[Coverage Report] Test Coverage Report — 2026-10-13

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-13

Overall Coverage

Metric	Coverage
Statements	91.72%
Branches	85.47%
Functions	90.38%
Lines	93.18%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	54.23%	41.32%	❌
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	59.58%	⚠️
src/nvx/cleanup-store.ts	65.59%	55.1%	71.42%	70.58%	⚠️
src/bounded-execution/strict-json-parser.ts	67.53%	65.04%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	72.72%	53.33%	100%	70.73%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/microvm/rootfs.ts	75.4%	58.33%	100%	75.86%	⚠️
src/cloud-hypervisor/cleanup-vmm-identity.ts	75.86%	70.76%	100%	79.24%	⚠️
src/enclave/github-gateway.ts	79.8%	74.13%	83.87%	82.56%	⚠️
src/routing/bootstrap.ts	79.8%	68.27%	83.33%	85.26%	⚠️
src/nvx/runtime-lifecycle.ts	79.88%	63.59%	92.98%	84.56%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
src/cloud-hypervisor/api-client.ts	95.06%	82.35%	90.9%	97.33%	✅
src/services/cli-proxy-service.ts	95.16%	91.52%	100%	98.11%	✅
TOTAL	91.72%	85.47%	90.38%	93.18%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 396 / Source files: 387

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
---
+export function buildMicrovmScratchInit(scratchMib: number, supervisorGuestPath: string): string {
+export function isCloudHypervisorScriptAcceptanceWorkflow(
+export function resolveAgentRuntimeStartFile(workDir: string, proxyLogsDir?: string): string {
+export function readAgentRuntimeStartTimeMs(workDir: string, proxyLogsDir?: string): number | undefined {
+export function ensureAgentRuntimeStartMarker(workDir: string, proxyLogsDir?: string): number | undefined {
+export function assertCloudHypervisorEnclaveExportsIsolated(
+export function validateEnclavesStructure(
+export function resolveRunSandboxBackend(primaryRuntime?: string): RunSandboxBackend {
+export function validateRunSandboxBackend(
+export async function captureEnclaveStartupDiagnostics(

🔎 Notable Findings

• All five security-critical files are at 100% statements and functions. host-iptables.ts, squid-config.ts, and docker-manager.ts are fully covered on all metrics.
• src/cli.ts branch coverage is 50%, the weakest branch figure among the security-critical set. It is marked OK only because it is in the statement/function range.
• src/domain-patterns.ts has 89.47% branch coverage. Its uncovered branches are in the if/switch paths listed in the function audit.
• Five non-security-critical files are below 60% statements, and nine are below 80%. The lowest are nvx/cleanup-registry.ts (42.8%) and bounded-execution/finite-cardinality.ts (46.03%).

🎯 Recommendations

1. High: Add tests for src/nvx/cleanup-registry.ts and src/bounded-execution/finite-cardinality.ts. Both are below 50% statements and about 35% branch coverage. These are the top gaps in the coverage-gaps brief.
2. Medium: Raise branch coverage in src/cli.ts and src/domain-patterns.ts. cli.ts is at 50% branches; domain-patterns.ts is at 89.47%. Target the uncovered branches, since both files are on the security-critical list.
3. Low: Improve src/bounded-execution/finite-disclosure.ts branch coverage (11.42%) and the 50–60% files (microvm/network-reservation.ts, bounded-execution/finite-schema.ts). Prioritize after the items above.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · copilot · sum00 · 0.784 AIC · ⊞ 7.2K · ◷

• expires on Oct 20, 2026, 6:04 PM UTC

[github-actions[bot]]

Oracle Omen

🔮 The ancient spirits stir; the smoke-test agent has walked this thread and left its sigil in passing.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test wanderer has passed this hall. The omens were read, the forge was tested, and this oracle leaves its trace in moonlit code.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the oracle records that the smoke test agent walked this hall. The omens shimmer; the rite is witnessed.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-20T18:04:33.064Z.

