[Coverage Report] Test Coverage Report — 2026-08-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-09

Overall Coverage

Repository-wide metrics (all files):

• Statements: 92.62% (8,014 / 8,652)
• Lines: 93.64% (7,694 / 8,216)
• Functions: 92.81% (1,046 / 1,127)
• Branches: 85.53% (4,300 / 5,027)

✅ Target Met: All primary metrics exceed 85% threshold.
⚠️ Branch Coverage: At 85.53%, this is the weakest metric and should be monitored for regressions.

---

🛡️ Security-Critical Path Status

Component	Lines	Functions	Statements	Branches	Status
host-iptables.ts	100%	100%	100%	100%	✅ Excellent
host-iptables-rules.ts	100%	100%	100%	100%	✅ Excellent
host-iptables-shared.ts	100%	100%	100%	100%	✅ Excellent
squid-config.ts	100%	100%	100%	0%	✅ No branches
domain-patterns.ts	100%	100%	100%	89.47%	✅ Strong
docker-manager.ts	100%	100%	100%	100%	✅ Excellent
bounded-execution/finite-disclosure.ts	11.49%	4.54%	9.26%	0.26%	🔴 CRITICAL
enclave/runtime-preflight.ts	67.56%	100%	70%	46.51%	⚠️ Medium
firecracker/manager.ts	76.54%	42.85%	72.09%	43.47%	⚠️ Medium
firecracker/preflight.ts	75.3%	80%	75%	65.51%	⚠️ Medium

---

📋 Coverage Table

Top Security-Critical Files (Complete):

File	Lines	Stmts	Functions	Branches
host-iptables-chain.ts	100%	100%	100%	100%
host-iptables-cleanup.ts	100%	100%	100%	100%
host-iptables-validation.ts	100%	100%	100%	100%
compose-generator.ts	100%	100%	100%	94.73%
config-file.ts	100%	100%	100%	100%

High-Coverage Core Files (>95%):

File	Lines	Stmts	Functions	Branches
api-proxy-config-domains.ts	100%	99.01%	100%	94.73%
artifact-permissions.ts	97.95%	97.95%	100%	97.14%
cli-workflow.ts	98.5%	98.5%	100%	95.91%
config-writer.ts	95.23%	95.23%	100%	95.31%
compose-sanitizer.ts	97.05%	97.14%	100%	93.33%

---

🔧 Function Audit

Uncovered Functions (by file):

1. firecracker/manager.ts — 8 of 14 functions uncovered (57.15% gap)
   • High priority: API initialization and error handling paths
2. firecracker/api-client.ts — 4 of 21 functions uncovered (19.05% gap)
   • Connection management and fallback paths need testing
3. firecracker-runtime-backend.ts — 3 of 7 functions uncovered (42.86% gap)
   • Backend runtime orchestration incomplete
4. enclave/manager.ts — 0 uncovered (100% function coverage)
   • But only 82.17% statement coverage; edge cases need branch tests

---

📅 Recent Source Changes (last 7 days)

Key recently modified files:

• src/bounded-execution/finite-disclosure.ts — 🔴 CRITICAL coverage regression (9.26%)
• src/enclave/runtime-preflight.ts — ⚠️ Medium coverage (70%)
• src/firecracker/manager.ts — ⚠️ Medium coverage (72.09%)
• src/firecracker/preflight.ts — ⚠️ Medium coverage (75%)
• src/firecracker/api-client.ts — ⚠️ Medium coverage (82.66%)

Note: Nearly all source files were touched in the last 7 days (likely a bulk refactor or recent release cycle). Priority should focus on files with degraded coverage.

---

🔎 Notable Findings

1. Critical Regression: bounded-execution/finite-disclosure.ts has only 9.26% statement coverage and 0.26% branch coverage. Only 2 of 44 functions are covered. This appears to be a new or heavily refactored module that lacks test cases. This is a MUST-FIX for security-critical disclosure enforcement.

2. Firecracker Coverage Gap: Three firecracker modules (manager.ts, preflight.ts, api-client.ts) show 72–83% coverage. Given that firecracker is a runtime backend for agent execution, uncovered branches in manager.ts (43.47%) indicate error paths and lifecycle transitions are not tested.

3. Enclave Runtime Preflight: enclave/runtime-preflight.ts has only 46.51% branch coverage despite 100% function coverage. This suggests conditional error handling and validation edge cases are untested, which is concerning for enclave sandbox enforcement.

4. Core Security Functions Excellent: Host iptables rules (host-iptables-rules.ts, host-iptables-shared.ts, host-iptables-chain.ts), domain validation (domain-patterns.ts), and Squid config generation (squid-config.ts) all maintain 100% coverage, demonstrating strong investment in network isolation testing.

---

🎯 Recommendations

HIGH — Address Critical Gap

• Action: Add comprehensive test coverage for src/bounded-execution/finite-disclosure.ts
  • Target: Minimum 70% statement coverage, 50% branch coverage
  • Focus: Core disclosure enforcement logic, rate limiting, and bounded-execution context serialization
  • Effort: High (374 lines, 44 functions, currently 2 covered)
  • Owner: Security/sandbox team

MEDIUM — Close Firecracker Coverage Holes

• Action: Expand test coverage for firecracker runtime backend (manager.ts, preflight.ts)
  • Target: ≥80% branch coverage (currently 43.47%, 65.51%)
  • Focus: Lifecycle transitions, error recovery, API client initialization failures
  • Effort: Medium (86+84 lines)
  • Owner: Runtime backend team

MEDIUM — Improve Enclave Runtime Validation

• Action: Add branch tests for enclave/runtime-preflight.ts
  • Target: ≥75% branch coverage (currently 46.51%)
  • Focus: Preflight validation edge cases, error propagation, MCP gateway readiness
  • Effort: Medium (37 lines, 5 functions)
  • Owner: Enclave runtime team

---

Verification Notes

• All metrics extracted from Istanbul coverage reporter (npm run test:coverage)
• Coverage data freshly computed at 2026-08-09 19:27 UTC
• Target threshold: 80% across all files; branches at ≥85%
• Files passing thresholds: ~95% of production source files
• Files at risk: bounded-execution/finite-disclosure.ts (critical), firecracker/* (medium), enclave/runtime-preflight.ts (medium)

Generated by Test Coverage Reporter · sum00 · 16.6 AIC · ⊞ 5.1K · ◷

• expires on Aug 16, 2026, 7:30 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-16T19:30:06.087Z.

Closed by Workflow