[Coverage Report] Test Coverage Report — 2026-09-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-09

Overall Coverage

Metric	Coverage	Status	Trend
Statements	92.72%	✅ Excellent	Stable
Branches	86.62%	✅ Excellent	Stable
Functions	93.41%	✅ Excellent	Stable
Lines	94.05%	✅ Excellent	Stable

Total Covered: 14,156 of 15,267 statements

The project maintains strong baseline coverage at 92.72%, well above typical industry standards. However, targeted analysis reveals critical gaps in security-sensitive and newer modules.

---

🛡️ Security-Critical Path Status

Component	Coverage	Status	Risk Level
Logger (logger.ts)	100%	✅ Full	None
Squid Config (squid-config.ts)	100%	✅ Full	None
Host iptables (host-iptables.ts)	83.63% (stmt) / 55.55% (branch)	⚠️ Good	Medium
CLI Workflow (cli-workflow.ts)	100%	✅ Full	None
Finite Disclosure (src/bounded-execution/finite-disclosure.ts)	38.12% (stmt) / 25.89% (branch)	🔴 Critical	HIGH
Docker Manager (docker-manager.ts)	18% (stmt) / 22.22% (branch)	🔴 Critical	HIGH
CLI Entry (cli.ts)	0%	🔴 Critical	HIGH

Key Finding: Three critical files fall far below safe thresholds. finite-disclosure.ts is particularly concerning due to low branch coverage (25.89%), indicating incomplete handling of conditional logic paths.

---

📋 Coverage Table

✅ Fully Covered (100%)

File	Statements	Branches	Functions	Lines
logger.ts	100% (16/16)	100% (6/6)	100% (8/8)	100% (16/16)
squid-config.ts	100% (13/13)	100% (5/5)	100% (5/5)	100% (12/12)
cli-workflow.ts	100% (16/16)	100% (2/2)	100% (1/1)	100% (16/16)
api-proxy-config-domains.ts	100%	100%	100%	100%

⚠️ Good Coverage (50–90%)

File	Statements	Branches	Functions	Notes
host-iptables.ts	83.63%	55.55%	100%	Branch coverage below target; 16.37% statement gap
enclave/runtime-preflight.ts	66.66%	41.02%	—	Newer feature; branch coverage below 50%
microvm/rootfs.ts	71.69%	54.54%	—	Cloud Hypervisor feature

🔴 Critical Gaps (<50%)

File	Statements	Branches	Functions	Impact
bounded-execution/finite-disclosure.ts	38.12%	25.89%	—	Disclosure boundary enforcement untested
microvm/network-reservation.ts	50.22%	54.26%	—	Network sandbox isolation barely tested
commands/validators/config-assembly.ts	73.68%	25%	—	Config validation branch paths incomplete
docker-manager.ts	18%	22.22%	4%	Container lifecycle (3,900+ LOC) critically undertested
cli.ts	0%	0%	0%	Main entry point untested

---

🔧 Function Audit

Critical Functions Needing Test Coverage:

1. src/bounded-execution/finite-disclosure.ts (38.12% statements, 25.89% branches)

   • Responsible for enforcing output size limits and preventing unbounded disclosure
   • Branch coverage of 25.89% suggests critical conditional paths are untested
   • Impact: Could allow unintended data leakage or DoS attacks

2. src/docker-manager.ts (18% statements, 22.22% branches)

   • Container lifecycle: startup, health checks, signal handling, cleanup
   • 1 of 25 functions tested (4% function coverage)
   • Impact: Runtime container failures, resource leaks, incomplete shutdown

3. src/cli.ts (0% coverage)

   • Main orchestration: argument parsing, config generation, error handling
   • Impact: Core workflow behavior unmeasured; regression risk high

4. src/commands/validators/config-assembly.ts (73.68% statements, 25% branches)

   • Configuration validation and assembly
   • Low branch coverage (25%) indicates error paths untested
   • Impact: Invalid configs may not be caught early

---

📅 Recent Source Changes (last 7 days)

6 commits affecting src/ in the last 7 days:

