[Coverage Report] Test Coverage Report — 2026-06-05

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-05

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.55%	4,601 / 4,765
Branches	91.07%	2,490 / 2,734
Functions	98.70%	535 / 542
Lines	96.65%	4,449 / 4,603

100 test files · 152 source files

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 152 source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Funcs	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0% ⚠️	100.0%	66.7%

---

🛡️ Security-Critical Path Status

File	Stmts	Branches	Funcs
✅ src/host-iptables.ts	100.0%	100.0%	100.0%
✅ src/squid-config.ts	100.0%	100.0%	100.0%
✅ src/docker-manager.ts	100.0%	100.0%	100.0%
✅ src/domain-patterns.ts	97.7%	95.4%	100.0%
✅ src/cli.ts	85.7%	50.0% ⚠️	100.0%
✅ src/host-iptables-rules.ts	100.0%	98.4%	100.0%
✅ src/squid/acl-generator.ts	100.0%	100.0%	100.0%
✅ src/squid/access-rules.ts	100.0%	100.0%	100.0%
✅ src/squid/domain-acl.ts	100.0%	100.0%	100.0%
✅ src/squid/config-generator.ts	100.0%	100.0%	100.0%
🟡 src/squid/policy-manifest.ts	87.2%	88.2%	70.0%

All primary firewall enforcement paths (iptables rule generation, Squid config, domain ACLs) are at 100% statement and branch coverage.

---

📋 Full Coverage Table

Click to expand — all source files (excluding test-utils)

File	Stmts	Branches	Funcs	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0% ⚠️	100.0%	66.7%
✅ src/services/agent-volumes/etc-mounts.ts	82.5%	67.8% ⚠️	100.0%	82.5%
✅ src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
✅ src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
✅ src/cli.ts	85.7%	50.0% ⚠️	100.0%	85.7%
✅ src/logs/log-parser.ts	86.9%	67.1% ⚠️	100.0%	87.8%
✅ src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
✅ src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
✅ src/commands/logs-command-helpers.ts	88.5%	83.3%	100.0%	88.3%
✅ src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
✅ src/commands/validators/log-and-limits.ts	90.3%	77.6%	100.0%	90.3%
✅ src/services/host-path-prefix.ts	90.3%	81.6%	100.0%	88.9%
✅ src/config-writer.ts	90.9%	83.0%	100.0%	90.9%
✅ src/services/api-proxy-service.ts	91.7%	50.0% ⚠️	100.0%	91.7%
✅ src/services/agent-volumes/docker-socket.ts	91.7%	93.3%	100.0%	91.7%
✅ src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
✅ src/diagnostic-collector.ts	92.5%	100.0%	100.0%	92.5%
✅ src/commands/validators/agent-options.ts	93.0%	88.6%	100.0%	93.0%
✅ src/services/agent-volumes/hosts-file.ts	93.2%	90.3%	100.0%	92.8%
✅ src/services/agent-environment/environment-builder.ts	93.5%	66.7% ⚠️	100.0%	93.5%
✅ src/squid/ssl-bump.ts	93.8%	91.7%	100.0%	93.8%
✅ src/ssl-bump.ts	94.0%	84.6%	100.0%	94.7%
✅ src/host-env.ts	94.1%	80.0%	100.0%	95.9%
✅ src/logs/log-aggregator.ts	94.7%	87.5%	100.0%	94.7%
✅ src/upstream-proxy.ts	94.9%	94.7%	100.0%	94.5%
✅ src/commands/main-action.ts	95.5%	88.6%	100.0%	95.5%
✅ src/services/cli-proxy-service.ts	95.5%	93.3%	100.0%	95.5%
✅ src/parsers/volume-parsers.ts	95.8%	100.0%	100.0%	95.8%
✅ src/container-lifecycle.ts	96.0%	88.1%	100.0%	95.8%
✅ src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100.0%	96.3%
✅ src/container-cleanup.ts	96.4%	100.0%	80.0%	95.8%
✅ src/services/agent-environment/env-passthrough.ts	96.8%	92.0%	100.0%	96.8%
✅ src/commands/validators/config-assembly.ts	97.0%	90.4%	100.0%	97.9%
✅ src/compose-sanitizer.ts	97.1%	93.3%	100.0%	97.0%
✅ src/logs/log-formatter.ts	97.4%	92.8%	100.0%	97.3%
✅ src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%
✅ src/services/agent-service.ts	97.8%	94.6%	100.0%	97.7%
✅ src/services/agent-volumes/home-strategy.ts	97.8%	83.3%	100.0%	97.7%
✅ src/config-file.ts	98.1%	97.1%	87.5%	100.0%
✅ src/rules.ts	98.2%	91.9%	100.0%	98.1%
✅ src/compose-generator.ts	98.4%	92.5%	100.0%	98.4%
✅ src/pid-tracker.ts	98.8%	80.8%	100.0%	98.7%
✅ src/option-parsers.ts	98.9%	95.5%	100.0%	98.8%
✅ src/api-proxy-config.ts	100.0%	98.2%	100.0%	100.0%
✅ src/cli-options.ts	100.0%	93.3%	100.0%	100.0%
✅ src/cli-workflow.ts	100.0%	100.0%	100.0%	100.0%
✅ src/docker-manager.ts	100.0%	100.0%	100.0%	100.0%
✅ src/host-iptables.ts	100.0%	100.0%	100.0%	100.0%
✅ src/squid-config.ts	100.0%	100.0%	100.0%	100.0%
✅ src/redact-secrets.ts	100.0%	100.0%	100.0%	100.0%
✅ src/services/agent-volumes/credential-hiding.ts	100.0%	100.0%	100.0%	100.0%
✅ src/services/service-security.ts	100.0%	100.0%	100.0%	100.0%
✅ src/services/squid-service.ts	100.0%	100.0%	100.0%	100.0%

