[Coverage Report] Test Coverage Report — 2026-10-02

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-02

Overall Coverage Metrics (全项目)

• Statements: 91.29%
• Branches: 84.59%
• Functions: 89.35%
• Lines: 92.78%

Test Status: 413 passed, 1 failed, 414 total test suites | 6632 passed, 7 skipped, 6640 total tests

---

🛡️ Security-Critical Path Status

The following security-critical modules have EXCELLENT coverage:

Module	Stmts	Branch	Funcs	Lines	Status
squid-config.ts	100%	100%	100%	100%	✅ Fully covered
host-iptables.ts	100%	100%	100%	100%	✅ Fully covered
domain-patterns.ts	100%	89.47%	100%	100%	✅ Strong coverage
domain-matchers.ts	98.14%	95%	100%	98.14%	✅ Excellent coverage
domain-utils.ts	100%	100%	100%	100%	✅ Fully covered
domain-validation.ts	100%	100%	100%	100%	✅ Fully covered

📋 Coverage Table — Top Modules

Category	Module	Stmts	Branch	Funcs	Lines
Core	cli.ts	85.71%	50%	100%	85.71%
Core	squid-config.ts	100%	100%	100%	100%
Core	host-iptables.ts	100%	100%	100%	100%
Core	docker-manager.ts	100%	100%	100%	100%
Network	host-iptables-network.ts	100%	88.23%	100%	100%
Config	config-writer.ts	89.17%	83.21%	94.11%	89.47%
CLI	cli-workflow.ts	96.03%	94.11%	100%	95.95%
Containers	container-lifecycle.ts	96.35%	90%	95.65%	96.73%
Services	sbx-manager.ts	99.07%	88.18%	100%	100%

🚨 CRITICAL Coverage Gaps

Three modules fall below 50% statement coverage and require immediate attention:

Priority	Module	Stmts	Branch	Issue
🔴 CRITICAL	src/nvx/cleanup-registry.ts	42.8%	32.11%	Registry cleanup logic for microVM artifact lifecycle severely undertested
🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	Bounded resource-limit validation missing branch coverage for edge cases
🔴 CRITICAL	src/bounded-execution/finite-schema.ts	49.31%	42.66%	Schema validation for bounded execution constraints — critical for security gates
🟡 MEDIUM	src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	Disclosure filtering branch coverage extremely low (11.42%) despite 51% statement coverage
🟡 MEDIUM	src/microvm/network-reservation.ts	51.5%	54.86%	Network reservation logic for cloud-hypervisor backend incomplete

🔧 Remaining Module Audit

Strong Coverage (≥95%):

• src/diagnostics.ts (98.85% stmts, 98.11% branch)
• src/topology.ts (98.95% stmts, 94.87% branch)
• src/domain-sanitizer.ts (97.14% stmts, 93.33% branch)
• src/cloud-hypervisor/setup-identity.ts (98.48% stmts, 97.72% branch)
• src/cloud-hypervisor/setup-process.ts (94.68% stmts, 89.83% branch)

Coverage Gaps (70–80%):

• src/routing/bootstrap.ts (79.8% stmts, 68.27% branch) — routing initialization undertested
• src/cloud-hypervisor/vmm-identity.ts (75.86% stmts, 70.76% branch) — VM identity setup missing test cases
• src/cloud-hypervisor/artifact-verifier.ts (82.45% stmts, 66.05% branch) — artifact verification logic has low branch coverage
• src/cloud-hypervisor/manager-start.ts (80.83% stmts, 65% branch) — microVM manager startup path barely half-covered on branches

Concerning Patterns:

• Modules with ≥90% statement coverage but <70% branch coverage indicate conditionals not being exercised (false positive coverage)
• bounded-execution/ directory average: 58.27% stmts, 45.29% branch — entire subsystem is undertested

📅 Test Status Summary

• 413 test suites passed, 1 failed
  • Failing suite: src/services/api-proxy-env-config.test.ts
  • Failure reason: Expected service name mismatch in orchestrator test (non-critical)
• 6,632 tests passed, 7 skipped
• No security-critical test failures

🔎 Notable Findings

1. High-risk artifact: bounded-execution/ subsystem is critically under-tested (avg 58% stmts, 45% branches). This path is foundational for resource-limit validation and disclosure filtering — essential for security gates preventing unbounded output leaks.

2. Registry cleanup gap: nvx/cleanup-registry.ts (42.8% stmts) handles artifact lifecycle in cloud-hypervisor backend. Undertesting this increases risk of resource exhaustion or stale artifact leaks.

3. API proxy sidecar integration incomplete: src/services/api-proxy-env-config.test.ts failing due to orchestrator test setup — suggests API proxy credential injection path may need hardening.

4. Network isolation partially validated: src/host-iptables.ts and src/squid-config.ts are 100% covered, but routing layer (routing/bootstrap.ts 68.27% branch) has low conditional coverage — some network initialization paths untested.

🎯 Recommendations

HIGH Priority — Fix within 1–2 sprints:

1. Increase bounded-execution/finite-schema.ts branch coverage to ≥80% — Add test cases for:

   • All schema validation edge cases (empty, nested, circular refs)
   • Boundary conditions (max cardinality, max disclosure depth)
   • Error handling paths (malformed input, type mismatches)
   • Expected outcome: Ensure resource limits and disclosure gates cannot be bypassed

2. Audit and test nvx/cleanup-registry.ts artifact lifecycle — Add integration tests for:

   • Registry state cleanup after container stop
   • Artifact garbage collection on failure
   • Stale artifact recovery
   • Expected outcome: Achieve ≥80% statement coverage; prevent resource exhaustion

MEDIUM Priority — Address within 1–2 months:
3. Close finite-disclosure.ts branch coverage gap (11.42% → ≥75%):

• Test all string filtering branches (regex, encoding, truncation)
• Test boundary conditions (max length, escape sequences)
• Add negative tests (attempt to bypass filters)
• Expected outcome: Guarantee disclosure cannot bypass filtering logic

4. Improve routing initialization coverage — Test routing/bootstrap.ts (68.27% branch):
   • Network namespace setup edge cases
   • Failure recovery paths
   • Integration with iptables rules
   • Expected outcome: Achieve ≥85% branch coverage

LOW Priority — Backlog:
5. Reduce cli.ts branch coverage gap (50% → ≥85%):

• Test CLI flag combinations and error paths
• Expected outcome: Better CLI test harness for future developers

---

Summary: 91.29% overall statement coverage is healthy, but bounded-execution and nvx subsystems are critical gaps that require dedicated test hardening sprints. The security-critical core (iptables, squid, domain validation) is excellently tested at 100%.

Generated by Test Coverage Reporter · copilot · sum00 · 13.6 AIC · ⊞ 5.3K · ◷

• expires on Oct 9, 2026, 3:57 AM UTC