[Coverage Report] Test Coverage Report — 2026-08-08

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-08

Overall Coverage

The project maintains strong overall coverage with comprehensive testing across most of the codebase:

• Statements: 93.09% (7720/8293)
• Branches: 86.29% (4174/4837)
• Functions: 94.47% (991/1049)
• Lines: 94.11% (7410/7873)

This reflects a mature, well-tested codebase with high quality assurance practices.

---

🛡️ Security-Critical Path Status

Security-critical components maintain excellent coverage — all core firewall enforcement paths are thoroughly tested:

Component	Statements	Branches	Functions	Lines	Status
squid-config.ts	100%	100%	100%	100%	✅ Excellent
host-iptables.ts	100%	100%	100%	100%	✅ Excellent
docker-manager.ts	100%	98.14%	100%	100%	✅ Excellent
domain-patterns.ts	100%	100%	100%	100%	✅ Excellent
cli.ts	85.71%	85.71%	100%	85.71%	⚠️ Good

Key Finding: All domain filtering, network isolation, and container orchestration code is fully covered. The CLI has acceptable coverage with identified gaps in error handling and edge-case paths.

---

📋 Coverage Table

High-Coverage Directories (>90%)

• src/ — 98.56% statements (primary source)
• src/enclave/ — 91.06% statements (enclave support code)

Low-Coverage Directory (Critical Gap)

• src/bounded-execution/ — 16.46% statements, 0.78% branches ⛔

---

🔧 Function Audit

Fully Covered Functions (Security-Critical)

• generateSquidConfig() — 100% ✅ Domain ACL rules
• setupIptablesRules() — 100% ✅ Network isolation
• normalizeAndValidateDomains() — 100% ✅ Domain validation
• generateDockerCompose() — 100% ✅ Container orchestration

Partially Covered Functions

• CLI command handlers (85.71%) — Main entry point has gaps in error recovery paths
• runtime-preflight.ts (66.66% stmts, 41.02% branches) — Enclave preflight validation needs more test cases

Critical Gap

• finite-disclosure.ts (9.26% stmts, 0.26% branches) ⛔ CRITICAL — Bounded execution module almost entirely untested. This controls execution time limits and resource constraints.

---

📅 Recent Source Changes (last 7 days)

No recent commits detected in the 7-day window. The codebase appears stable with no active development in the measured period.

---

🔎 Notable Findings

1. Excellent Security Coverage — All critical firewall enforcement paths (Squid config, iptables rules, domain validation) maintain 100% statement and branch coverage. Network isolation logic is well-tested.

2. Critical Gap in Bounded Execution — src/bounded-execution/finite-disclosure.ts has only 9.26% statement coverage with nearly 0% branch coverage. This module handles execution time limits and resource constraints — a security-relevant path that should be tested.

3. CLI Edge Cases Unvalidated — While core CLI logic is functional, error handling and recovery paths in cli.ts (85.71% coverage) lack testing. This affects graceful shutdown and cleanup scenarios.

4. Enclave Preflight Untested — src/enclave/runtime-preflight.ts has 66.66% statement coverage and only 41.02% branch coverage, indicating incomplete test coverage for enclave validation logic.

---

🎯 Recommendations

High Priority ⛔

• Add tests for src/bounded-execution/finite-disclosure.ts — This module enforces resource limits and execution timeouts, critical for security. Test execution timeout behavior, resource constraint enforcement, and edge cases where limits are exceeded. Target: ≥90% statement coverage.

Medium Priority ⚠️

• Expand CLI error handling tests — Add tests for graceful shutdown, cleanup on interruption, and error recovery in src/cli.ts. Focus on SIGTERM/SIGINT handling and partial failure scenarios. Target: ≥95% coverage on error paths.
• Complete enclave preflight validation tests — Increase coverage of src/enclave/runtime-preflight.ts to ≥80% by testing all validation branches and error conditions for enclave startup.

Low Priority i️

• Monitor overall trend — While overall coverage (93.09%) is strong, maintain branch coverage above 85% on future changes. Continue current testing practices for security-critical paths.

---

Summary

The project demonstrates strong test coverage with excellent security focus. Core firewall components (domain filtering, network isolation, container orchestration) are comprehensively tested. The identified gap in bounded execution (finite-disclosure.ts) is the primary concern requiring remediation, as it relates to resource constraint enforcement — a security-relevant feature.

Generated by Test Coverage Reporter · sum00 · 19.8 AIC · ⊞ 5.1K · ◷

• expires on Aug 15, 2026, 6:42 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-15T18:42:18.676Z.

Closed by Workflow