[Coverage Report] Test Coverage Report — 2026-06-05

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-05

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.5%	4,596 / 4,760
Branches	91.0%	2,481 / 2,725
Functions	98.7%	535 / 542
Lines	96.7%	4,444 / 4,598

100 test files · 151 source files

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Notes
src/commands/validators/network-options.ts	66.7%	50.0%	⚠️ New in last 7 days — 7/21 statements uncovered

---

🛡️ Security-Critical Path Status

File	Stmts	Branches	Functions	Lines	Status
src/host-iptables.ts	100.0%	100.0%	100.0%	100.0%	✅
src/squid-config.ts	100.0%	100.0%	100.0%	100.0%	✅
src/docker-manager.ts	100.0%	100.0%	100.0%	100.0%	✅
src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%	✅
src/cli.ts	85.7%	50.0%	100.0%	85.7%	⚠️

src/cli.ts is a 13-line entry-point shim (if (require.main === module)). The uncovered branch is the module-import path (not invoked directly), so this is expected rather than a real gap. All substantive orchestration logic lives in src/cli-workflow.ts at 100%.

---

📋 Coverage by File (bottom 20 by statement coverage)

File	Stmts	Branches	Functions	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100.0%	82.5%
src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
src/cli.ts	85.7%	50.0%	100.0%	85.7%
src/logs/log-parser.ts	86.9%	67.1%	100.0%	87.8%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100.0%	88.3%
src/commands/validators/log-and-limits.ts	89.5%	74.5%	100.0%	89.5%
src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
src/services/host-path-prefix.ts	90.3%	81.6%	100.0%	88.9%
src/config-writer.ts	90.9%	83.0%	100.0%	90.9%
src/services/api-proxy-service.ts	91.7%	50.0%	100.0%	91.7%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100.0%	93.5%
src/squid/ssl-bump.ts	93.8%	91.7%	100.0%	93.8%
src/host-env.ts	94.1%	80.0%	100.0%	95.9%
src/logs/log-aggregator.ts	94.7%	87.5%	100.0%	94.7%
src/upstream-proxy.ts	94.9%	94.7%	100.0%	94.5%
src/commands/main-action.ts	95.5%	88.6%	100.0%	95.5%

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — new file with 33% uncovered statements

Added in commit 4c46947 (api-proxy: Copilot session_id opt-in), this validator checks Docker host socket validity and DinD path-prefix resolution. Two conditional branches are untested:

• !dockerHostCheck.valid && !dockerHostPathPrefixResolution.dockerHostPathPrefix (line 59) — error path when Docker host is invalid and no DinD prefix provided
• dockerHostPathPrefixResolution.dindHint && !dockerHostPathPrefixResolution.dockerHostPathPrefix (line 64) — DinD hint detected but no prefix resolved

This function validates the security boundary between runner and Docker daemon (ARC/DinD). Missing branch coverage here means the error paths that guard misconfigured network isolation are untested.

2. src/logs/log-parser.ts — 67.1% branch coverage

Complex IPv6 parsing logic ([::1]:port bracket notation, lastColon fallbacks, \d+ port validation, malformed destination strings) has many untested branches. While not security-critical, malformed log entries could silently produce null and drop audit records.

3. src/services/agent-volumes/etc-mounts.ts — 67.8% branch coverage

The /etc/passwd and /etc/group staging paths (lines 82–113) handle null returns from staged file reads, UID/GID presence checks, and error recovery. These branches are untested. The /etc staging logic determines which credential files the agent can see — uncovered branches here are worth addressing.

4. src/artifact-preservation.ts — 85.4% stmt (new file)

Newly introduced in the last 7 days. The preserveIptablesAudit function preserves iptables audit dumps before docker compose down -v destroys the init-signal volume. The copy-failure error handling path is not covered.

---

📈 Recommendations

1. High — Add unit tests for src/commands/validators/network-options.ts: cover the two error branches (invalid Docker host without DinD prefix; DinD hint present but prefix unresolved). New code validating a security-critical boundary, shipped without complete branch coverage.

2. Medium — Improve branch coverage in src/logs/log-parser.ts: add test cases for IPv6 [::1]:port format, missing port separator, non-numeric port strings, and malformed rawDest values. Ensures audit logs are never silently dropped.

3. Medium — Cover staging error paths in src/services/agent-volumes/etc-mounts.ts: test when stagedPasswdContent is null (file read failure) and when the UID/GID is absent from the staged file. Error-recovery paths in credential file staging.

4. Low — Add a test for the preserveIptablesAudit copy-failure path in src/artifact-preservation.ts (mock fs.copyFileSync to throw and assert graceful degradation).

---

Generated by test-coverage-reporter workflow · Trigger: push · Commit: 4c46947

Generated by Test Coverage Reporter · sonnet46 1.5M · ◷

• expires on Jun 12, 2026, 3:52 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir around discussion 4385.
Smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T15:52:58.446Z.

Closed by Workflow

[github-actions[bot]]

🔮 The ancient spirits stir over this archive: the smoke test agent has passed through, left a trace in the ether, and departed in good standing.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex