[Coverage Report] Test Coverage Report — 2026-10-02

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-02

Overall Coverage

Metric	Coverage	Count
Lines	92.81%	18,238 / 19,649
Statements	91.29%	19,223 / 21,057
Functions	89.34%	2,877 / 3,220
Branches	84.69%	11,315 / 13,360

Assessment: Overall coverage is strong at 91%+ for lines and statements, with branch coverage slightly lower at 84.69%. This indicates good line-level and logical coverage, though some conditional edge cases remain untested.

🛡️ Security-Critical Path Status

File	Statements	Functions	Branches	Status
src/host-iptables-rules.ts	✅ 100.0%	✅ 100.0%	✅ 100.0%	EXCELLENT
src/host-iptables-shared.ts	✅ 100.0%	✅ 100.0%	✅ 100.0%	EXCELLENT
src/docker-manager.ts	✅ 100.0%	✅ 100.0%	—	EXCELLENT
src/domain-patterns.ts	✅ 100.0%	✅ 100.0%	89.47%	GOOD
src/domain-matchers.ts	98.14%	✅ 100.0%	95.0%	EXCELLENT
src/container-lifecycle.ts	96.35%	95.65%	90.0%	GOOD
src/cli.ts	⚠️ 85.71%	✅ 100.0%	50.0%	NEEDS ATTENTION
src/config-writer.ts	89.17%	94.11%	83.21%	ADEQUATE

Key Findings:

• Network isolation (host-iptables) is fully covered — excellent for security-critical enforcement
• Domain filtering (domain-patterns, domain-matchers) is 99%+ covered — ACL rules well-tested
• Container lifecycle management is 96%+ covered — orchestration is robust
• Risk: cli.ts (main entry) has only 50% branch coverage and 85.71% statement coverage, with 1 uncovered line

📋 Coverage Table

Critical Low-Coverage Modules (< 52% Statements)

#	File	Statements	Functions	Branches	Issue
1	src/nvx/cleanup-registry.ts	🔴 42.80%	54.23%	32.11%	Major: Registry cleanup logic undertested
2	src/bounded-execution/finite-cardinality.ts	🔴 46.03%	66.66%	35.29%	Major: Cardinality enforcement incomplete
3	src/bounded-execution/finite-schema.ts	🔴 49.77%	69.56%	43.11%	Major: Schema validation gaps

Medium-Coverage Modules (< 80% Statements)

#	File	Statements	Functions	Branches
4	src/microvm/network-reservation.ts	51.50%	58.33%	54.86%
5	src/bounded-execution/finite-disclosure.ts	⚠️ 51.78%	37.50%	🔴 11.42%
6	src/artifact-permissions.ts	82.08%	80.0%	80.0%
7	src/host-env.ts	95.23%	✅ 100.0%	85.71%

Branch Coverage Concerns

• src/cli.ts: 50% branch coverage (1 of 2 branches untested)
• src/bounded-execution/finite-disclosure.ts: 11.42% branch coverage (only 4 of 35 branches tested)
• src/compose-network-conflicts.ts: 85.41% branch coverage (7 untested branches in conflict detection)

🔧 Function Audit

Uncovered/Undertested Functions:

• src/cloud-hypervisor-runtime-backend.ts: 50% functions covered (3 of 6), but 100% statements (likely utility re-exports)
• src/container-cleanup.ts: 80% functions (4 of 5), 100% statements (1 cleanup path untested)
• src/bounded-execution/finite-disclosure.ts: 37.5% functions (3 of 8) — disclosure logic incomplete

📅 Recent Source Changes (last 7 days)

Modules Modified:

• src/domain-patterns.ts — 100% coverage maintained ✅
• src/host-env.ts — 95.23% coverage (2 lines uncovered)
• src/runner-tool-cache.ts — modified, check coverage
• src/services/agent-volumes/* — 10+ files modified, coverage varies 80–100%

Volume mount subsystem sees frequent changes; coverage is generally good (85%+) but should be monitored.

🔎 Notable Findings

1. Security Baseline Strong: Host-level network isolation (host-iptables-*.ts) and domain ACL enforcement (domain-*.ts) have excellent coverage, indicating firewall rules are well-tested. ✅

2. Emerging Components Undertested: The new bounded-execution/ and nvx/ modules (cleanup-registry, finite-cardinality, finite-schema) have critical gaps in coverage (<50%), likely because they are newer or feature-flagged. These manage resource limits and lifecycle hooks and must be prioritized.

3. Branch Coverage Gap in CLI: The main entry point (cli.ts) has only 50% branch coverage, leaving at least one error-handling or exit-path untested. This is a quality-of-life issue but not a direct security risk.

4. Disclosure Logic (11% Branches): src/bounded-execution/finite-disclosure.ts has only 11.42% branch coverage, indicating most edge cases and failure modes in credential/secret disclosure prevention are untested. This is a potential security regression vector.

🎯 Recommendations

🔴 HIGH — Immediate Action Required

1. Fix src/bounded-execution/finite-disclosure.ts branch coverage (11.42% → 80%+)

   • Why: Disclosure prevention is security-critical. Untested branches may hide credential leaks or information exposure bugs.
   • Action: Add test cases for all conditional paths (success, failure, null/undefined, edge encoding), especially around secret handling.
   • Effort: 2–3 hours

2. Raise src/nvx/cleanup-registry.ts to 70%+ coverage

   • Why: Registry cleanup manages resource lifecycle and state. Under 43% coverage risks resource leaks or corrupt cleanup operations.
   • Action: Test cleanup paths, error recovery, and state transitions (registering, deregistering, error cases).
   • Effort: 3–4 hours

🟡 MEDIUM — Next Sprint

3. Expand src/bounded-execution/finite-cardinality.ts and finite-schema.ts to 75%+ coverage

   • Why: Resource and schema validation prevent DoS and invalid inputs. Current <50% coverage leaves enforcement gaps.
   • Action: Add tests for boundary conditions, overflow/underflow, validation rules, and error reporting.
   • Effort: 4–5 hours combined

4. Add branch coverage to src/cli.ts (50% → 85%+)

   • Why: Main entry point error handling should be tested. One untested branch could hide startup failures or graceful-exit bugs.
   • Action: Cover error paths in config loading, container startup, and signal handling.
   • Effort: 1–2 hours

⚪ LOW — Backlog

5. Monitor src/config-writer.ts (89.17% statements, 83.21% branches)
   • Status: Acceptable but borderline. If this is modified for new features, bring it to 90%+.
   • Effort: 1 hour per feature addition

---

Baseline: With 91.29% statement coverage overall and security-critical modules at 95–100%, the codebase demonstrates good test health. However, the three critical CRITICAL modules require immediate remediation to close resource-management and disclosure-prevention gaps before the next release.

Generated by Test Coverage Reporter · copilot · sum00 · 28.6 AIC · ⊞ 5.3K · ◷

• expires on Oct 9, 2026, 8:48 PM UTC