[Coverage Report] Test Coverage Report — 2026-09-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-09

Overall Coverage

Metric	Coverage	Details
Lines	94.05%	13,474 covered / 14,326 total
Statements	92.72%	14,150 covered / 15,261 total
Functions	93.41%	2,056 covered / 2,201 total
Branches	86.61%	8,122 covered / 9,377 total

Status: Overall coverage is strong (>90% across all metrics), well above industry baseline of 80%.

---

🛡️ Security-Critical Path Status

All primary firewall security paths are fully covered:

Module	Lines	Statements	Functions	Branches	Status
src/host-iptables.ts	100%	100%	100%	100%	✅ Excellent
src/squid-config.ts	100%	100%	100%	100%	✅ Excellent
src/docker-manager.ts	100%	100%	100%	100%	✅ Excellent
src/domain-patterns.ts	100%	100%	100%	N/A	✅ Excellent
src/cli.ts	85%	85%	100%	50%	⚠️ Moderate Gap

Key Finding: Core network isolation (iptables rules), domain ACL filtering (Squid config), and container orchestration (Docker management) are all comprehensively tested. However, src/cli.ts has branch coverage at 50%, indicating untested conditional paths in CLI argument handling or error recovery flows.

---

📋 Coverage Table

Top Coverage Areas (100%):

• API proxy domain configuration
• Squid proxy configuration generation
• Docker lifecycle management
• Domain pattern matching and validation
• Host iptables rule generation

Notable Coverage Gaps:

File	Statements	Branches	Issue
src/bounded-execution/finite-disclosure.ts	38.12%	25.89%	🔴 CRITICAL — Very low core module coverage
src/microvm/network-reservation.ts	50.22%	54.26%	🟡 Moderate gap in network setup
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 Preflight checks partially covered
src/microvm/rootfs.ts	71.69%	54.54%	🟡 Root filesystem setup incomplete
src/commands/validators/config-assembly.ts	73.68%	25.00%	🟡 Branch coverage very low (25%)

---

🔧 Function Audit

• Total Functions: 2,201
• Covered Functions: 2,056
• Uncovered Functions: 145 (6.59%)

Primary uncovered function clusters:

1. Error recovery paths in CLI/enclave modules
2. MicroVM network initialization helpers
3. Bounded execution disclosure/timeout handlers
4. Config validation branch conditions

---

📅 Recent Source Changes (last 7 days)

The following modules have been modified and warrant coverage review:

• src/microvm/network-reservation.ts — Only 50% coverage ⚠️
• src/microvm/rootfs.ts — Only 71% coverage ⚠️
• src/microvm/workflow-command-filter.ts — New changes
• src/microvm/network.ts, src/microvm/workspace.ts — Recent updates
• src/external-runtime-backend-resolver.ts — Modified (coverage unknown)
• src/guest-environment.ts, src/guest-protocol.test.ts — Modified

Risk: New microVM-related changes coincide with identified low-coverage areas. Network reservation and rootfs changes should be validated with focused integration tests.

---

🔎 Notable Findings

1. 🛡️ Security-Critical Paths: Fully Covered

   • All L7 firewall logic (Squid ACLs, domain matching) reaches 100%
   • All L3/L4 firewall logic (iptables rules) reaches 100%
   • Container orchestration (Docker Compose generation, lifecycle) reaches 100%
   • Risk from these paths is minimized ✅

2. 🔴 Bounded Execution Module at Risk

   • src/bounded-execution/finite-disclosure.ts at only 38% statements and 26% branches
   • This module handles resource limits and process timeout — critical for preventing runaway operations
   • Action Required: Add test cases for disclosure timeout paths and finite-resource edge cases

3. 🟡 MicroVM Networking Infrastructure Gap

   • network-reservation.ts (50%) and rootfs.ts (71%) are partially covered
   • Changes to these files in the last 7 days lack corresponding new tests
   • Risk: Cloud Hypervisor microVM backend may have untested network setup paths

4. ⚠️ CLI Branch Coverage Insufficient

   • src/cli.ts has only 50% branch coverage despite 85% statement coverage
   • Likely uncovered: error conditions, signal handlers (SIGINT/SIGTERM), graceful shutdown paths
   • Recommendation: Add branch-level tests for error scenarios and signal interrupts

---

🎯 Recommendations

🔴 HIGH Priority

1. Add tests for src/bounded-execution/finite-disclosure.ts (target: 80%)

   • Focus on timeout enforcement paths and resource-limit boundary conditions
   • Cover both success and failure disclosure scenarios
   • Impact: Critical for preventing infinite loops or resource leaks
   • Effort: 1–2 hours (est. 15–20 test cases)

2. Cover src/cli.ts error paths and branch conditions (target: 85% branches)

   • Add tests for graceful shutdown (SIGINT/SIGTERM handlers)
   • Test error recovery when containers fail or networks conflict
   • Cover all conditional branches in argument validation and config merging
   • Impact: Improves reliability and user experience during failures
   • Effort: 2–3 hours (est. 25–30 test cases)

🟡 MEDIUM Priority

3. Validate MicroVM network setup changes with integration tests
   • Review recent changes to network-reservation.ts (50%) and rootfs.ts (71%)
   • Add unit tests for network isolation and filesystem mount configurations
   • Consider end-to-end test: microVM launch → network access attempt → verification
   • Impact: Ensures Cloud Hypervisor backend security properties hold under new code
   • Effort: 2–4 hours (est. 20–25 test cases)

---

Report Generated: 2026-09-09
Test Suite: Jest
Coverage Tool: nyc (Istanbul)

Generated by Test Coverage Reporter · copilot · sum00 · 14.3 AIC · ⊞ 5.4K · ◷

• expires on Sep 16, 2026, 4:42 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-16T04:42:49.411Z.

Closed by Workflow