[Coverage Report] Test Coverage Report — 2026-08-20

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-20

Overall Coverage

Metric	Coverage	Statements
Statements	92.69%	10,004 / 10,792
Branches	85.94%	5,448 / 6,339
Functions	93.11%	1,366 / 1,467
Lines	93.85%	9,603 / 10,232

Status: ✅ Overall coverage exceeds 85% threshold across all metrics. The codebase demonstrates strong test coverage with 92.69% statement coverage.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ EXCELLENT
src/squid-config.ts	100%	100%	100%	✅ EXCELLENT
src/docker-manager.ts	100%	100%	100%	✅ EXCELLENT
src/domain-patterns.ts	100%	89.47%	100%	✅ EXCELLENT
src/cli.ts	85.71%	50%	100%	⚠️ GOOD

Summary: All security-critical files have 100% statement coverage and high branch coverage. The cli.ts wrapper shows good coverage with 85.71% statements (6/7 covered). Domain pattern matching is fully tested with 100% statement coverage and 89.47% branch coverage.

---

📋 Coverage Table

By Directory

Directory	Statements	Branches	Functions	Status
src/ (overall)	98.3%	94.02%	98.14%	✅ EXCELLENT
src/commands/	98.14%	94.41%	98.37%	✅ EXCELLENT
src/services/	97.79%	94.23%	100%	✅ EXCELLENT
src/microvm/	93.45%	88.02%	96.08%	✅ EXCELLENT
src/enclave/	91.42%	79.95%	97%	✅ EXCELLENT
src/cloud-hypervisor/	88.67%	81.06%	83.44%	✅ EXCELLENT
src/bounded-execution/	16.46%	0.78%	16%	⛔️ CRITICAL GAP
src/logs/	98.92%	92.09%	100%	✅ EXCELLENT
src/parsers/	99.01%	98.26%	100%	✅ EXCELLENT

---

🔧 Function Audit

Fully Covered Security Functions (100% statement coverage):

• ✅ generateSquidConfig() & related Squid ACL generation
• ✅ generateDockerCompose() & Docker orchestration
• ✅ setupHostIptables() & teardownHostIptables() — network isolation rules
• ✅ validateDomainPattern() — domain ACL validation
• ✅ All key service container functions

Partially Covered (> 80% statement coverage):

• ⚠️ cli.ts entry point (85.71% — 6/7 lines covered, 1 branch uncovered)

Uncovered/Low Coverage (< 80%):

• 🔴 src/bounded-execution/finite-disclosure.ts (9.26% statements, 0.26% branches) — CRITICAL
• 🟡 src/enclave/runtime-preflight.ts (66.66% statements, 41.02% branches)
• 🟡 src/commands/validators/config-assembly.ts (69.69% statements, 20% branches)
• 🟡 src/microvm/rootfs.ts (71.69% statements, 54.54% branches)
• 🟡 src/cloud-hypervisor/virtiofsd.ts (72.51% statements, 55.35% branches)

---

📅 Recent Source Changes (last 7 days)

Note: Git history not accessible in current environment. Review recent PRs and commits in the GitHub repository for context on changes to:

• src/cli.ts (entry point updates)
• src/bounded-execution/ (if modified — this is the top coverage gap)
• src/enclave/ (enclave runtime improvements)
• src/microvm/ (Cloud Hypervisor integration)

---

🔎 Notable Findings

1. 🎯 Critical Gap in Bounded Execution: src/bounded-execution/finite-disclosure.ts has 9.26% statement coverage with only 0.26% branch coverage (1/377 branches). This module appears to handle execution isolation and disclosure controls — coverage urgently needed given its security role.

2. ✅ Security Core is Protected: The three most critical files (host-iptables.ts, squid-config.ts, docker-manager.ts) achieve 100% coverage. All egress filtering, container management, and network isolation logic is well-tested.

3. 🟡 Enclave & MicroVM Coverage Gaps: Features for unified enclaves (runtime-preflight.ts at 66.66%) and Cloud Hypervisor backend (rootfs.ts at 71.69%, virtiofsd.ts at 72.51%) have gaps, suggesting these newer features may lack integration tests or scenario coverage.

4. 📊 Strong Overall Health: 92.69% statement coverage across 10,792 statements indicates mature test infrastructure. The distribution shows core functionality is well-covered while newer/optional features lag behind.

---

🎯 Recommendations

Priority 1 — HIGH

Add coverage for src/bounded-execution/finite-disclosure.ts (currently 9.26%)

• Action: Write integration tests for bounded execution isolation and resource disclosure limits
• Why: This module appears to enforce execution boundaries critical for security; 9.26% coverage is unacceptable for security-critical code
• Effort: High (likely requires environment setup for execution limits)
• Target: Aim for ≥ 90% statements, especially branch coverage (currently 0.26%)

Priority 2 — MEDIUM

Improve branch coverage in src/enclave/runtime-preflight.ts (66.66% stmt, 41.02% branch)

• Action: Add test cases for error conditions, validation failures, and edge cases in enclave startup preflight checks
• Why: Low branch coverage suggests error paths and edge cases are untested
• Effort: Medium (focus on negative test scenarios)
• Target: Aim for ≥ 85% statements, ≥ 75% branches

Priority 3 — MEDIUM

Improve branch coverage in microVM/Cloud Hypervisor modules

• Files: src/microvm/rootfs.ts (71.69%), src/cloud-hypervisor/virtiofsd.ts (72.51%)
• Action: Add tests for failure scenarios (device initialization failures, virtio-fs mount errors)
• Why: These emerging backend features show adequate statement coverage but weak branch coverage
• Effort: Medium (mock device failures, test fallbacks)
• Target: Aim for ≥ 85% statements, ≥ 75% branches

---

Report Metadata

• Report Date: 2026-08-20
• Test Suite: Jest with Istanbul coverage
• Total Files Analyzed: 237 source files in src/
• Threshold Status: ✅ Overall (92.69%) exceeds 85% goal
• Security-Critical Files: ✅ All > 85% (most at 100%)
• Coverage Gaps: ⚠️ 5 files below 80% (mainly new/optional features)

Generated by Test Coverage Reporter · sum00 · 32.5 AIC · ⊞ 5.3K · ◷

• expires on Aug 27, 2026, 5:02 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-27T17:02:04.701Z.

Closed by Workflow