(~40 additional files at 100% omitted for brevity)

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — branch coverage 50% (only file below 80% stmts): The untested branches cover ARC/DinD warning paths — specifically the three distinct logger.warn() code paths triggered when DOCKER_HOST is external (!dockerHostCheck.valid) combined with missing --docker-host-path-prefix. These are tested via integration but not unit-tested; adding tests for the three warning combinations in a new network-options.test.ts would bring this file to ~90%+.

2. src/cli.ts — branch coverage 50%: The sole uncovered branch is the top-level if (require.main === module) guard (line 11). This is an inherent limitation of Jest's module loading model — the module is always require()'d during tests, so the guard never evaluates to true. No action needed; statement coverage is 85.7% and all real logic paths are covered.

3. src/services/agent-volumes/etc-mounts.ts — branch coverage 67.8%: This file handles passwd/group file injection for UID/GID remapping in the agent container. Uncovered branches are the stagedPasswdContent/stagedGroupContent null-guard paths (lines 91, 113). These are security-relevant — a missing uid/gid in staged files could affect credential isolation. Tests for fileHasPasswdUid/fileHasGroupGid when staged content is null would address this.

4. src/services/agent-environment/environment-builder.ts — branch coverage 66.7%: Uncovered branches are the if (!envAll) null guard and the ENV_SIZE_WARNING_THRESHOLD exceeded path. Adding a test where envAll is empty/undefined and one where total env bytes exceed the threshold would cover both remaining branches in this agent bootstrap path.

---

📈 Recommendations

1. High — Add src/commands/validators/network-options.test.ts: Unit test validateNetworkOptions() with a mocked checkDockerHost() returning { valid: false }, covering the three distinct warning branches: (a) invalid host + no prefix, (b) dindHint + no prefix, (c) valid host. This is the only file below 80% statement coverage.

2. Medium — Extend etc-mounts tests for null staged-content paths: In the existing etc-mounts.ts test suite, add cases where the Docker-host staging returns null for passwd/group content, ensuring injectHostPasswd/injectHostGroup fall back cleanly without inserting uid/gid entries — directly tests a security-adjacent code path.

3. Low — Cover environment-builder.ts env-size threshold branch: Add a test that builds a large environment object (exceeding ENV_SIZE_WARNING_THRESHOLD bytes) to trigger logger.warn(), and one that passes undefined as envAll. Low-risk but completes branch coverage for the agent container bootstrap.

---

Generated by test-coverage-reporter workflow · Trigger: push · Run: 27035903916

Generated by Test Coverage Reporter · sonnet46 1.4M · ◷

• expires on Jun 12, 2026, 7:40 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here, and the winds of validation speak PASS.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T19:40:41.107Z.

Closed by Workflow