**1 issue found** across 9 files Confidence score: **4/5** - There is a medium-severity issue where `NODE_V8_COVERAGE`/`CTRF_JUNIT_PATH` can leak into the child process even when `TEST_COVERAGE` is off, potentially bypassing the opt-in gate in `packages/core/scripts/test-e2e.ts`. - Impact seems limited to test environment configuration rather than production behavior, so overall risk looks low-to-moderate and likely safe to merge with awareness. - Pay close attention to `packages/core/scripts/test-e2e.ts` - ensure coverage-related env vars are only set when explicitly enabled.

Prompt for AI agents (all issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P2: Environment variables `NODE_V8_COVERAGE` and `CTRF_JUNIT_PATH` leak from the parent process when `TEST_COVERAGE` is not enabled, bypassing the opt-in gate. When `coverageDir`/`ctrfPath` are `null`, `withCoverageEnv`/`withCtrfEnv` return the env unchanged, so any pre-existing values from `process.env` are passed to the child. Consider explicitly deleting these keys when coverage is disabled, e.g. `{ ...env, NODE_V8_COVERAGE: undefined }`. ```

Architecture diagram

```mermaid sequenceDiagram participant CI as CI / Developer participant Script as Test Script (Core/E2E/Server) participant Utils as NEW: test-artifacts.ts participant FS as File System participant Runner as Test Runner (Vitest/Playwright/Node) CI->>Script: Run test command (e.g. pnpm test:core) Script->>Utils: isTestCoverageEnabled() Note over Utils: Checks TEST_COVERAGE env var Utils-->>Script: boolean alt TEST_COVERAGE is enabled (CI or Local Opt-in) Script->>Utils: NEW: initCoverageDir(path) Utils->>FS: CHANGED: mkdirSync (recursive) Utils-->>Script: coveragePath Script->>Utils: NEW: initJunitPath(path) Utils->>FS: CHANGED: mkdirSync (parent dir) Utils-->>Script: junitPath Script->>Utils: NEW: withCoverageEnv(env, coveragePath) Utils-->>Script: Updated Env (NODE_V8_COVERAGE) Script->>Runner: spawnSync (with reporter + coverage flags) Runner->>FS: Write JUnit XML & Coverage data Runner-->>Script: Exit Code Script->>Utils: NEW: maybeWriteCtrf(junitPath, writer) Utils->>FS: Convert JUnit to CTRF JSON else TEST_COVERAGE is disabled (Default Local) Script->>Utils: NEW: initCoverageDir(path) Utils-->>Script: null Script->>Utils: NEW: initJunitPath(path) Utils-->>Script: null Script->>Runner: CHANGED: spawnSync (minimal flags, no coverage env) Note right of Runner: No artifacts generated Runner-->>Script: Exit Code end Script-->>CI: Return Exit Status ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}