[Coverage Report] Test Coverage Report — 2026-06-05

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-05

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.55% ✅	4,596 / 4,760
Branches	90.97% ✅	2,480 / 2,726
Functions	98.70% ✅	535 / 542
Lines	96.65% ✅	4,444 / 4,598

100 test files, 151 source files, 28,781 lines of test code. Coverage is measured across 133 instrumented files; 18 uncovered files are type-only (src/types/*.ts).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All source files are above 50%.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Fns	Lines
🟡 src/commands/validators/network-options.ts	66.66%	50%	100%	66.66%

---

🛡️ Security-Critical Path Status

File	Stmts	Branches	Fns	Notes
src/host-iptables.ts	100%	100%	100%	✅ Barrel — delegates to sub-modules
src/host-iptables-rules.ts	100%	98.41%	100%	✅ 1 branch uncovered (129 stmts)
src/host-iptables-shared.ts	100%	95%	100%	✅ 1 branch uncovered
src/host-iptables-cleanup.ts	100%	100%	100%	✅ Fully covered
src/host-iptables-network.ts	100%	100%	100%	✅ Fully covered
src/squid-config.ts	100%	100%	100%	✅ Fully covered
src/squid/config-sections.ts	100%	82.75%	100%	✅ Good
src/docker-manager.ts	100%	100%	100%	✅ Fully covered (barrel, 15 stmts)
src/domain-patterns.ts	97.67%	95.38%	100%	✅ Excellent
src/cli.ts	85.71%	50%	100%	⚠️ Uncovered: require.main === module guard

---

📋 Full Coverage Table (files with < 100% coverage)

Expand to see all 65 non-perfect files

File	Stmts	Branches	Fns	Lines
🟡 src/commands/validators/network-options.ts	66.66%	50%	100%	66.66%
🟢 src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%	82.45%
🟢 src/logs/audit-enricher.ts	83.6%	74.13%	100%	89.36%
🟢 src/artifact-preservation.ts	85.36%	95.34%	100%	85.36%
🟢 src/cli.ts	85.71%	50%	100%	85.71%
🟢 src/logs/log-parser.ts	86.9%	67.14%	100%	87.8%
🟢 src/squid/policy-manifest.ts	87.23%	88.23%	70%	86.95%
🟢 src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%	87.23%
🟢 src/commands/logs-command-helpers.ts	88.52%	83.33%	100%	88.33%
🟢 src/commands/validators/log-and-limits.ts	89.47%	74.5%	100%	89.47%
🟢 src/services/doh-proxy-service.ts	90%	75%	100%	90%
🟢 src/services/host-path-prefix.ts	90.32%	81.57%	100%	88.88%
🟢 src/config-writer.ts	90.9%	82.97%	100%	90.9%
🟢 src/services/api-proxy-service.ts	91.66%	50%	100%	91.66%
🟢 src/services/agent-volumes/docker-socket.ts	91.66%	93.33%	100%	91.66%
🟢 src/logs/log-streamer.ts	92.18%	77.77%	88.88%	92.06%
🟢 src/diagnostic-collector.ts	92.5%	100%	100%	92.5%
🟢 src/commands/validators/agent-options.ts	92.98%	88.57%	100%	92.98%
🟢 src/services/agent-volumes/hosts-file.ts	93.22%	90.32%	100%	92.85%
🟢 src/services/agent-environment/environment-builder.ts	93.54%	66.66%	100%	93.54%
🟢 src/squid/ssl-bump.ts	93.75%	91.66%	100%	93.75%
🟢 src/ssl-bump.ts	93.96%	84.61%	100%	94.69%
🟢 src/host-env.ts	94.11%	80%	100%	95.91%
🟢 src/logs/log-aggregator.ts	94.73%	87.5%	100%	94.66%
🟢 src/upstream-proxy.ts	94.93%	94.73%	100%	94.52%
🟢 src/commands/main-action.ts	95.45%	88.57%	100%	95.45%
🟢 src/services/cli-proxy-service.ts	95.45%	93.33%	100%	95.45%
🟢 src/parsers/volume-parsers.ts	95.83%	100%	100%	95.83%
🟢 src/container-lifecycle.ts	96%	88.09%	100%	95.8%
🟢 src/services/agent-volumes/workspace-mounts.ts	96.29%	75%	100%	96.29%
🟢 src/container-cleanup.ts	96.42%	100%	80%	95.83%
🟢 src/services/agent-environment/env-passthrough.ts	96.77%	92%	100%	96.77%
🟢 src/commands/validators/config-assembly.ts	96.96%	90.36%	100%	97.93%
🟢 src/compose-sanitizer.ts	97.14%	93.33%	100%	97.05%
🟢 src/logs/log-formatter.ts	97.43%	92.85%	100%	97.29%
🟢 src/domain-patterns.ts	97.67%	95.38%	100%	97.61%
🟢 src/services/agent-service.ts	97.77%	94.64%	100%	97.67%
🟢 src/services/agent-volumes/home-strategy.ts	97.77%	83.33%	100%	97.72%
🟢 src/config-file.ts	98.11%	97.14%	87.5%	100%
🟢 src/rules.ts	98.18%	91.89%	100%	98.11%
🟢 src/compose-generator.ts	98.43%	92.5%	100%	98.43%
🟢 src/pid-tracker.ts	98.78%	80.76%	100%	98.7%
🟢 src/option-parsers.ts	98.88%	95.55%	100%	98.82%
🟢 src/api-proxy-config.ts	100%	98.19%	100%	100%
🟢 src/cli-options.ts	100%	93.33%	100%	100%
🟢 src/commands/build-config.ts	100%	97.87%	100%	100%
🟢 src/commands/logs-audit.ts	100%	95.65%	100%	100%
🟢 src/commands/network-setup.ts	100%	86.95%	100%	100%
🟢 src/commands/preflight.ts	100%	83.78%	100%	100%
🟢 src/commands/signal-handler.ts	100%	87.5%	100%	100%
🟢 src/copilot-api-resolver.internal.ts	100%	92.85%	100%	100%
🟢 src/dind-probe.ts	100%	93.75%	100%	100%
🟢 src/dns-resolver.ts	100%	91.66%	100%	100%
🟢 src/host-identity.ts	100%	96.87%	100%	100%
🟢 src/host-iptables-rules.ts	100%	98.41%	100%	100%
🟢 src/host-iptables-shared.ts	100%	95%	100%	100%
🟢 src/logger.ts	100%	90.9%	100%	100%
🟢 src/logs/log-discovery.ts	100%	90%	100%	100%
🟢 src/logs/stats-formatter.ts	100%	93.47%	100%	100%
🟢 src/services/agent-environment/api-proxy-environment.ts	100%	92.85%	100%	100%
🟢 src/services/agent-environment/github-actions-environment.ts	100%	95%	100%	100%
🟢 src/services/agent-environment/host-path-recovery.ts	100%	90%	100%	100%
🟢 src/services/agent-environment/tool-specific-environment.ts	100%	95.45%	100%	100%
🟢 src/services/api-proxy-service-config.ts	100%	96.59%	100%	100%
🟢 src/squid/config-sections.ts	100%	82.75%	100%	100%

