[Coverage Report] Test Coverage Report — 2026-06-06

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage	Total
Statements	96.46%	4669 / 4840
Branches	90.73%	2546 / 2806
Functions	98.72%	542 / 549
Lines	96.55%	4515 / 4676

Test suite: 105 test files, 139 source files. Coverage thresholds pass (≥30% branch, ≥35% fn, ≥38% stmt/lines).

---

🛡️ Security-Critical Path Status

File	Stmt	Branch	Fn	Status
src/host-iptables.ts	100%	100%	100%	✅ Full
src/squid-config.ts	100%	100%	100%	✅ Full
src/docker-manager.ts	100%	100%	100%	✅ Full
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Near-full
src/cli.ts	85.7%	50.0%	100%	⚠️ Low branch

All core firewall modules (iptables rules, Squid ACL generation, Docker lifecycle, domain matching) have excellent coverage. The only security-adjacent concern is cli.ts entry-point branch coverage at 50%.

---

🔴 Critical Gaps (< 80% statement coverage)

File	Stmt	Branch	Fn	Notes
src/commands/validators/network-options.ts	66.7%	50.0%	100%	DinD/DockerHost validation logic half-untested

---

🟡 Low Coverage (80–89% statement coverage)

File	Stmt	Branch	Fn	Notes
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100%	Sensitive /etc bind-mount logic
src/logs/audit-enricher.ts	83.6%	74.1%	100%	Audit log enrichment paths
src/artifact-preservation.ts	85.4%	95.3%	100%	Artifact cleanup branches
src/cli.ts	85.7%	50.0%	100%	CLI entry-point error paths
src/logs/log-parser.ts	86.9%	67.1%	100%	Log line parsing edge cases
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	3 ACL-policy functions uncovered
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%	DinD volume staging paths
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%	Log command helper branches
src/dind-bootstrap.ts	88.9%	66.7%	100%	DinD bootstrap failure paths

Additional branch-coverage concerns (< 70% branch, stmt ≥ 90%)

File	Stmt	Branch
src/services/api-proxy-service.ts	91.7%	50.0%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%

---

🔍 Notable Findings

1. network-options.ts validator has half its branches untested (50% branch, 66.7% stmt)
The validateNetworkOptions() function contains conditional logic for --docker-host, --docker-host-path-prefix, and DinD hints. The uncovered branches are the invalid-argument error paths — exactly the kind of security-relevant input validation that should be tested.

2. cli.ts entry point has 50% branch coverage
src/cli.ts is only 13 lines but has 2 branches with only 1 covered. The uncovered branch is likely the require.main guard. As the orchestration entry point, all execution paths here should be verified.

3. squid/policy-manifest.ts has 3 uncovered functions (70% fn)
generatePolicyManifest() drives the Squid ACL rules. With 30% of its functions uncovered, there are ACL policy code paths — particularly around blocked-domain lists, DLP, and pattern-based rules — that have no test coverage. Given that this module directly controls what traffic is allowed or denied, this is the most actionable security finding.

4. Large active codebase — 258 TypeScript files changed in the last 7 days
The codebase is under heavy active development. The 96.46% statement baseline is strong, but the rate of change means coverage gaps can appear quickly. The 7 files with < 70% branch coverage warrant attention before they accumulate further.

---

📈 Recommendations

1. High — src/commands/validators/network-options.ts: Add tests covering the invalid---docker-host and conflicting---docker-host-path-prefix error branches. These are ~4 untested conditional paths in a validation function.

2. High — src/squid/policy-manifest.ts: Add tests for the 3 uncovered functions. Focus on ACL generation with blocked-domain lists and DLP-enabled configs — the branches controlling which domains are allowed or denied.

3. Medium — src/cli.ts: Cover the second branch (likely the require.main === module guard or an error-propagation path). This is a small change in the test but closes a gap at the entry point.

4. Medium — src/services/api-proxy-service.ts: Branch coverage at 50% for the API credential-injection sidecar warrants investigation. Likely missing error-path tests (credential missing, upstream unreachable).

5. Low — src/services/agent-volumes/etc-mounts.ts: Cover the UID/GID mismatch branches in buildEtcMounts() — these handle staged passwd/group file edge cases during DinD operation.

