[Coverage Report] Test Coverage Report — 2026-08-28

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-28

Overall Coverage

Excellent overall coverage with one critical security gap:

Metric	Coverage	Status
Statements	92.67%	✅
Branches	86.10%	✅
Functions	93.23%	✅
Lines	93.87%	✅

Interpretation: The codebase has strong overall coverage above the 90% benchmark. However, branch coverage (86.10%) indicates some conditional logic paths remain untested, particularly in exception handling and edge cases.

---

🛡️ Security-Critical Path Status

Host iptables (Network Isolation) — 100% ✅

• host-iptables.ts: 100% statements, 100% branches
• host-iptables-rules.ts: 100% statements, 100% branches
• host-iptables-shared.ts: 100% statements, 100% branches
• host-iptables-validation.ts: 100% statements, 100% branches
• Assessment: Network isolation rules are fully tested — no gaps.

Domain Pattern Matching — 100% statements, 89.47% branches ⚠️

• domain-patterns.ts: 100% statements, but only 89.47% branch coverage
• Issue: Some edge cases in domain normalization/validation logic may not be tested
• Severity: LOW — core logic is covered, but some conditional branches need test cases

Squid Proxy Config — 100% ✅

• squid-config.ts: 100% statements, 100% branches
• Assessment: Domain ACL filtering logic is fully covered.

Docker Manager — 100% ✅

• docker-manager.ts: 100% statements (modularized re-exports only)
• Related files all at 100% or near-complete coverage

Main CLI Entry — 85.71% statements, 50% branches ⚠️

• cli.ts: 85.71% statements, 50% branch coverage
• Issue: Some orchestration or error handling paths untested
• Severity: MEDIUM — orchestration logic should be fully covered

---

📋 Coverage Table (Low Coverage Files)

File	Statements	Branches	Status
CRITICAL
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL
MEDIUM/LOW
src/cloud-hypervisor/virtiofsd.ts	74.84%	61.84%	🟡
src/microvm/rootfs.ts	71.69%	54.54%	🟡
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡
src/enclave/github-gateway.ts	73.95%	66.25%	🟡
src/commands/validators/config-assembly.ts	73.68%	25%	🟠
src/cloud-hypervisor/manager.ts	87.5%	78.26%	🟢
src/cloud-hypervisor/exports.ts	83.33%	71.21%	🟢

---

🔧 Function Audit

Fully Tested Functions (100% statement coverage):

• All host iptables chain management functions
• Domain pattern validators
• API proxy configuration generators
• Docker Compose orchestration (15/15 functions)
• Squid configuration builders (2/2 functions)

Partially Tested Functions:

• Cloud Hypervisor manager: 83.33% of functions tested (45/54)
  • Missing: Error handling paths, edge cases in lifecycle management
• Launcher module: 64.28% of functions tested (9/14)
  • Missing: Some VM startup scenarios, recovery paths
• virtiofsd setup: 47.61% of functions tested (10/21)
  • Missing: Filesystem permission validation, mount error scenarios

Untested Module:

• bounded-execution/finite-disclosure.ts: Only 2/44 functions tested (4.54%)
  • This is the single largest coverage gap and is security-relevant

---

📅 Recent Source Changes (Last 7 Days)

Recent commits with coverage implications:

1. Capability filter re-exports in docker-manager — High impact to tested code ✅
2. API proxy CA certificate support — New feature, likely with lower coverage initially
3. Orphaned Docker network cleanup — Integration testing required
4. Cloud Hypervisor guest filesystem and capability hardening — Critical paths should be tested
5. Enclave gateway Authorization header contract hardening — Security-critical, check coverage

---

🔎 Notable Findings

• Critical Gap: finite-disclosure.ts (9.26% coverage) is severely undertested. This module appears security-relevant given its name. Immediate investigation required.
• Branch Coverage Gap: While statement coverage is strong at 92.67%, branch coverage at 86.10% suggests exception handling and defensive conditions need test cases (particularly in cloud-hypervisor and enclave modules).
• Cloud Hypervisor Module Trend: Newer Cloud Hypervisor infrastructure (virtiofsd, rootfs, launcher) has lower function coverage (47–76%), indicating new features need additional integration tests.
• Enclave Runtime Preflight: Only 41.02% branch coverage despite 100% statement coverage — indicates branch-heavy validation logic with incomplete paths.

---

🎯 Recommendations

High Priority

1. Investigate and cover finite-disclosure.ts (9.26% coverage)
   • Audit the purpose of this module (seems security-related based on naming)
   • Add unit tests for the 42 untested functions
   • Add integration tests for bounded execution scenarios
   • Timeline: Critical blocker

Medium Priority
2. Improve Cloud Hypervisor virtiofsd coverage (74.84% statements)

• Focus on mount permission edge cases, filesystem validation
• Add negative test cases for virtiofsd setup failures
• Target: 90%+ statement coverage, 80%+ branch coverage

3. Complete cli.ts orchestration tests (50% branch coverage)
   • Add signal interrupt (SIGINT/SIGTERM) handling tests
   • Test container startup/cleanup error paths
   • Test config generation validation edge cases
   • Target: 95%+ coverage

Low Priority
4. Increase domain-patterns branch coverage (89.47%)

• Add test cases for subdomain normalization edge cases
• Test invalid domain format handling
• Target: 95%+ branch coverage

Generated by Test Coverage Reporter · copilot · sum00 · 19.7 AIC · ⊞ 5.4K · ◷

• expires on Sep 4, 2026, 9:52 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-04T21:52:24.896Z.

Closed by Workflow