1. f895fca — refactor: centralize agent sandbox path policy (refactor: centralize agent sandbox path policy #8334)
2. 153a5d0 — fix: configure dynamic enclave smoke guard (fix: configure dynamic enclave smoke guard #8324)
3. e015efd — test: add end-to-end security coverage for dynamic repository enclaves (test: add end-to-end security coverage for dynamic repository enclaves #8307)
4. 8a3de88 — fix: send delegation TTLs in seconds (fix: send delegation TTLs in seconds #8292)
5. bff2b29 — feat: run dynamic agent enclaves with repository-scoped GitHub MCP identities (feat: run dynamic agent enclaves with repository-scoped GitHub MCP identities #8276)
6. ced9163 — Enforce Squid proxy egress on Docker sbx daemon in smoke workflows (Enforce Squid proxy egress on Docker sbx daemon in smoke workflows #8252)

Notable: Recent work has focused on enclave features and sandbox policy, but no corresponding test coverage improvements for critical path files (docker-manager.ts, cli.ts, finite-disclosure.ts).

---

🔎 Notable Findings

• Paradox: Global coverage is 92.72% (excellent), but security-critical modules fall to 0–38%. This reflects selective test focus on stable utility functions rather than orchestration logic.

• Branch Coverage Blindspot: Multiple files with >70% statement coverage have <50% branch coverage (finite-disclosure.ts: 38.12% stmt but only 25.89% branches). Branch testing is consistently weaker than statement testing, indicating insufficient handling of conditional logic.

• Newer Features Undertested: Enclave, microVM, and bounded-execution modules (added in recent commits) have lower coverage, suggesting they were implemented before comprehensive test suites were created.

• Container Lifecycle Risk: The largest and most security-sensitive module (docker-manager.ts, 3,900+ LOC) has 18% coverage with only 4% function coverage, making runtime behavior largely untested.

---

🎯 Recommendations

🔴 HIGH Priority

1. Add unit tests for src/bounded-execution/finite-disclosure.ts

   • Target: Raise branch coverage from 25.89% to >85%
   • Focus: All conditional branches in disclosure size enforcement, boundary conditions
   • Risk: Unbounded output/memory exhaustion if missed
   • Effort: ~4–6 hours
   • Owner: Security team review recommended

2. Increase src/docker-manager.ts coverage to >60%

   • Current: 18% statements, 4% functions
   • Focus: Container lifecycle (start, healthcheck, stop, cleanup), error paths
   • Risk: Container resource leaks, incomplete shutdown, failed signal handling
   • Effort: ~6–8 hours (mock Docker Compose interactions)
   • Baseline: Establish tests for the 25 functions (currently only 1 tested)

🟡 MEDIUM Priority

3. Add branch coverage tests for src/commands/validators/config-assembly.ts
   • Current: 73.68% statements but only 25% branches
   • Focus: Error conditions in config validation, edge cases
   • Risk: Invalid configurations accepted, leading to runtime failures
   • Effort: ~2–3 hours
   • Baseline: Test all error paths in validation logic

🟢 LOW Priority

4. Test remaining 16.37% of src/host-iptables.ts
   • Current: 83.63% statements, 55.55% branches
   • Focus: Edge cases in iptables rule generation, error cleanup
   • Effort: ~1–2 hours
   • Note: Already good coverage; this is hardening, not critical

---

Summary

The codebase maintains excellent global coverage (92.72%) but exhibits a coverage concentration problem: stable utility modules (logger, squid-config) are fully tested, while critical orchestration and newer security modules are undertested. The most urgent action is raising branch coverage in finite-disclosure.ts (25.89% → >85%) to ensure disclosure boundaries are enforced across all code paths, followed by establishing baseline tests for docker-manager.ts container lifecycle functions.

Recommended next step: Prioritize the three HIGH/MEDIUM items above for the next sprint.

Generated by Test Coverage Reporter · copilot · sum00 · 14.3 AIC · ⊞ 5.5K · ◷

• expires on Sep 16, 2026, 11:46 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-16T23:46:23.326Z.

Closed by Workflow