[Coverage Report] Test Coverage Report — 2026-08-28

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-28

Overall Coverage

Metric	Coverage	Status
Lines	93.84% (10,681 / 11,381)	✅ Excellent
Statements	92.66% (11,174 / 12,058)	✅ Excellent
Functions	93.19% (1,562 / 1,676)	✅ Excellent
Branches	86.06% (6,166 / 7,164)	✅ Strong

Overall test coverage remains in the excellent range across all metrics. The branch coverage of 86% is particularly strong for a network security utility where conditional logic is critical.

🛡️ Security-Critical Path Status

File	Coverage	Branch	Status
squid-config.ts	High	High	✅ Protected
host-iptables.ts	High	High	✅ Protected
docker-manager.ts	High	High	✅ Protected
domain-patterns.ts	High	High	✅ Protected
cli.ts	High	High	✅ Protected

All primary security-critical paths maintain excellent coverage. Domain validation, iptables rule generation, Squid configuration, and container orchestration are well-tested.

📋 Coverage Table — Files Below 80%

Only 5 files fall below 80% statement coverage:

File	Statements	Branches	Severity
bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL
enclave/runtime-preflight.ts	66.66%	41.02%	🟡 LOW
microvm/rootfs.ts	71.69%	54.54%	🟡 LOW
commands/validators/config-assembly.ts	73.68%	25.00%	🟡 LOW
test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100.00%	🟡 LOW (Test Utility)

🔧 Function Audit

• Total Functions: 1,676 (1,562 covered, 93.19%)
• Uncovered Functions: ~114 (~6.81%)
  • Majority in low-priority utility and test-helper modules
  • Enclave and microVM feature areas have new untested codepaths

📅 Recent Source Changes (last 7 days)

Recent commits show focus on:

1. Enclave Security — Added read-only GitHub CLI access, improved entry diagnostics
2. Cloud Hypervisor — Refactored manager lifecycle, split backend helpers
3. Core Hardening — Capability filtering, MCP gateway auth headers
4. Dependencies — Updated js-yaml to 5.4.0, ESLint to 8.68.0

Impact on Coverage: Enclave and Cloud Hypervisor modules added new codepaths without complete test coverage (see enclave/runtime-preflight.ts, microvm/rootfs.ts).

🔎 Notable Findings

1. 🚨 Critical Gap — finite-disclosure.ts (9.26%): This appears to be a newly added or substantially refactored module related to bounded execution. At 9.26% statements and 0.26% branches, this file represents untested security logic and should be treated as a blocker. Recommend immediate test authoring.

2. ⚠️ Enclave Module Regression — runtime-preflight.ts (66.66%) has dropped in coverage relative to feature additions. The recent PR test: recompile enclave smoke with deferred startup #7758 ("recompile enclave smoke with deferred startup") suggests new execution paths that lack integration test coverage.

3. 📦 microVM Feature Gap — microvm/rootfs.ts (71.69%) is undertested despite being part of Cloud Hypervisor v53.0 support. Recent refactors (Split Cloud Hypervisor manager lifecycle into focused modules #7796, refactor: split Cloud Hypervisor backend helpers #7797) suggest architectural changes may have outpaced test updates.

4. ✅ Test Utilities — config-writer-dependency-mocks.test-utils.ts is well-covered on branches (100%) but low on statements (73.91%) — this is acceptable for test helper code and not a priority.

🎯 Recommendations

High Priority 🔴

1. Add tests for bounded-execution/finite-disclosure.ts (Critical)
   • This module is 90.74% uncovered and appears to handle credential isolation or sensitive data
   • Create integration tests covering all decision branches
   • Target: ≥85% statement coverage, ≥80% branch coverage
   • Effort: 3–4 hours
   • Blocks: Any release that includes bounded-execution features

Medium Priority 🟡

2. Increase enclave/runtime-preflight.ts coverage to ≥80%

   • Recent feature additions (feat: add read-only GitHub CLI access to agent enclaves #7714, test: recompile enclave smoke with deferred startup #7758, Add protected enclave entry diagnostics #7772) added new code paths
   • Current 66.66% is acceptable for preview features but should improve as they stabilize
   • Target: ≥80% statement, ≥70% branch coverage
   • Effort: 2–3 hours
   • Timeline: Before next enclave feature release

3. Add microVM rootfs tests

   • microvm/rootfs.ts is critical for Cloud Hypervisor support
   • Recent manager refactors need integration coverage
   • Target: ≥80% statement, ≥75% branch coverage
   • Effort: 2 hours
   • Timeline: Before Cloud Hypervisor backend declared stable

Low Priority 🟢

4. Optional: Improve branch coverage on commands/validators/config-assembly.ts (25%)
   • This is already at 73.68% statements (acceptable)
   • Low branch coverage suggests some code paths aren't being exercised
   • Defer unless config validation bugs surface in production

---

Report Generated: 2026-08-28 | Coverage Data Source: npm test coverage-summary.json

Generated by Test Coverage Reporter · copilot · sum00 · 15.7 AIC · ⊞ 5.4K · ◷

• expires on Sep 4, 2026, 3:01 AM UTC