[Coverage Report] Test Coverage Report — 2026-08-29

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-29

Overall Coverage

Metric	Coverage	Statements	Functions	Branches	Lines
Overall	92.67%	11267/12157	1572/1686	6228/7233	10771/11474

Status: ✅ Excellent — All metrics exceed 85% threshold

---

🛡️ Security-Critical Path Status

Module	Statements	Branches	Functions	Status
src/squid/	100% ✅	100% ✅	100% ✅	Fully Covered
src/services/credentials/	100% ✅	100% ✅	100% ✅	Fully Covered
src/services/agent-volumes/	96.92% ✅	91.16% ✅	98.78% ✅	Very High
src/services/agent-environment/	99.6% ✅	92.77% ✅	100% ✅	Very High
src/bounded-execution/	16.46% 🔴	0.78% 🔴	16% 🔴	CRITICAL GAP

Key Finding: Squid proxy filter rules and credential isolation (api-proxy pass-through) are comprehensively tested. However, bounded-execution module (resource limits & finite disclosure) is severely under-tested.

---

📋 Coverage Table

✅ Fully Covered Modules (100%)

Module	Statements	Branches	Functions
src/squid/	100% (307/307)	100% (204/204)	100% (38/38)
src/squid/policy-rules/	100% (66/66)	100% (30/30)	100% (21/21)
src/services/credentials/	100% (67/67)	100% (32/32)	100% (8/8)
src/config/	99.18% (242/244)	98.75% (159/161)	100% (39/39)
src/constants/	100% (1/1)	100% (0/0)	100% (0/0)
src/types/	100% (31/31)	100% (0/0)	33.33% (5/15)

⚠️ High Coverage (>90%)

Module	Statements	Branches	Functions
src/microvm/	93.45%	88.02%	96.08%
src/cloud-hypervisor/	91.54%	84.73%	89.1%
src/logs/	98.92%	92.09%	100%
src/commands/	97.57%	94.53%	96.85%
src/parsers/	99.01%	98.26%	100%
src/services/agent-volumes/	96.92%	91.16%	98.78%

🔴 Low Coverage (<20%)

Module	Statements	Branches	Functions	Issue
src/bounded-execution/	16.46% ⚠️	0.78% 🔴	16% 🔴	Resource-limit enforcement untested

---

🔧 Function Audit

Critical Security Functions — Status Check

1. Squid Domain ACL Enforcement (src/squid/domain-acl.ts)

   • ✅ 100% coverage (28 lines, 8 functions)
   • Validates domain whitelisting logic
   • Tests: domain matching, subdomain wildcard logic, ACL file generation

2. Credential Isolation (src/services/credentials/provider-credential-isolation.ts)

   • ✅ 100% coverage (17 lines, 1 function)
   • Ensures API keys not leaked to agent
   • Tests: env var filtering, allowed key list enforcement

3. Agent Volume Mounts (src/services/agent-volumes/)

   • ✅ 96.92% overall
   • /etc/shadow exclusion: 97.87% (hosts-file.ts)
   • Read-only system binaries: 100% (system-mounts.ts)
   • Credential hiding overlays: 97.56% (credential-hiding.ts)

4. Bounded Execution (src/bounded-execution/finite-disclosure.ts) 🔴

   • ❌ 9.26% statement coverage, 0.26% branch coverage
   • Risk: Resource limits and disclosure timeouts not validated
   • Mitigation: Integration tests may cover indirectly, but unit tests needed
   • Impact: Prevents verification that agent runtime limits are enforced

---

📅 Recent Source Changes (last 7 days)

Based on HTML coverage report timestamp (2026-08-29T04:34:45.632Z), this is the latest snapshot.

Expected active areas:

• src/bounded-execution/ (new feature)
• src/enclave/ (unified enclaves rollout)
• src/microvm/ (Cloud Hypervisor backend)

---

🔎 Notable Findings

1. Squid ACL & Domain Filtering: Exceptionally well-tested. All domain-matching logic, policy rules, and HTTP/HTTPS decision trees have 100% coverage. Security-critical path for network isolation is highly validated.

2. Bounded Execution Gap: src/bounded-execution/finite-disclosure.ts has only 0.78% branch coverage. This module likely handles resource timeouts and information disclosure limits — essential for AI agent sandboxing. Current tests do not exercise the core branches.

3. Enclave Architecture: src/enclave/ at 89.57% coverage is reasonable but has 78.48% branch coverage. The MCP gateway integration (late-backend rediscovery) may need additional error-path testing.

4. Microvm Cloudvisor Backend: 93.45% statement, 88.02% branch. Cloud Hypervisor launcher and VM lifecycle management could benefit from more error-case coverage (e.g., VM startup failures, resource exhaustion).

---

🎯 Recommendations

🔴 HIGH PRIORITY

Add unit tests for src/bounded-execution/finite-disclosure.ts

• Why: Resource-limit enforcement is security-critical; disclosure timeouts prevent exfiltration loops
• Action: Create test suite covering timeout scenarios, disclosure trigger conditions, and boundary cases
• Effort: ~4–6 hours
• Risk if skipped: Unvalidated resource limits could fail silently or behave unexpectedly under stress

🟡 MEDIUM PRIORITY

Expand branch coverage in src/microvm/rootfs.ts (current: 54.54%)

• Why: Container image preparation and rootfs mount logic are reliability-critical
• Action: Add tests for mount failures, missing FS layers, permission errors
• Effort: ~2–3 hours
• Risk if skipped: VM startup failures under edge conditions may not be caught until production

Improve error-path testing in src/enclave/runtime-preflight.ts (current: 41.02% branch)

• Why: MCP gateway integration errors (503, timeouts) need robust handling
• Action: Mock gateway failures and test retry logic, timeout escalation
• Effort: ~2 hours
• Risk if skipped: Enclave startup failures may cascade or fail silently

🟢 LOW PRIORITY

Increase config assembly validator coverage (src/commands/validators/config-assembly.ts)

• Why: 73.68% statements, 25% branch coverage — low priority but improves config validation robustness
• Action: Add edge-case tests (empty configs, conflicting flags, invalid schema)
• Effort: ~1–2 hours

---

Summary

Overall Assessment: The codebase has excellent test coverage (92.67%) with particularly strong coverage of security-critical networking and credential-isolation paths. However, the bounded-execution module is severely under-tested (16.46%), representing a coverage regression in a security-sensitive area. Prioritizing finite-disclosure tests and error paths in microvm/enclave modules will significantly improve reliability.

Generated by Test Coverage Reporter · copilot · sum00 · 20.9 AIC · ⊞ 5.4K · ◷

• expires on Sep 5, 2026, 4:39 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-05T04:39:29.710Z.

Closed by Workflow