[Coverage Report] Test Coverage Report — 2026-08-24

[github-actions[bot]]

Overall Coverage

The firewall codebase maintains robust test coverage across the critical security paths:

Metric	Coverage	Status
Lines	93.83%	✅ Excellent
Statements	92.7%	✅ Excellent
Functions	93.12%	✅ Excellent
Branches	86.01%	✅ Very Good

Overall assessment: The project is well-tested with strong baseline coverage. The branch coverage of 86% suggests most logical paths are exercised, though some edge cases remain untested.

---

🛡️ Security-Critical Path Status

Core security components all achieve 100% line coverage:

Component	Lines	Statements	Branches	Risk Level
host-iptables (main module)	100%	100%	—	✅ Safe
host-iptables-chain	100%	100%	100%	✅ Safe
host-iptables-rules	100%	100%	100%	✅ Safe
host-iptables-validation	100%	100%	100%	✅ Safe
host-iptables-cleanup	100%	100%	100%	✅ Safe
domain-patterns	100%	100%	89.47%	✅ Safe
squid-config (facade)	100%	100%	—	✅ Safe
docker-manager	100%	100%	—	✅ Safe
cli.ts	85.71%	85.71%	50%	⚠️ Watch

Key finding: Network isolation (iptables) and domain ACL matching (domain-patterns) are fully covered. The main entry point (cli.ts) has partial branch coverage, likely covering normal flow but missing error paths.

---

📋 Coverage Table

Lowest-Covered Modules (excluding test utilities):

File	Statements	Branches	Issue
finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL — bounded-execution feature
runtime-preflight.ts	66.66%	41.02%	🟡 Enclave preflight checks untested
rootfs.ts	71.69%	54.54%	🟡 Microvm rootfs init partially tested
config-assembly.ts	73.68%	25%	🟡 Config validation has low branch coverage

Summary: Four modules fall below 75% statement coverage. The most critical issue is finite-disclosure.ts with only 9.26% statement coverage and 0.26% branch coverage, indicating this feature is nearly untested.

---

🔧 Function Audit

High-confidence findings:

• ✅ All 9 functions in host-iptables-rules.ts covered
• ✅ All 15 functions in host-iptables-shared.ts covered
• ✅ All 3 functions in domain-patterns.ts covered
• ⚠️ 0 functions in cli.ts (stub-only file? Consider instrumenting if not)
• 🔴 Only 4.54% of functions in finite-disclosure.ts (2 of 44 functions covered)

Test gaps:

1. Error paths in CLI — 50% branch coverage suggests normal flow tested, exceptions/exits not fully exercised
2. Config assembly validation — 25% branch coverage for validation logic leaves edge cases untested
3. Enclave preflight — 41% branch coverage means enclave availability checks are incomplete

---

📅 Recent Source Changes (Last 7 Days)

Note: Git history access is limited in this environment. Recommend checking:

git log --since="7 days ago" --name-only src/

Last known coverage snapshot: 2026-08-24 04:42 UTC

---

🔎 Notable Findings

1. Network isolation is airtight — All iptables modules (rules, validation, cleanup) achieve 100% coverage with perfect branch coverage. The firewall's core security boundary is well-tested.

2. Bounded execution feature is untested — finite-disclosure.ts has only 9.26% statement coverage and 0.26% branch coverage (1 branch out of 377 covered). This bounded-execution feature appears to be newly added or deprioritized; urgent test coverage needed if this is security-critical.

3. Enclave feature has moderate gaps — runtime-preflight.ts (66.66% stmt, 41% branch) and rootfs.ts (71.69% stmt, 54.54% branch) indicate enclave support is partially tested. Consider adding integration tests for enclave startup and validation paths.

4. CLI entry point handling — cli.ts shows 85.71% line coverage but only 50% branch coverage, suggesting error handling and signal interrupts may not be fully exercised. Consider testing SIGTERM/SIGINT handling and cleanup failure paths.

---

🎯 Recommendations

🔴 High Priority

1. Add test coverage for finite-disclosure.ts
   • Current: 9.26% statements, 0.26% branches
   • Action: Write unit tests for bounded-execution feature's core logic, including timeout scenarios and resource limits
   • Impact: Prevents undetected regressions in a feature that (if security-related) could enable resource exhaustion attacks
   • Effort: ~4–6 hours (44 functions, complex logic likely needs fixtures)

🟡 Medium Priority

2. Improve config-assembly.ts branch coverage

   • Current: 73.68% statements, 25% branches (only 3 of 12 branches covered)
   • Action: Add tests for validation edge cases (invalid domain formats, conflicting configs, empty arrays, etc.)
   • Impact: Reduces risk of malformed configs reaching container startup
   • Effort: ~2–3 hours

3. Complete enclave integration tests

   • Current: runtime-preflight.ts 41% branches, rootfs.ts 54.54% branches
   • Action: Add integration tests for enclave preflight validation, MCP gateway interaction, and rootfs initialization
   • Impact: Ensures enclave feature is production-ready with resilience to edge cases
   • Effort: ~5–8 hours (depends on test infrastructure for MCP gateway mocking)

🟢 Low Priority

4. Test CLI error paths
   • Current: cli.ts 50% branch coverage
   • Action: Add tests for SIGTERM/SIGINT handling, container startup failures, config write errors
   • Impact: Graceful failure modes, clean resource teardown
   • Effort: ~2 hours

---

Next steps: Start with High Priority #1 (finite-disclosure tests) to close the critical gap. Use the existing test fixtures in src/test-helpers/ as templates.

Generated by Test Coverage Reporter · sum00 · 21.3 AIC · ⊞ 5.4K · ◷

• expires on Aug 31, 2026, 4:52 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-31T04:52:42.032Z.

Closed by Workflow