[Coverage Report] Test Coverage Report — 2026-08-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-09

Overall Coverage

Metric	Coverage	Trend
Statements	93.1%	✅ Excellent
Branches	86.33%	✅ Good
Functions	94.47%	✅ Excellent
Lines	94.12%	✅ Excellent

The project maintains strong overall test coverage with 93.1% statement coverage and 94.47% function coverage, indicating comprehensive test suite for the firewall orchestration layer.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Status	Priority
src/host-iptables-rules.ts	100%	100%	🟢 SECURE	—
src/host-iptables-chain.ts	100%	100%	🟢 SECURE	—
src/host-iptables-cleanup.ts	100%	100%	🟢 SECURE	—
src/domain-patterns.ts	100%	89.47%	🟢 SECURE	—
src/domain-validation.ts	100%	100%	🟢 SECURE	—
src/docker-manager.ts	100%	100%	🟢 SECURE	—
src/squid-config.ts	100%	100%	🟢 SECURE	—
src/cli.ts	85.71%	50%	🟡 LOW	Medium
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL	High
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 LOW	High

Key observations:

• Core network isolation functions (host-iptables-*.ts) are 100% covered
• Domain filtering (domain-*.ts) is fully tested
• Container orchestration (docker-manager.ts) is fully tested
• CRITICAL GAP: finite-disclosure.ts has only 9.26% statement coverage and 0.26% branch coverage — this is the primary bounded execution module and requires immediate attention
• Enclave preflight checks need additional test coverage for branch logic

---

📋 Coverage Table

Files with < 80% Statement Coverage:

File	Statements	Branches	Functions	Issue
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	4.54%	Legacy bounded execution (being replaced by MCP enclaves)
src/enclave/runtime-preflight.ts	66.66%	41.02%	100%	New enclave feature, branch logic undertested
src/commands/main-action.ts	73.46%	67.44%	72.72%	CLI action routing logic
src/bounded-execution/sbx-ingress-capabilities.ts	68.42%	37.5%	60%	Capability injection (legacy)

High-coverage files (>95%):

• 89 files with 95%+ statement coverage
• Most security-critical files at 100% coverage
• Overall system well-tested for mainline scenarios

---

🔧 Function Audit

Audit of top-level functions in critical files:

• ✅ src/host-iptables-rules.ts: All 9 functions covered (iptables rule generation logic fully tested)
• ✅ src/domain-patterns.ts: All 3 functions covered (domain pattern matching logic fully tested)
• ✅ src/cli-workflow.ts: All 3 functions covered (CLI orchestration logic fully tested)
• ⚠️ src/cli.ts: 0/0 functions (re-exports only; integration coverage via CLI tests)
• 🟡 src/bounded-execution/finite-disclosure.ts: 2/44 functions covered (4.54%) — most finite disclosure logic untested
• 🟡 src/enclave/runtime-preflight.ts: 5/5 functions covered (100% function coverage) but 66.66% statement coverage — gap is in branch logic within functions

---

📅 Recent Source Changes (last 7 days)

Recent commits affecting coverage scope:

1. ✅ 2e67e92 — Add configurable --pids-limit and expose delegated cgroup (Aug 9)

   • Affects container resource management, no new security-critical paths added

2. ✅ ace59e2 — Drive Google provider adapters from specs (Aug 9)

   • API provider routing, existing coverage maintained

3. ✅ 60888fc — Confirm --allow-host-ports with --enable-host-access (Aug 8)

   • Network access validation, using existing tested paths

No recent changes to:

• src/host-iptables-*.ts (stable)
• src/squid-config.ts (stable)
• src/domain-*.ts (stable)

Recent activity in scope:

• 2bf9909 — Refactor: remove legacy bounded execution in favor of MCP enclaves (7 days ago)
  • Impact: src/bounded-execution/finite-disclosure.ts is legacy code being superseded by src/enclave/ — low coverage may be acceptable as feature is in transition

---

🔎 Notable Findings

1. 🔴 Legacy Bounded Execution Gap: src/bounded-execution/finite-disclosure.ts (9.26% statements) is a legacy feature being replaced by MCP enclaves. Per commit 2bf9909, this module is slated for removal. The low coverage is a symptom of deprecation, not an active security risk if the feature is not in use. Recommend: Confirm this module is deprecated in docs; if still active, prioritize test coverage.

