[Coverage Report] Test Coverage Report — 2026-08-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-21

Overall Coverage

Metric	Coverage
Statements	92.52% (10,228 / 11,054)
Branches	85.76% (5,613 / 6,545)
Functions	93.05% (1,394 / 1,498)
Lines	93.67% (9,815 / 10,478)

Assessment: Overall coverage is strong across all metrics, with statement and line coverage exceeding 92%. Branch coverage at 85.76% indicates most conditional paths are tested, though opportunities remain for improvement in edge cases and error paths.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/cli.ts	85.71%	50.00%	100%	⚠️ Moderate Risk
src/domain-patterns.ts	100%	89.47%	100%	✅ Healthy
src/docker-manager.ts	100%	100%	100%	✅ Healthy
src/squid-config.ts	100%	100%	100%	✅ Healthy
src/host-iptables-chain.ts	100%	100%	100%	✅ Healthy

Key Insight: Four of five critical security components have perfect or near-perfect coverage. cli.ts requires immediate attention due to 50% branch coverage, likely indicating untested error-handling paths in the main orchestration logic.

---

📋 Coverage Table

Critical Files (Security-Focused)

• ✅ Domain pattern validation (domain-patterns.ts): 100% statements, 89.47% branches
• ✅ Docker container management (docker-manager.ts): 100% all metrics
• ✅ Squid ACL configuration (squid-config.ts): 100% all metrics
• ✅ iptables chain generation (host-iptables-chain.ts): 100% all metrics
• ⚠️ CLI orchestration (cli.ts): 85.71% statements, 50% branches

High-Risk Files (Below 75%)

1. [CRITICAL] src/bounded-execution/finite-disclosure.ts: 9.26% statements, 0.26% branches (374/43 lines)
2. src/commands/validators/config-assembly.ts: 69.69% statements, 20% branches
3. src/enclave/runtime-preflight.ts: 66.66% statements, 41.02% branches
4. src/microvm/rootfs.ts: 71.69% statements, 54.54% branches
5. src/cloud-hypervisor/virtiofsd.ts: 72.51% statements, 55.35% branches

---

🔧 Function Audit

Uncovered/Under-covered Functions by Category:

CLI & Orchestration (src/cli.ts)

• Issue: 1 uncovered branch (50% coverage) indicates an error handling path in main command execution
• Impact: Silent failures or improper signal handling during container lifecycle
• Test Gap: Missing tests for graceful shutdown, SIGTERM/SIGINT handling, config validation failures

Bounded Execution Module (src/bounded-execution/finite-disclosure.ts)

• Functions: 2/44 covered (4.54%)
• Issue: Module is almost entirely untested (43/374 lines executed)
• Impact: CRITICAL — Any logic errors in disclosure control, credential filtering, or bounded scope validation are undetected
• Test Gap: Need functional test suite covering all 44 functions; currently appears to be new/exploratory code

Enclave Runtime (src/enclave/runtime-preflight.ts)

• Functions: 5/5 covered (100% function coverage, but 66.66% statement coverage)
• Issue: Functions are reachable but many code paths within them are untested
• Impact: Preflight checks may pass incorrectly; MCP gateway interaction errors masked
• Test Gap: Edge cases for gateway unavailability, malformed responses, timeout scenarios

MicroVM & Cloud Hypervisor

• virtiofsd.ts: 9/19 functions covered (47.36%)
• rootfs.ts: 6/6 functions covered but only 72% statement coverage
• Issue: Virtual filesystem and rootfs mounting logic partially untested
• Impact: MicroVM backend may fail silently in rare configurations
• Test Gap: Container image mounting, device passthrough, symlink resolution edge cases

---

📅 Recent Source Changes (last 7 days)

Note: Git history querying encountered permission restrictions. Based on file evidence in coverage data, the following areas show active development:

• Cloud Hypervisor integration (src/cloud-hypervisor/) — virtiofsd, rootfs, and diagnostic utilities
• Bounded Execution framework (src/bounded-execution/) — finite-disclosure, capability control
• Enclave runtime (src/enclave/runtime-preflight.ts) — MCP gateway preflight validation

---

🔎 Notable Findings

1. Branch Coverage Gap in CLI: Only 50% of conditional branches tested in cli.ts (2/4 branches). This is the entry point for all commands, so untested branches likely represent critical error paths (config generation failure, container startup failure, signal handling).

2. Finite-Disclosure Module Unverified: With 9.26% statement coverage and 0.26% branch coverage, the bounded-execution/finite-disclosure system (44 functions, 374 lines) is essentially untested. This module appears to control credential and capability disclosure in advanced scenarios — it must be tested comprehensively before production use.

3. Strong Foundation in Core Firewall: All three core firewall components (squid-config, domain-patterns, docker-manager) have 100% statement coverage, indicating the proxy filtering, domain validation, and container lifecycle are well-tested.

4. Enclave Preflight Undertested: Runtime preflight checks show 100% function coverage but only 66.66% statement coverage, indicating partial execution paths in MCP gateway interaction and fallback scenarios.

---

🎯 Recommendations

🔴 High Priority

1. Fix cli.ts branch coverage (50% → 85%+)

   • Add unit tests for error scenarios: config generation failure, docker-compose startup timeout, container unhealthy, SIGTERM/SIGINT signal handling
   • Ensure all conditional branches in main orchestration are exercised
   • Effort: 2–3 hours | Risk Reduction: High

2. Audit & test bounded-execution/finite-disclosure.ts comprehensively

   • Currently at 9.26% coverage; module is critical for credential/capability isolation
   • Add functional test suite covering all 44 functions
   • Verify credential filtering, scope boundaries, disclosure prevention logic
   • Effort: 8–12 hours | Risk Reduction: Critical (prevents security regression)

🟡 Medium Priority

3. Expand enclave runtime-preflight.ts edge-case coverage (66.66% → 85%+)

   • Test MCP gateway unavailability, timeouts, malformed responses
   • Add integration tests for gateway backend retries (503 backend_unavailable)
   • Effort: 4–6 hours | Risk Reduction: Medium

4. Improve microVM backend coverage (virtiofsd, rootfs) to 80%+

   • Test virtual filesystem mounting edge cases, device passthrough, symlink resolution
   • Add tests for rootfs preparation with various bind-mount configurations
   • Effort: 6–8 hours | Risk Reduction: Medium

🟢 Low Priority

5. Raise config-assembly.ts branch coverage (20% → 60%+)
   • Currently only 2/10 branches tested; add tests for validation error paths
   • Effort: 2–3 hours | Risk Reduction: Low (validator, non-critical path)

---

Summary

This project maintains strong overall coverage (92.52% statements, 85.76% branches) with excellent security foundations. All core firewall components are well-tested. However, two issues require immediate action:

1. cli.ts — incomplete branch coverage in main orchestration
2. finite-disclosure.ts — critical security module nearly untested

Addressing these two items would significantly reduce security and reliability risks in advanced features (bounded execution, credential isolation) while ensuring robust command orchestration.

Generated by Test Coverage Reporter · sum00 · 17.5 AIC · ⊞ 5.4K · ◷

• expires on Aug 28, 2026, 6:17 PM UTC