Closed by Workflow

[ywsfnra-boopasdf123]

📊 تقرير تغطية الاختبار — 13-10-2026

التغطية الشاملة

متري التغطية
عبارات 91.72%
الفروع 85.47%
وظائف 90.38%
أسطر 93.18%

🛡️ حالة المسار الحرج للأمن

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 جدول التغطية

ملف عبارات فرع الدوال أسطر الحالة
src/nvx/cleanup-registry.ts 42.8% 32.11% 54.23% 41.32% ❌
src/bounded-execution/finite-cardinality.ts 46.03% 35.29% 66.66% 52.83% ❌
src/microvm/network-reservation.ts 51.5% 54.86% 58.33% 53.27% ⚠️
src/bounded-execution/finite-disclosure.ts 51.78% 11.42% 37.5% 54.16% ⚠️
src/bounded-execution/finite-schema.ts 57.07% 56.88% 73.91% 59.58% ⚠️
src/nvx/cleanup-store.ts 65.59% 55.1% 71.42% 70.58% ⚠️
src/bounded-execution/strict-json-parser.ts 67.53% 65.04% 100% 83.49% ⚠️
src/nvx/preflight.ts 70.83% 73.33% 54.54% 72.03% ⚠️
src/enclave/runtime-preflight.ts 72.72% 53.33% 100% 70.73% ⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts 73.91% 100% 80% 66.66% ⚠️
src/microvm/rootfs.ts 75.4% 58.33% 100% 75.86% ⚠️
src/cloud-hypervisor/cleanup-vmm-identity.ts 75.86% 70.76% 100% 79.24% ⚠️
src/enclave/github-gateway.ts 79.8% 74.13% 83.87% 82.56% ⚠️
src/routing/bootstrap.ts 79.8% 68.27% 83.33% 85.26% ⚠️
src/nvx/runtime-lifecycle.ts 79.88% 63.59% 92.98% 84.56% ⚠️
src/cli.ts 85.71% 50% 100% 85.71% ✅
src/microvm/vsock-client.ts 93.07% 90.6% 91.3% 97.07% ✅
src/enclave/delegation-control-client.ts 94.92% 94.73% 92% 94.53% ✅
src/cloud-hypervisor/api-client.ts 95.06% 82.35% 90.9% 97.33% ✅
src/services/cli-proxy-service.ts 95.16% 91.52% 100% 98.11% ✅
الإجمالي 91.72% 85.47% 90.38% 93.18%

🔧 تدقيق الوظائف

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 396 / Source files: 387

📅 آخر التغييرات في المصدر (آخر 7 أيام)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
---
+export function buildMicrovmScratchInit(scratchMib: number, supervisorGuestPath: string): string {
+export function isCloudHypervisorScriptAcceptanceWorkflow(
+export function resolveAgentRuntimeStartFile(workDir: string, proxyLogsDir?: string): string {
+export function readAgentRuntimeStartTimeMs(workDir: string, proxyLogsDir?: string): number | undefined {
+export function ensureAgentRuntimeStartMarker(workDir: string, proxyLogsDir?: string): number | undefined {
+export function assertCloudHypervisorEnclaveExportsIsolated(
+export function validateEnclavesStructure(
+export function resolveRunSandboxBackend(primaryRuntime?: string): RunSandboxBackend {
+export function validateRunSandboxBackend(
+export async function captureEnclaveStartupDiagnostics(

🔎 نتائج ملحوظة

• **** host-iptables.tsجميع الملفات الخمسة ذات الأهمية الأمنية البالغة تغطيتها بنسبة 100% ، بما في ذلك البيانات والوظائف.squid-config.ts كما docker-manager.tsأنها مغطاة بالكامل في جميع المقاييس.
• src/cli.tsتبلغ نسبة تغطية الفروع 50% ، وهي أضعف نسبة تغطية بين الفروع ضمن المجموعة ذات الأهمية الأمنية البالغة. وقد تم تصنيفها على أنها "جيدة" فقط لأنها تقع ضمن نطاق العبارات/الدوال.
• src/domain-patterns.tsتغطي الشبكة 89.47% من الفروع. أما الفروع غير المغطاة فتقع ضمن المسارات if/ switchالمدرجة في تدقيق الوظائف.
• خمسة ملفات غير حساسة أمنياً تقل نسبة تقييمها عن 60% ، وتسعة ملفات تقل نسبة تقييمها عن 80%. أما أدنى نسبة تقييم فكانت nvx/cleanup-registry.ts(42.8%) و bounded-execution/finite-cardinality.ts(46.03%).

