You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
microvm/network-reservation.ts: Network namespace preparation only 50% covered
Impact: microVM guest network setup may have untested paths
Recommendation: Add integration tests for CIDR allocation, IP conflicts
enclave/runtime-preflight.ts: Enclave bootstrap validation only 67% covered
Impact: Policy validation before enclave execution may miss edge cases
Recommendation: Add tests for policy merge conflicts, schema violations
📅 Recent Source Changes (last 7 days)
The project has been actively developed, with changes across multiple security-critical and infrastructure components. No recent regressions detected — overall coverage remains stable at 92.72% statements.
Key activity areas:
Core iptables and domain filtering (100% maintained)
Enclave and microVM infrastructure (coverage gaps pre-existing)
Configuration validation and schema enforcement (stable)
🔎 Notable Findings
✅ Security Foundation Solid: iptables rules, domain ACL, and network isolation are comprehensively tested. No security regressions detected.
🔴 CRITICAL: finite-disclosure.ts — Only 38% statement coverage. This module handles sensitive string redaction and timing-safe operations. Recommend prioritizing additional test coverage before any policy-sensitive changes.
🟡 Microvm/Enclave Infrastructure Gaps — network-reservation (50%), runtime-preflight (67%), and rootfs (72%) have moderate coverage. Not security-critical for baseline firewall, but important for advanced features (Cloud Hypervisor support, Unified Enclaves).
✅ Overall Trend: 92.72% statement coverage represents a strong testing culture. The project significantly exceeds the 38% baseline threshold. Remaining gaps are isolated to newer/optional components.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
📊 Test Coverage Report — 2026-09-08
Overall Coverage
Excellent overall coverage across the project. All metrics exceed baseline thresholds:
Coverage Summary
🛡️ Security-Critical Path Status
Host-Level Network Isolation (iptables):
host-iptables-*.tsmodules: 100% coverage ✅host-iptables-rules.ts: 100% (97 stmts, 36 branches)host-iptables-shared.ts: 100% (91 stmts, 20 branches)host-iptables-validation.ts: 100% (30 stmts, 32 branches)host-iptables-chain.ts: 100% (42 stmts, 10 branches)Domain Filtering (Squid ACL):
squid-config.ts: 100% coverage ✅ (13 stmts, 5 branches)domain-patterns.ts: 100% coverage ✅ (25 stmts, 17 branches)domain-matchers.ts: 98.14% coverage ✅ (53 of 54 stmts)domain-utils.ts: 100% coverage ✅ (53 stmts, 22 branches)Critical Risk: One security-critical file has dangerously low coverage:
src/bounded-execution/finite-disclosure.ts: 38.12% statements, 25.89% branches📋 Coverage Table
✅ 100% Coverage (Security-Critical & Core Modules)
host-iptables-rules.tshost-iptables-shared.tshost-iptables-validation.tshost-iptables-chain.tssquid-config.tsdomain-patterns.tsdomain-utils.tscompose-generator.tschroot-home-setup.tscli-options.tscli-workflow.tscontainer-startup-diagnostics.tsdomain-matchers.tsfs-utils.tsconfig-writer.tsartifact-preservation.tshost-env.ts❌ Critical Coverage Gaps (Below 50%)
src/bounded-execution/finite-disclosure.tssrc/microvm/network-reservation.tssrc/enclave/runtime-preflight.tssrc/microvm/rootfs.tssrc/commands/validators/config-assembly.ts🔧 Function Audit
Core Security Functions (100% Tested)
generateSquidConfig()— Domain ACL generation ✅setupIptablesRules()— Network isolation via iptables ✅validateHostIdentity()— User UID/GID validation ✅composerNetworkValidator()— Docker network conflict detection ✅Problem Areas (Requires Coverage Expansion)
finite-disclosure.ts: String redaction and timing-safe operations only 38% covered
microvm/network-reservation.ts: Network namespace preparation only 50% covered
enclave/runtime-preflight.ts: Enclave bootstrap validation only 67% covered
📅 Recent Source Changes (last 7 days)
The project has been actively developed, with changes across multiple security-critical and infrastructure components. No recent regressions detected — overall coverage remains stable at 92.72% statements.
Key activity areas:
🔎 Notable Findings
✅ Security Foundation Solid: iptables rules, domain ACL, and network isolation are comprehensively tested. No security regressions detected.
🔴 CRITICAL: finite-disclosure.ts — Only 38% statement coverage. This module handles sensitive string redaction and timing-safe operations. Recommend prioritizing additional test coverage before any policy-sensitive changes.
🟡 Microvm/Enclave Infrastructure Gaps — network-reservation (50%), runtime-preflight (67%), and rootfs (72%) have moderate coverage. Not security-critical for baseline firewall, but important for advanced features (Cloud Hypervisor support, Unified Enclaves).
✅ Overall Trend: 92.72% statement coverage represents a strong testing culture. The project significantly exceeds the 38% baseline threshold. Remaining gaps are isolated to newer/optional components.
🎯 Recommendations
🔴 High Priority
Expand bounded-execution/finite-disclosure.ts coverage (38% → 80%+)
Improve microvm/network-reservation.ts coverage (50% → 75%+)
🟡 Medium Priority
Report Generated: 2026-09-08 22:29:56 UTC
Test Framework: Jest + NYC
Baseline Thresholds: statements=38%, branches=30%, functions=35%, lines=38%
All reactions