[Coverage Report] Test Coverage Report — 2026-10-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-21

Overall Coverage

Metric	Coverage
Statements	91.85%
Branches	85.92%
Functions	91.01%
Lines	93.42%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=87.5% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/resolved-config-artifact.ts	46.6%	45%	75%	50.53%	❌
src/nvx/cleanup-registry.ts	48.21%	38.53%	60%	47.54%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/nvx/cleanup-store.ts	64.04%	55.1%	70%	69.13%	⚠️
src/enclave/docker-host-storage.ts	68.51%	72.34%	65%	70.78%	⚠️
src/bounded-execution/strict-json-parser.ts	68.83%	66.99%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	72.91%	55.31%	100%	71.11%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/microvm/rootfs.ts	75.4%	58.33%	100%	75.86%	⚠️
src/bounded-execution/finite-schema.ts	78.94%	77.57%	96.15%	81.68%	⚠️
src/cli.ts	87.5%	50%	100%	87.5%	✅
src/microvm/vsock-client.ts	92.93%	87.63%	90%	96%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
src/cloud-hypervisor/api-client.ts	95.06%	82.35%	90.9%	97.33%	✅
src/services/cli-proxy-service.ts	95.23%	90.74%	100%	98.14%	✅
src/cli-workflow.ts	96.62%	93.33%	100%	96.29%	✅
src/cli-options.ts	100%	93.33%	100%	100%	✅
TOTAL	91.85%	85.92%	91.01%	93.42%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 431 / Source files: 417

Note: the per-function audit for host-iptables.ts and squid-config.ts returned no entries, so it does not confirm function-level coverage for those files. The file-level metrics above show 100%.

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-gemini-settings.test.ts
src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
---
+export function isRouterOtelHostEnvVar(name: string): boolean {
+export function buildRouterOtelEnv(hostEnv: NodeJS.ProcessEnv): Record<string, string> {
+export function redactOtlpEnvValue(name: string, value: unknown): unknown {
+export function buildRouterService({ imageConfig, hostEnv = process.env }: RouterServiceParams): any {
+export function createPrimaryReadinessReporter(directory: string) {
+export function createDockerHostEnclaveExecutor(options: DockerHostEnclaveExecutorOptions): DockerHostEnclaveExecutorBackend {
+export async function recoverDockerHostEnclaveExecutor(
+export function captureDockerHostOwner(): DockerHostOwnerIdentity {
+export function assertDockerHostOwnerStopped(owner: DockerHostOwnerIdentity | undefined, current: DockerHostOwnerIdentity): void {
+export function expectedDockerHostContainer(args: readonly string[]): DockerHostExpectedContainer {

🔎 Notable Findings

• Security-critical files are fully covered. host-iptables.ts, squid-config.ts, docker-manager.ts, and domain-patterns.ts are at 100% statements and functions. The only weak spot is branch coverage in domain-patterns.ts (89.47%) and cli.ts (50%).
• src/cli.ts has the lowest branch coverage among critical paths at 50%, despite 87.5% statements. Its untested branches are in the orchestration entry point.
• Three files are critically low (under 50% statements): bounded-execution/finite-cardinality.ts, resolved-config-artifact.ts, and nvx/cleanup-registry.ts. None are on the security-critical list, but cleanup-registry.ts manages resource teardown, so gaps there could leave resources behind.
• bounded-execution/finite-disclosure.ts has 11.42% branch coverage, the lowest branch figure in the report.
• Recent changes add new exported functions in docker-manager-adjacent enclave code (for example createDockerHostEnclaveExecutor, recoverDockerHostEnclaveExecutor, assertDockerHostOwnerStopped). These are new public surface and should have direct tests.

🎯 Recommendations

1. High: Add branch tests for src/cli.ts. It is the main entry point and sits at 50% branch coverage. Cover the error and flag-combination paths in orchestration.
2. High: Add tests for src/nvx/cleanup-registry.ts and src/resolved-config-artifact.ts. Both are under 50% statements. Prioritize cleanup and teardown paths to prevent leaked resources.
3. Medium: Test the new enclave Docker-host functions (createDockerHostEnclaveExecutor, recoverDockerHostEnclaveExecutor, assertDockerHostOwnerStopped, captureDockerHostOwner). They are recent additions with no visible direct coverage in this report.
4. Low: Raise branch coverage in src/bounded-execution/finite-disclosure.ts (11.42%) and src/domain-patterns.ts (89.47%, the remaining branches of its two if statements and one switch).

Generated by Test Coverage Reporter · copilot · sum00 · 0.796 AIC · ⊞ 7.3K · ◷

• expires on Oct 28, 2026, 8:58 PM UTC