🎯 توصيات

1. مستوى عالٍ: أضف اختبارات لـ src/nvx/cleanup-registry.tsو src/bounded-execution/finite-cardinality.ts. كلاهما أقل من 50% من العبارات وتغطية الفروع حوالي 35%. هذه هي أبرز الثغرات في ملخص ثغرات التغطية.
2. متوسط: زيادة تغطية الفروع في src/cli.tsو src/domain-patterns.ts. cli.ts حيث تبلغ نسبة التغطية في 50%، domain-patterns.tsبينما تبلغ في 89.47%. يجب استهداف الفروع غير المغطاة، لأن كلا الملفين مدرجان في قائمة الملفات ذات الأهمية الأمنية البالغة.
3. منخفض: تحسين src/bounded-execution/finite-disclosure.tsتغطية الفروع (11.42%) والملفات التي تتراوح نسبتها بين 50 و60% ( microvm/network-reservation.ts) bounded-execution/finite-schema.ts. يُعطى الأولوية بعد البنود المذكورة أعلاه.

تم إنشاؤه بواسطة سير عمل مُبلغ تغطية الاختبار. المُشغِّل:push

تم إنشاؤه بواسطة مُبلغ تغطية الاختبار · copilot · sum00 · 0.784 AIC · ⊞ 7.2K · ◷

• تنتهي صلاحيتها في 20 أكتوبر 2026، الساعة 6:04 مساءً بالتوقيت العالمي المنسق

📊 Test Coverage Report — 2026-10-13

Overall Coverage

Metric	Coverage
Statements	91.72%
Branches	85.47%
Functions	90.38%
Lines	93.18%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	54.23%	41.32%	❌
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	59.58%	⚠️
src/nvx/cleanup-store.ts	65.59%	55.1%	71.42%	70.58%	⚠️
src/bounded-execution/strict-json-parser.ts	67.53%	65.04%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	72.72%	53.33%	100%	70.73%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/microvm/rootfs.ts	75.4%	58.33%	100%	75.86%	⚠️
src/cloud-hypervisor/cleanup-vmm-identity.ts	75.86%	70.76%	100%	79.24%	⚠️
src/enclave/github-gateway.ts	79.8%	74.13%	83.87%	82.56%	⚠️
src/routing/bootstrap.ts	79.8%	68.27%	83.33%	85.26%	⚠️
src/nvx/runtime-lifecycle.ts	79.88%	63.59%	92.98%	84.56%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
src/cloud-hypervisor/api-client.ts	95.06%	82.35%	90.9%	97.33%	✅
src/services/cli-proxy-service.ts	95.16%	91.52%	100%	98.11%	✅
TOTAL	91.72%	85.47%	90.38%	93.18%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 396 / Source files: 387

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
---
+export function buildMicrovmScratchInit(scratchMib: number, supervisorGuestPath: string): string {
+export function isCloudHypervisorScriptAcceptanceWorkflow(
+export function resolveAgentRuntimeStartFile(workDir: string, proxyLogsDir?: string): string {
+export function readAgentRuntimeStartTimeMs(workDir: string, proxyLogsDir?: string): number | undefined {
+export function ensureAgentRuntimeStartMarker(workDir: string, proxyLogsDir?: string): number | undefined {
+export function assertCloudHypervisorEnclaveExportsIsolated(
+export function validateEnclavesStructure(
+export function resolveRunSandboxBackend(primaryRuntime?: string): RunSandboxBackend {
+export function validateRunSandboxBackend(
+export async function captureEnclaveStartupDiagnostics(

🔎 Notable Findings

• All five security-critical files are at 100% statements and functions. host-iptables.ts, squid-config.ts, and docker-manager.ts are fully covered on all metrics.
• src/cli.ts branch coverage is 50%, the weakest branch figure among the security-critical set. It is marked OK only because it is in the statement/function range.
• src/domain-patterns.ts has 89.47% branch coverage. Its uncovered branches are in the if/switch paths listed in the function audit.
• Five non-security-critical files are below 60% statements, and nine are below 80%. The lowest are nvx/cleanup-registry.ts (42.8%) and bounded-execution/finite-cardinality.ts (46.03%).

🎯 Recommendations

1. High: Add tests for src/nvx/cleanup-registry.ts and src/bounded-execution/finite-cardinality.ts. Both are below 50% statements and about 35% branch coverage. These are the top gaps in the coverage-gaps brief.
2. Medium: Raise branch coverage in src/cli.ts and src/domain-patterns.ts. cli.ts is at 50% branches; domain-patterns.ts is at 89.47%. Target the uncovered branches, since both files are on the security-critical list.
3. Low: Improve src/bounded-execution/finite-disclosure.ts branch coverage (11.42%) and the 50–60% files (microvm/network-reservation.ts, bounded-execution/finite-schema.ts). Prioritize after the items above.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · copilot · sum00 · 0.784 AIC · ⊞ 7.2K · ◷

• expires on Oct 20, 2026, 6:04 PM UTC