[Coverage Report] Test Coverage Report — 2026-08-28

[github-actions[bot]]

The project maintains strong test coverage across core infrastructure:

Metric	Coverage	Status
Statements	92.67%	✅ Excellent
Branches	86.09%	✅ Good
Functions	93.21%	✅ Excellent
Lines	93.85%	✅ Excellent

Summary: 253 files tracked; 92% statement coverage across 12,073 total statements.

🛡️ Security-Critical Path Status

Component	Statements	Branches	Functions	Status
host-iptables-rules.ts	100%	100%	100%	✅ Fully Covered
host-iptables.ts	100%	100%	100%	✅ Fully Covered
domain-patterns.ts	100%	89.47%	100%	✅ Excellent
squid-config.ts	100%	100%	100%	✅ Fully Covered
cli.ts	85.71%	50%	100%	⚠️ Branch Gap
bounded-execution/finite-disclosure.ts	9.26%	0.26%	4.54%	🔴 CRITICAL
enclave/runtime-preflight.ts	66.66%	41.02%	100%	🟡 Medium
microvm/rootfs.ts	71.69%	54.54%	100%	🟡 Medium
config-assembly.ts	73.68%	25%	100%	🟡 Medium

Key Findings:

• ✅ Core firewall security (iptables, domain ACL, squid config) is fully tested
• 🔴 finite-disclosure.ts has critical coverage gaps (9% statements, 0% branches) — this component controls disclosure of sensitive execution data
• 🟡 Enclave/microvm support areas have moderate gaps that should be addressed

📋 Coverage Details

Fully Covered (100% statements)

• src/host-iptables-rules.ts — All iptables rule generation paths tested
• src/host-iptables-cleanup.ts — Cleanup procedures fully exercised
• src/host-iptables-network.ts — Network topology setup fully covered
• src/host-iptables-shared.ts — Shared utilities (routing, helpers) 100% tested
• src/host-iptables-validation.ts — Rule validation logic fully covered
• src/host-iptables.ts — Main iptables module fully tested
• src/domain-patterns.ts — Domain pattern matching 100% covered
• src/squid-config.ts — Proxy configuration generation fully tested

High Coverage (90–99%)

• src/cli-workflow.ts — 98.63% (main CLI workflow orchestration)
• src/cli-options.ts — 100% (option parsing)
• src/cloud-hypervisor/api-client.ts — 97.33% (REST API client)
• src/microvm/vsock-client.ts — 97.32% (vsock communication)
• src/services/cli-proxy-service.ts — 98.11% (CLI proxy)

🔧 Function Audit

Host iptables subsystem: All core modules (rules, cleanup, network, shared, validation) have 100% statement coverage. 9 functions tested across 5 modules, ensuring network isolation rules are properly validated and applied.

Domain pattern matching: All 3 domain-matching functions fully tested (100%). Pattern validation and subdomain resolution both have comprehensive test coverage.

CLI entry point: Main CLI module has only 7 statements (architectural constraint). 85.71% statement coverage (1 line) and only 50% branch coverage (1 untested branch) suggests one conditional path remains untested.

Bounded Execution (finite-disclosure): 44 total functions, only 2 tested (4.54%). This module controls disclosure of sensitive execution state. Coverage is critically low and requires urgent expansion.

📅 Recent Source Changes (last 7 days)

All monitored source files were updated 2026-08-28 18:37–18:38. No file-specific regressions detected from previous week.

🔎 Notable Findings

1. Security-critical coverage is strong: Core firewall components (iptables rules, domain patterns, squid config) all achieve 100% statement coverage, providing high confidence in network isolation behavior and domain whitelisting enforcement.

2. Critical coverage regression in bounded-execution/finite-disclosure.ts: Only 9% of statements and 0.26% of branches are covered. This module is responsible for controlling disclosure of sensitive agent state to monitoring systems. Of 44 functions, only 2 are exercised. This is a security control that warrants urgent test expansion.

3. Branch coverage gap in cli.ts: Statement coverage is 85.71%, but only 50% of branches are covered (1 of 2). This suggests an untested error path or conditional in the main entry point. Should be reviewed for error handling coverage.

4. Enclave and microVM features have moderate gaps: runtime-preflight.ts (66% statements, 41% branches) and rootfs.ts (71% statements, 54% branches) are newer subsystems with room for improvement. config-assembly.ts has only 25% branch coverage, indicating many conditional paths remain untested.

🎯 Recommendations

Priority	Item	Effort	Impact
🔴 High	Expand finite-disclosure.ts tests to achieve ≥85% statement coverage and ≥80% branch coverage. Add tests for all 44 functions, focusing on disclosure control edge cases and error conditions. This is a critical security control.	2–3 days	Critical disclosure control; currently only 9% exercised
🟡 Medium	Improve cli.ts branch coverage from 50% to 100% by testing the untested conditional. Review error handling paths in main CLI orchestration.	1–2 hrs	CLI entry point robustness; catch potential silent failures
🟡 Medium	Expand enclave/microVM test suite for new feature stability: Target 75% branches for runtime-preflight.ts and 70% for rootfs.ts. Focus on error handling and edge cases in initialization and configuration.	2–3 days	New feature stability; better error resilience

---

Generated: 2026-08-28
Recommendation Priority: High — Address finite-disclosure.ts before next release

Generated by Test Coverage Reporter · copilot · sum00 · 22.5 AIC · ⊞ 5.4K · ◷

• expires on Sep 4, 2026, 6:44 PM UTC