(policyJSON string) {
 			logWasm.Printf("LabelAgent normalized policy: guard=%s, policy=%s", g.name, policyJSON)
@@ -739,7 +730,7 @@ func (g *WasmGuard) LabelAgent(ctx context.Context, policy interface{}, backend
 		return nil, err
 	}
 
-	logMarshaledForDebug(
+	logger.LogMarshaledForDebug(
 		result,
 		func(responseJSON string) {
 			logWasm.Printf("LabelAgent parsed response: guard=%s, response=%s", g.name, responseJSON)

internal/logger/marshal_debug.go

@@ -0,0 +1,14 @@
+package logger
+
+import "encoding/json"
+
+// LogMarshaledForDebug marshals value for debug logging and dispatches to the
+// provided callbacks for success or marshal failure paths.
+func LogMarshaledForDebug(value interface{}, onMarshalSuccess func(string), onMarshalFailure func(error)) {
+	resultJSON, err := json.Marshal(value)
+	if err != nil {
+		onMarshalFailure(err)
+		return
+	}
+	onMarshalSuccess(string(resultJSON))
+}

internal/logger/marshal_debug_test.go

@@ -0,0 +1,54 @@
+package logger
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogMarshaledForDebug_Success(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	var (
+		gotJSON       string
+		gotMarshalErr error
+	)
+
+	LogMarshaledForDebug(
+		map[string]string{"status": "ok"},
+		func(resultJSON string) {
+			gotJSON = resultJSON
+		},
+		func(err error) {
+			gotMarshalErr = err
+		},
+	)
+
+	require.NoError(gotMarshalErr)
+	assert.JSONEq(`{"status":"ok"}`, gotJSON)
+}
+
+func TestLogMarshaledForDebug_MarshalFailure(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	var (
+		gotJSON       string
+		gotMarshalErr error
+	)
+
+	LogMarshaledForDebug(
+		make(chan int),
+		func(resultJSON string) {
+			gotJSON = resultJSON
+		},
+		func(err error) {
+			gotMarshalErr = err
+		},
+	)
+
+	require.Error(gotMarshalErr)
+	assert.Empty(gotJSON)
+}

internal/server/guard_init.go

@@ -17,15 +17,6 @@ import (
 
 var logGuardInit = logger.New("server:guard_init")
 
-func logMarshaledForDebug(value interface{}, onMarshalSuccess func(string), onMarshalFailure func(error)) {
-	resultJSON, err := json.Marshal(value)
-	if err != nil {
-		onMarshalFailure(err)
-		return
-	}
-	onMarshalSuccess(string(resultJSON))
-}
-
 // hasServerGuardPolicies reports whether any server in cfg has per-server guard policies
 // configured. This is used during DIFC auto-detection to enable enforcement when policies
 // are present even if no non-noop guard was registered (e.g., guard missing or failed to load).
@@ -360,7 +351,7 @@ func (us *UnifiedServer) ensureGuardInitialized(
 		log.Printf("[DIFC] label_agent returned nil result: server=%s, session=%s, guard=%s", serverID, sessionID, g.Name())
 		return defaultMode, fmt.Errorf("label_agent returned nil result")
 	}
-	logMarshaledForDebug(
+	logger.LogMarshaledForDebug(
 		labelAgentResult,
 		func(resultJSON string) {
 			log.Printf("[DIFC] label_agent response: server=%s, session=%s, guard=%s, response=%s", serverID, sessionID, g.Name(), resultJSON)