[Coverage Report] Test Coverage Report — 2026-10-14

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-14

Overall Coverage

Metric	Coverage
Statements	91.89%
Branches	85.64%
Functions	90.63%
Lines	93.31%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/nvx/cleanup-registry.ts	48.21%	38.53%	60%	47.54%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	59.58%	⚠️
src/nvx/cleanup-store.ts	65.59%	55.1%	71.42%	70.58%	⚠️
src/bounded-execution/strict-json-parser.ts	67.53%	65.04%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	72.72%	53.33%	100%	70.73%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/microvm/rootfs.ts	75.4%	58.33%	100%	75.86%	⚠️
src/enclave/github-gateway.ts	79.8%	74.13%	83.87%	82.56%	⚠️
src/routing/bootstrap.ts	79.8%	68.27%	83.33%	85.26%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
src/cloud-hypervisor/api-client.ts	95.06%	82.35%	90.9%	97.33%	✅
src/services/cli-proxy-service.ts	95.23%	90.74%	100%	98.14%	✅
src/cli-workflow.ts	96.62%	94.17%	100%	96.29%	✅
src/cli-options.ts	100%	93.33%	100%	100%	✅
TOTAL	91.89%	85.64%	90.63%	93.31%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 399 / Source files: 389

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
---
+export function namedUserAclUid(entry: string): number | undefined {
+export function composeDeviceAcl(
+export async function resolveTemporaryVmmAclUids(
+export async function preserveHostExecutorInvocationEvidence(
+export function hostExecutorJournalDirectory(run: Pick<HostExecutorRunState, 'journalDir'>): string {
+export function readHostExecutorInvocationDiagnostics(
+export function describeDeviceAclShape(entries: readonly string[]): string {
+export function parseDeviceAcl(contents: string): string[] {
+export function deviceAclArgument(entries: readonly string[]): string {
+export function sameDeviceAcl(

🔎 Notable Findings

• Security-critical files are at or near full coverage. host-iptables.ts, squid-config.ts, and docker-manager.ts are at 100% across statements, branches, and functions.
• Branch gaps remain in security-adjacent code. cli.ts has 50% branch coverage and domain-patterns.ts has 89.47%. The domain-patterns.ts report shows 2 uncovered if branches and 1 uncovered switch branch.
• Several new or lightly tested modules have very low coverage. bounded-execution/finite-cardinality.ts (46% statements, 35% branches) and nvx/cleanup-registry.ts (48% statements, 39% branches) are the lowest-covered files. Both are below 50% statement coverage.
• bounded-execution/finite-disclosure.ts has an extreme branch gap. It shows 11.42% branch coverage with 37.5% function coverage.

🎯 Recommendations

1. High: Add branch tests for src/cli.ts and src/domain-patterns.ts. Cover the uncovered if and switch branches in domain-patterns.ts (for example, invalid or edge-case domain inputs) and the untested branches in cli.ts. These sit on the domain-allowlist path, so they are the most security-relevant gaps.
2. High: Raise src/bounded-execution/finite-cardinality.ts and src/nvx/cleanup-registry.ts above 80%. Both are under 50% statement coverage. Add tests for their uncovered functions and error paths, starting with cleanup-registry.ts, where cleanup failures could leave resources behind.
3. Medium: Add tests for src/bounded-execution/finite-disclosure.ts. Its 11% branch coverage and 37.5% function coverage suggest most decision logic is untested. Prioritize the branch paths that decide what gets disclosed.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · copilot · sum00 · 0.769 AIC · ⊞ 7.2K · ◷

• expires on Oct 21, 2026, 5:08 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-21T17:08:35.734Z.

Closed by Workflow