[Coverage Report] Test Coverage Report — 2026-06-10

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-10

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.4%	4762 / 4940
Branches	90.8%	2628 / 2895
Functions	98.8%	563 / 570
Lines	96.5%	4608 / 4776

---

🔴 Critical Gaps (< 50% statement coverage)

None — all 136 source files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.7%	50.0% (5/10)	100%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Full coverage
src/squid-config.ts	100%	100%	100%	✅ Full coverage
src/docker-manager.ts	100%	100%	100%	✅ Full coverage
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Excellent
src/cli.ts	85.7%	50.0% (1/2)	100%	⚠️ Low branch coverage

All four primary security-critical files are at or near 100% coverage. The cli.ts branch gap is the require.main === module guard — only 1 of 2 branches is exercised in unit tests (expected for an entry-point guard).

---

📋 Full Coverage Table

Files 80–89% statement coverage (10 files)

File	Statements	Branches	Functions
src/squid-log-reader.ts	82.2%	80.0%	100%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/artifact-preservation.ts	85.4%	95.3%	100%
src/cli.ts	85.7%	50.0%	100%
src/logs/log-parser.ts	86.9%	68.6%	100%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%
src/dind-bootstrap.ts	88.9%	66.7%	100%

Files 90–99% statement coverage (selected)

File	Statements	Branches
src/services/doh-proxy-service.ts	90.0%	75.0%
src/commands/validators/log-and-limits.ts	90.3%	77.6%
src/services/host-path-prefix.ts	90.3%	81.6%
src/config-writer.ts	90.9%	83.0%
src/services/api-proxy-service.ts	91.7%	50.0%
src/services/agent-volumes/system-mounts.ts	92.3%	75.0%
src/logs/log-streamer.ts	92.2%	77.8%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%
src/logs/audit-enricher.ts	83.6%	74.1%
src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%

Files at 100% statement coverage (58 files)

src/api-proxy-config.ts, src/cli-options.ts, src/cli-workflow.ts, src/constants.ts, src/container-lifecycle-state.ts, src/container-stop.ts, src/copilot-api-resolver.ts, src/copilot-model.ts, src/dind-probe.ts, src/dlp.ts, src/dns-resolver.ts, src/docker-host.ts, src/docker-manager.ts, src/domain-patterns.ts, src/domain-utils.ts, src/env-utils.ts, src/github-env.ts, src/host-iptables.ts, src/host-iptables-cleanup.ts, src/host-iptables-network.ts, src/host-iptables-rules.ts, src/host-iptables-shared.ts, src/image-tag.ts, src/log-paths.ts, src/logger.ts, src/redact-secrets.ts, src/schema-validator.ts, src/squid-config.ts, src/commands/logs-audit.ts, src/commands/logs-stats.ts, src/commands/logs-summary.ts, src/commands/logs.ts, src/commands/main-action.ts, src/commands/network-setup.ts, src/commands/predownload.ts, src/commands/preflight.ts, src/commands/signal-handler.ts, src/commands/subcommands.ts, src/commands/validate-options.ts, src/squid/access-rules.ts, src/squid/acl-generator.ts, src/squid/config-generator.ts, src/squid/domain-acl.ts, src/squid/upstream-proxy.ts, src/squid/validation.ts, and many more.

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — Only file below 80% (66.7% stmt, 50.0% branch)

This was recently added as part of the validator refactor. It handles Docker host detection, domain resolution (--allow-domains, --block-domains), DNS, and upstream proxy configuration. The 50% branch coverage (5/10 branches) means ~5 error-handling or conditional paths are untested — these include warning paths for external Docker hosts and missing path-prefix detection. Security-relevant because domain resolution feeds directly into the Squid ACL allowlist.

2. src/logs/log-parser.ts — 68.6% branch coverage (48/70 branches uncovered)

This file has the largest absolute number of uncovered branches (22 uncovered). Log parsers are important for security audit trails — uncovered branches may include malformed-log handling and edge-case timestamp/IP parsing that could silently drop audit events. File was recently changed.

3. src/services/agent-volumes/etc-mounts.ts — 67.8% branch coverage (9/28 uncovered)

Generates /etc bind-mounts inside the agent container, controlling which host system files the agent can read. Uncovered branches likely include platform-specific file existence checks and optional-mount conditions. Gaps here mean mount configurations for edge-case OS layouts aren't tested — a miss could expose or hide /etc files unintentionally.

4. src/dind-bootstrap.ts — 66.7% branch coverage (11/33 uncovered)

Docker-in-Docker bootstrap logic recently modified; 11 uncovered branch paths. DinD mode is used in ARC/GitHub Actions setups and failure to handle edge cases here could break network isolation in those environments.

---

📈 Recommendations

1. High — src/commands/validators/network-options.ts: Add tests for the warning paths: (a) checkDockerHost() returning invalid (external TCP socket), (b) missing --docker-host-path-prefix when DinD is active. These are security-gating checks; untested paths could allow a misconfigured firewall to silently proceed.

2. High — src/logs/log-parser.ts: Add tests for malformed Squid log lines (missing fields, truncated timestamps, IPv6 addresses) and the edge-case branches in log-line parsing. Security audit trails should never silently drop events.

3. Medium — src/services/agent-volumes/etc-mounts.ts: Test the conditional mount paths for files that may or may not exist on the host (e.g., /etc/ld.so.cache, /etc/alternatives). Ensure both "file exists" and "file absent" branches are covered to guard against accidental exposure.

4. Low — src/dind-bootstrap.ts: Expand DinD bootstrap tests to cover the 11 uncovered branches — particularly the fallback paths when the DinD socket is unavailable or when path-prefix resolution fails.

---

Generated by test-coverage-reporter workflow. Trigger: push. 108 test files · 136 source files measured.

Generated by Test Coverage Reporter · 153.2 AIC · ⊞ 30.7K · ◷

• expires on Jun 17, 2026, 4:35 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-17T16:35:19.730Z.

Closed by Workflow