2. 🟡 Enclave Runtime Preflight: src/enclave/runtime-preflight.ts (66.66% statements, 41.02% branches) is a new feature for unified enclaves. Functions are covered (100%) but branch paths within functions are undertested. Recommend: Add test cases for preflight validation error paths (DNS failures, timeout scenarios, capability negotiation edge cases).

3. 🟢 Security-Critical Path Well-Tested: All primary firewall components (host-iptables-*.ts, domain-*.ts, squid-config.ts, docker-manager.ts) achieve 100% statement coverage. Network isolation logic is production-ready from a test coverage perspective.

4. Branches vs. Statements Gap: Branch coverage (86.33%) is ~7% lower than statement coverage (93.1%). Most gaps are in error handling paths and conditional logic, which are lower-risk than critical security paths (e.g., the 50% branch coverage in src/cli.ts is a single uncovered branch in a re-export).

---

🎯 Recommendations

🔴 HIGH — Address Legacy Bounded Execution Coverage

• Action: Confirm whether src/bounded-execution/finite-disclosure.ts is still in use or fully deprecated
• If deprecated: Add a deprecation notice to the module and remove tests marked as legacy
• If active: Add test suite covering the remaining 90.74% of statement paths, focusing on finite-disclosure validation and rollout logic
• Timeline: Within next sprint (1–2 weeks) to clarify the module's status

🟡 MEDIUM — Expand Enclave Preflight Test Coverage

• Action: Add integration tests for src/enclave/runtime-preflight.ts covering:
  • Preflight validation success and failure paths
  • DNS server negotiation (IPv4, IPv6, custom resolvers)
  • Timeout and retry logic for MCP gateway readiness (AWF_ENCLAVE_MCP_READINESS_TIMEOUT_MS)
  • Capability injection edge cases
• Target: Increase branch coverage from 41% to >75%
• Rationale: Enclaves are a new feature; comprehensive branch coverage ensures reliability for unified private-repository support
• Timeline: 2–3 weeks (coordinate with enclave feature rollout)

🟡 MEDIUM — Improve Main Action CLI Routing

• Action: Add test cases for src/commands/main-action.ts covering:
  • Subcommand routing logic (each branch in switch statement)
  • Error handling for unrecognized subcommands
  • State transitions between subcommands
• Current coverage: 73.46% statements, 67.44% branches
• Target: >90% statement coverage
• Timeline: Within next sprint (low risk, incremental improvement)

---

📊 Coverage Trend

Summary:

• ✅ Overall: 93.1% statements, 86.33% branches — strong baseline
• ✅ Security-Critical: 100% for host-iptables, domain filtering, Docker management
• 🟡 Emerging Features: Enclaves (66.66%) need branch coverage expansion
• 🔴 Legacy: Bounded execution (9.26%) should be clarified as deprecated or prioritized

Next Steps:

1. Clarify deprecation status of finite-disclosure.ts
2. Expand enclave preflight tests (DNS, MCP readiness, capabilities)
3. Improve CLI routing test coverage incrementally
4. Monitor branch coverage gaps in error paths

---

Report Generated: 2026-08-09 18:02:22 UTC
Coverage Dataset: coverage/coverage-summary.json (post-test-run snapshot)

Generated by Test Coverage Reporter · sum00 · 24.2 AIC · ⊞ 5.1K · ◷

• expires on Aug 16, 2026, 6:05 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-16T18:05:37.825Z.

Closed by Workflow