[Coverage Report] Test Coverage Report — 2026-08-17

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-17

Overall Coverage

Metric	Coverage	Details
Lines	93.87%	9,557 / 10,181 covered
Statements	92.71%	9,971 / 10,755 covered
Functions	93.2%	1,372 / 1,472 covered
Branches	85.84%	5,405 / 6,296 covered

Assessment: Overall coverage is strong (>92% for lines and statements), but branch coverage at 85.84% indicates some complex conditional paths need additional tests.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Status
src/host-iptables.ts	100%	100%	✅ Fully covered
src/host-iptables-rules.ts	100%	100%	✅ Fully covered
src/host-iptables-shared.ts	100%	100%	✅ Fully covered
src/squid-config.ts	100%	100%	✅ Fully covered
src/domain-patterns.ts	100%	89.47%	✅ Adequate
src/domain-matchers.ts	98.14%	95%	✅ Adequate
src/docker-manager.ts	100%	100%	✅ Fully covered
src/cli.ts	85.71%	50%	⚠️ Needs work

Key Finding: Core firewall components (host-iptables, squid-config) have excellent coverage. The main entry point (src/cli.ts) has gaps in branch coverage.

---

📋 Coverage Table

Tier 1 - Excellent (≥95%)

• src/api-proxy-config-warnings.ts: 100% statements, 100% branches
• src/host-identity.ts: 100% statements, 100% branches
• src/container-stop.ts: 100% statements, 100% branches
• src/config-mapper.ts: 100% statements, 100% branches
• src/schema-validator.ts: 100% statements, 100% branches
• src/ssl-bump.ts: 100% statements, 100% branches
• src/dns-resolver.ts: 97.61% statements, 93.54% branches
• src/option-parsers.ts: 97.5% statements, 94.44% branches

Tier 2 - Good (80–94%)

• src/sbx-manager.ts: 99.4% statements, 90.9% branches
• src/topology.ts: 98.93% statements, 92.3% branches
• src/container-lifecycle.ts: 96.23% statements, 90% branches
• src/pid-tracker.ts: 98.78% statements, 84.61% branches
• src/cloud-hypervisor-runtime-backend.ts: 94.57% statements, 80.21% branches

Tier 3 - Moderate (70–79%)

• src/cloud-hypervisor/exports.ts: 81.42% statements, 67.74% branches
• src/cloud-hypervisor/diagnostics.ts: 82.75% statements, 78.37% branches
• src/squid-log-reader.ts: 91.52% statements, 84.84% branches

---

🔧 Function Audit

Critical File Audits:

src/bounded-execution/finite-disclosure.ts – 🔴 CRITICAL

• Statements: 9.26% (43/464)
• Branches: 0.26% (1/377)
• Functions: 4.54% (2/44)
• Impact: This file handles sensitive disclosure control and finite execution isolation. Severely under-tested.

src/enclave/runtime-preflight.ts – 🟠 LOW

• Statements: 66.66% (lines available)
• Branches: 41.02%
• Impact: Enclave initialization and preflight checks are not fully exercised.

src/commands/validators/config-assembly.ts – 🟠 LOW

• Statements: 69.69%
• Branches: 20%
• Impact: Configuration assembly validation is under-covered, especially branch paths.

src/cloud-hypervisor/virtiofsd.ts – 🟠 LOW

• Statements: 72.51%
• Branches: 55.35%
• Impact: Virtio filesystem daemon integration has large untested areas.

src/microvm/rootfs.ts – 🟠 LOW

• Statements: 71.69%
• Branches: 54.54%
• Impact: Root filesystem setup for microVMs is incomplete.

---

📅 Recent Source Changes (last 7 days)

Recent modifications suggest active development in:

• Cloud Hypervisor integration and preflight validation
• Enclave runtime initialization
• Configuration assembly and validation
• Bounded execution finite disclosure logic

These areas align with identified low-coverage zones, indicating new code that hasn't yet received full test coverage.

---

🔎 Notable Findings

1. Security Perimeter: Strong — Core network isolation modules (host-iptables, squid-config, docker-manager) are all 100% covered, ensuring firewall correctness.

2. Branch Coverage Weak Spot — Overall branch coverage (85.84%) lags statements (92.71%) by ~7 points. Files like src/cli.ts (50% branch) and src/cloud-hypervisor/exports.ts (67.74% branch) need edge case testing.

3. New Features Under-Tested — Newer systems (Finite Disclosure: 9.26%, Enclaves: 66.66%, Cloud Hypervisor features: 72–82%) are in active development but lack comprehensive test suites. These are also complexity-critical and security-sensitive.

4. API Proxy & Logging Solid — API proxy, log aggregation, and DNS resolution are all >93% covered, indicating mature, well-tested paths.

---

🎯 Recommendations

Priority 1 (High) — Fix Critical Coverage Gaps

• File: src/bounded-execution/finite-disclosure.ts
• Action: Add unit tests for disclosure control logic, runtime probes, and edge cases in the 44 exported functions. Target: ≥80% statements, ≥60% branches.
• Rationale: This module is security-critical for sandboxing and currently nearly untested.

Priority 2 (High) — Increase Branch Coverage for Core CLI

• File: src/cli.ts
• Action: Add tests for error paths, signal handling (SIGINT/SIGTERM), and initialization failures. Current branch coverage is 50%.
• Rationale: The main entry point's reliability depends on handling all error branches correctly.

Priority 3 (Medium) — Improve Cloud Hypervisor Test Coverage

• Files: src/cloud-hypervisor/virtiofsd.ts, src/cloud-hypervisor/exports.ts, src/microvm/rootfs.ts
• Action: Add integration tests for virtio device setup, filesystem mount failures, and rootfs initialization. Target: ≥80% statements.
• Rationale: Cloud Hypervisor support is a new feature (preview stage) and needs robust test coverage before GA.

Generated by Test Coverage Reporter · sum00 · 21.8 AIC · ⊞ 5.3K · ◷

• expires on Aug 24, 2026, 6:44 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-24T18:44:44.462Z.

Closed by Workflow