---

📋 Full per-file coverage table (production files only)

File	Stmt	Branch	Fn	Lines
src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100.0%	82.5%
src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
src/cli.ts	85.7%	50.0%	100.0%	85.7%
src/logs/log-parser.ts	86.9%	67.1%	100.0%	87.8%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100.0%	88.3%
src/dind-bootstrap.ts	88.9%	66.7%	100.0%	88.5%
src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
src/commands/validators/log-and-limits.ts	90.3%	77.6%	100.0%	90.3%
src/services/host-path-prefix.ts	90.3%	81.6%	100.0%	88.9%
src/config-writer.ts	90.9%	83.0%	100.0%	90.9%
src/services/api-proxy-service.ts	91.7%	50.0%	100.0%	91.7%
src/services/agent-volumes/docker-socket.ts	91.7%	93.3%	100.0%	91.7%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
src/diagnostic-collector.ts	92.5%	100.0%	100.0%	92.5%
src/commands/build-config.ts	92.8%	92.2%	100.0%	92.8%
src/commands/validators/agent-options.ts	93.0%	88.6%	100.0%	93.0%
src/services/agent-volumes/hosts-file.ts	93.2%	90.3%	100.0%	92.8%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100.0%	93.5%
src/squid/ssl-bump.ts	93.8%	91.7%	100.0%	93.8%
src/ssl-bump.ts	94.0%	84.6%	100.0%	94.7%
src/host-env.ts	94.1%	80.0%	100.0%	95.9%
src/logs/log-aggregator.ts	94.7%	87.5%	100.0%	94.7%
src/upstream-proxy.ts	94.9%	94.7%	100.0%	94.5%
src/services/cli-proxy-service.ts	95.5%	93.3%	100.0%	95.5%
src/commands/main-action.ts	95.6%	88.6%	100.0%	95.6%
src/parsers/volume-parsers.ts	95.8%	100.0%	100.0%	95.8%
src/container-lifecycle.ts	96.0%	88.1%	100.0%	95.8%
src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100.0%	96.3%
src/container-cleanup.ts	96.4%	100.0%	80.0%	95.8%
src/services/agent-environment/env-passthrough.ts	96.8%	92.3%	100.0%	96.8%
src/commands/validators/config-assembly.ts	97.0%	90.4%	100.0%	97.9%
src/compose-sanitizer.ts	97.1%	93.3%	100.0%	97.0%
src/logs/log-formatter.ts	97.4%	92.8%	100.0%	97.3%
src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%
src/services/agent-service.ts	97.8%	94.6%	100.0%	97.7%
src/services/agent-volumes/home-strategy.ts	97.8%	83.3%	100.0%	97.7%
src/config-file.ts	98.1%	97.1%	87.5%	100.0%
src/rules.ts	98.2%	91.9%	100.0%	98.1%
src/compose-generator.ts	98.4%	92.5%	100.0%	98.4%
src/pid-tracker.ts	98.8%	80.8%	100.0%	98.7%
src/option-parsers.ts	98.9%	95.5%	100.0%	98.8%
src/api-proxy-config.ts	100.0%	98.2%	100.0%	100.0%
src/cli-options.ts	100.0%	93.3%	100.0%	100.0%
src/cli-workflow.ts	100.0%	100.0%	100.0%	100.0%
src/docker-manager.ts	100.0%	100.0%	100.0%	100.0%
src/domain-patterns.ts (above)	97.7%	95.4%	100.0%	97.6%
src/host-iptables.ts	100.0%	100.0%	100.0%	100.0%
src/host-iptables-cleanup.ts	100.0%	100.0%	100.0%	100.0%
src/host-iptables-network.ts	100.0%	100.0%	100.0%	100.0%
src/host-iptables-rules.ts	100.0%	98.4%	100.0%	100.0%
src/host-iptables-shared.ts	100.0%	95.0%	100.0%	100.0%
src/squid-config.ts	100.0%	100.0%	100.0%	100.0%
src/squid/access-rules.ts	100.0%	100.0%	100.0%	100.0%
src/squid/acl-generator.ts	100.0%	100.0%	100.0%	100.0%
src/squid/config-generator.ts	100.0%	100.0%	100.0%	100.0%
src/squid/config-sections.ts	100.0%	82.8%	100.0%	100.0%
src/squid/domain-acl.ts	100.0%	100.0%	100.0%	100.0%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
src/squid/upstream-proxy.ts	100.0%	100.0%	100.0%	100.0%
src/squid/validation.ts	100.0%	100.0%	100.0%	100.0%

---

Generated by test-coverage-reporter workflow. Trigger: push — 2026-06-06

Generated by Test Coverage Reporter · sonnet46 1.6M · ◷

• expires on Jun 13, 2026, 4:58 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent has passed through this discussion and left a brief omen of success.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-13T16:58:15.594Z.

Closed by Workflow