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — 50% branch coverage (7 uncovered statements).
   This validator handles Docker host path prefix and DinD detection — security-adjacent code. The two uncovered if branches around dockerHostPathPrefixResolution edge-cases (lines 59 and 64) are not exercised: the case where the prefix is absent but the DinD hint fires, and the combined !dockerHostCheck.valid && !prefix path.

2. src/logs/log-parser.ts — 67.14% branch coverage (23 uncovered branches across parseLogLine and parseAuditJsonlLine).
   The parser covers the happy path well, but malformed log-line variants (truncated fields, unexpected tokens, negative counts) are not tested. Log parsing drives the audit and firewall summary commands, so incorrect failure-mode handling could silently produce wrong statistics.

3. src/services/agent-volumes/etc-mounts.ts — 67.85% branch coverage (9 uncovered branches).
   buildEtcMounts constructs the selective /etc bind-mount list. Uncovered branches are in the platform- and option-conditional mount logic. A missed branch here could expose host files (e.g., /etc/shadow) inside the agent container.

4. src/cli.ts — 50% branch coverage (1 uncovered branch).
   The uncovered branch is the require.main === module guard. This is structurally hard to exercise in Jest without spawning a child process; it does not represent a real functional gap.

---

📈 Recommendations

1. High — network-options.ts branch gaps (src/commands/validators/network-options.ts): Add two unit tests for validateNetworkOptions covering (a) dindHint=true with no resolved prefix and (b) invalid docker host path with no prefix. These branches guard DinD security decisions.

2. Medium — log-parser.ts malformed input (src/logs/log-parser.ts): Add property-based or table-driven tests for parseLogLine with truncated/corrupted Squid log lines (fewer than 9 fields, negative byte counts, missing %rm method token). Target: raise branch coverage above 85%.

3. Medium — etc-mounts.ts conditional mounts (src/services/agent-volumes/etc-mounts.ts): Add tests for buildEtcMounts with DinD enabled, with --docker-host-path-prefix set, and without optional config keys — the 9 uncovered branches map directly to those combinations.

4. Low — audit-enricher.ts edge cases (src/logs/audit-enricher.ts): enrichWithPolicyRules and computeRuleStats have 16 uncovered branches (74.13%). Tests for empty rule-set and no-match scenarios would improve coverage with minimal effort.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 27021193452 · Coverage data from coverage/coverage-summary.json (2026-06-05T14:36:48Z)

Generated by Test Coverage Reporter · sonnet46 1.5M · ◷

• expires on Jun 12, 2026, 2:42 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through these halls. The run leaves a brief omen of success upon the discussion.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T14:42:01.546Z.

Closed by Workflow