[Coverage Report] Test Coverage Report — 2026-09-24

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-24

Overall Coverage

Metric	Coverage	Status
Statements	91.35%	✅ Strong
Lines	92.81%	✅ Strong
Functions	89.78%	✅ Strong
Branches	84.61%	⚠️ At Risk

Summary: The codebase maintains strong overall coverage across statements, lines, and functions (89–93%). However, branch coverage lags at 84.61%, indicating conditional paths are not fully exercised. This is particularly important for security-critical paths where edge cases must be tested.

---

🛡️ Security-Critical Path Status

The following files are essential for network isolation and firewall enforcement:

File	Statements	Branches	Status
src/cli.ts	85.71%	50.0%	🟡 Branch gaps
src/docker-manager.ts	TBD*	TBD*	✅ Needs audit
src/squid-config.ts	TBD*	TBD*	✅ Needs audit
src/domain-patterns.ts	TBD*	TBD*	✅ Needs audit
src/host-iptables-rules.ts	TBD*	TBD*	✅ Needs audit
src/host-iptables-shared.ts	TBD*	TBD*	✅ Needs audit

Key Concern: src/cli.ts shows 50% branch coverage, meaning half of all conditional branches in the main entry point are untested. This is a critical gap for a security wrapper.

---

📋 Coverage Table

Top Gap Areas (pre-identified from test artifacts):

Severity	File	Statements	Branches	Issue
🔴 CRITICAL	src/nvx/cleanup-registry.ts	42.8%	32.11%	Registry cleanup error paths untested
🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	Cardinality enforcement edge cases missing
🔴 CRITICAL	src/bounded-execution/finite-schema.ts	49.31%	42.66%	Schema validation branches uncovered
🟡 MEDIUM	src/microvm/network-reservation.ts	51.08%	55.07%	Network allocation paths partially tested
🟡 MEDIUM	src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	Disclosure filtering nearly untested (11% branch)

---

🔧 Function Audit

Notable Coverage Patterns:

• 100% Coverage Files (27 files):

  • src/api-proxy-config-domains.ts — Domain validation fully tested ✅
  • src/api-proxy-config-warnings.ts — Warning logic fully tested ✅
  • src/chroot-home-setup.ts — Home directory setup fully tested ✅
  • src/cli-options.ts — CLI option parsing fully tested ✅

• >95% Coverage Files (good security baseline):

  • src/artifact-preservation.ts (95.03%)
  • src/capability-filter.ts (94.82%)
  • src/cli-workflow.ts (98.75%)

• <80% Coverage Files (requires attention):

  • src/cli.ts — 85.71% overall, 50% branches ⚠️
  • src/artifact-permissions.ts (82.08%)

---

📅 Recent Source Changes (Last 7 Days)

Note: Git history access was restricted in this environment. Please review recent commits manually via:

git log --since="7 days ago" --oneline -- src/

Key areas to re-test after recent changes:

• Any modifications to src/bounded-execution/* files (currently < 50% coverage)
• Updates to src/nvx/cleanup-registry.ts (critical path)
• CLI entry point changes in src/cli.ts

---

🔎 Notable Findings

1. Branch Coverage Crisis in CLI Entry Point: src/cli.ts has only 50% branch coverage. This is the main orchestration point for the firewall and must have comprehensive conditional testing. This gap affects error handling, signal handling, and edge cases in container startup.

2. Bounded Execution Framework Under-Tested: Three files in src/bounded-execution/ have < 50% statement coverage (42–49%), and finite-disclosure.ts has only 11.42% branch coverage. These implement disclosure filtering and cardinality limits — security-critical constraints that must be bulletproof.

3. Registry Cleanup Missing Error Paths: src/nvx/cleanup-registry.ts (42.8% coverage) lacks testing for error conditions in NVX container registry cleanup. Failures here could leak credentials or leave dangling resources.

4. Strong Coverage on Proxy Configuration: Files like api-proxy-config-domains.ts and api-proxy-config-warnings.ts are at 100% coverage, indicating good test discipline for the API proxy layer.

---

🎯 Recommendations

🔴 HIGH PRIORITY

1. Increase src/cli.ts branch coverage from 50% to ≥90%

   • Add tests for all conditional branches (error paths, signal handling, startup failures)
   • Estimated effort: 4–6 hours
   • Impact: Hardens the critical entry point and orchestration logic

2. Complete bounded-execution test suite

   • Target finite-cardinality.ts, finite-schema.ts, and finite-disclosure.ts to ≥80% coverage
   • Focus on edge cases: boundary values, invalid inputs, resource exhaustion
   • Estimated effort: 6–8 hours
   • Impact: Ensures disclosure filtering and cardinality limits are bulletproof

🟡 MEDIUM PRIORITY

3. Add error-path testing for NVX registry cleanup
   • Test src/nvx/cleanup-registry.ts failure modes: network errors, permission denied, registry unavailable
   • Target: ≥80% coverage
   • Estimated effort: 3–4 hours
   • Impact: Prevents credential leaks and orphaned resources in microVM scenarios

⚪ LOW PRIORITY

4. Optimize branch coverage across the board from 84.61% → 90%+
   • Focus on conditional branches in security-critical files (host-iptables, squid-config, docker-manager)
   • Add integration tests for multi-container scenarios
   • Estimated effort: Ongoing, 2 hours per sprint

---

📌 Next Steps

1. For Developers: Use npm run test:coverage to generate detailed coverage reports. Review files flagged in the Coverage Table above.
2. For Security: Manually audit the three CRITICAL files (cleanup-registry.ts, finite-cardinality.ts, finite-schema.ts) for untested error paths.
3. For QA: Prioritize integration tests that exercise error conditions in container startup and cleanup (helps close gaps in cli.ts).

Generated: 2026-09-24 (pre-computed coverage data, coverage summary from coverage/coverage-summary.json)

Generated by Test Coverage Reporter · copilot · sum00 · 11.7 AIC · ⊞ 5.3K · ◷

• expires on Oct 1, 2026, 3:06 AM UTC

[arianegirtz99-hue]

****