[Coverage Report] 📊 Test Coverage Report — 2026-06-11

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Count
Statements	96.38%	4770 / 4949
Branches	90.78%	2630 / 2897
Functions	98.77%	563 / 570
Lines	96.46%	4616 / 4785

108 test files · 155 source files

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files are above 50%.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.7%	50.0%	100.0%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100.0%	100.0%	100.0%	✅
src/squid-config.ts	100.0%	100.0%	100.0%	✅
src/docker-manager.ts	100.0%	100.0%	100.0%	✅
src/domain-patterns.ts	97.7%	95.4%	100.0%	✅
src/cli.ts	85.7%	50.0%	100.0%	⚠️

---

📋 Full Coverage Table

All files (sorted by statement coverage)

File	Stmt	Branch	Func	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%
🟢 src/squid-log-reader.ts	82.2%	80.0%	100.0%	82.2%
🟢 src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100.0%	82.5%
🟢 src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
🟢 src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
🟢 src/cli.ts	85.7%	50.0%	100.0%	85.7%
🟢 src/logs/log-parser.ts	86.9%	68.6%	100.0%	87.8%
🟢 src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
🟢 src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
🟢 src/commands/logs-command-helpers.ts	88.5%	83.3%	100.0%	88.3%
🟢 src/dind-bootstrap.ts	88.9%	66.7%	100.0%	88.5%
🟢 src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
🟢 src/commands/validators/log-and-limits.ts	90.3%	77.6%	100.0%	90.3%
🟢 src/services/host-path-prefix.ts	90.3%	81.6%	100.0%	88.9%
🟢 src/config-writer.ts	90.9%	83.0%	100.0%	90.9%
🟢 src/services/agent-volumes/docker-socket.ts	91.7%	93.3%	100.0%	91.7%
🟢 src/services/api-proxy-service.ts	91.7%	50.0%	100.0%	91.7%
🟢 src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
🟢 src/services/agent-volumes/system-mounts.ts	92.3%	75.0%	100.0%	92.3%
🟢 src/diagnostic-collector.ts	92.5%	100.0%	100.0%	92.5%
🟢 src/commands/build-config.ts	92.8%	92.2%	100.0%	92.8%
🟢 src/commands/validators/agent-options.ts	93.0%	88.6%	100.0%	93.0%
🟢 src/services/agent-volumes/hosts-file.ts	93.2%	90.3%	100.0%	92.8%
🟢 src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100.0%	93.5%
🟢 src/squid/ssl-bump.ts	93.8%	91.7%	100.0%	93.8%
🟢 src/ssl-bump.ts	94.0%	84.6%	100.0%	94.7%
🟢 src/host-env.ts	94.1%	80.0%	100.0%	95.9%
🟢 src/logs/log-aggregator.ts	94.7%	87.5%	100.0%	94.7%
🟢 src/commands/main-action.ts	94.8%	89.2%	100.0%	94.8%
🟢 src/upstream-proxy.ts	94.9%	94.7%	100.0%	94.5%
🟢 src/services/cli-proxy-service.ts	95.5%	93.3%	100.0%	95.5%
🟢 src/parsers/volume-parsers.ts	95.8%	100.0%	100.0%	95.8%
🟢 src/container-startup-diagnostics.ts	96.2%	93.9%	100.0%	96.0%
🟢 src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100.0%	96.3%
🟢 src/container-cleanup.ts	96.4%	100.0%	80.0%	95.8%
🟢 src/container-lifecycle.ts	96.8%	86.8%	100.0%	96.6%
🟢 src/services/agent-environment/env-passthrough.ts	96.8%	92.3%	100.0%	96.8%
🟢 src/compose-sanitizer.ts	97.1%	93.3%	100.0%	97.0%
🟢 src/commands/validators/config-assembly.ts	97.4%	92.1%	100.0%	98.2%
🟢 src/logs/log-formatter.ts	97.4%	92.8%	100.0%	97.3%
🟢 src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%
🟢 src/services/agent-service.ts	97.8%	94.6%	100.0%	97.7%
🟢 src/services/agent-volumes/home-strategy.ts	97.8%	83.3%	100.0%	97.7%
🟢 src/config-file.ts	98.1%	97.3%	87.5%	100.0%
🟢 src/rules.ts	98.2%	91.9%	100.0%	98.1%
🟢 src/compose-generator.ts	98.4%	92.5%	100.0%	98.4%
🟢 src/pid-tracker.ts	98.8%	80.8%	100.0%	98.7%
🟢 src/option-parsers.ts	98.9%	95.5%	100.0%	98.8%
🟢 src/api-proxy-config.ts	100.0%	98.2%	100.0%	100.0%
🟢 src/cli-options.ts	100.0%	93.3%	100.0%	100.0%
🟢 src/cli-workflow.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/logs-audit.ts	100.0%	95.7%	100.0%	100.0%
🟢 src/commands/logs-stats.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/logs-summary.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/logs.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/network-setup.ts	100.0%	87.0%	100.0%	100.0%
🟢 src/commands/predownload.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/preflight.ts	100.0%	83.8%	100.0%	100.0%
🟢 src/commands/signal-handler.ts	100.0%	87.5%	100.0%	100.0%
🟢 src/commands/subcommands.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/commands/validate-options.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/constants.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/host-iptables.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/host-iptables-rules.ts	100.0%	97.0%	100.0%	100.0%
🟢 src/host-iptables-cleanup.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/host-iptables-network.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/host-iptables-shared.ts	100.0%	95.0%	100.0%	100.0%
🟢 src/squid-config.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/docker-manager.ts	100.0%	100.0%	100.0%	100.0%
🟢 src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — branch coverage 50% (only file below 80% stmt)
   The validateNetworkOptions() function has three warning branches for Docker/DinD host edge cases (!dockerHostCheck.valid, dindHint && !dockerHostPathPrefix). These paths are security-relevant: they guard against misconfigured DinD setups that could allow unintended filesystem access. Tests currently cover only the "happy path"; the warning branches are untested.

2. src/cli.ts — branch coverage 50% (entry point; 7 total statements)
   The only uncovered branch is the if (require.main === module) guard, which prevents program.parse() from being called when the file is imported. While the file is tiny, adding a test that mocks require.main would reach 100% branch coverage.

3. src/services/api-proxy-service.ts — branch coverage 50%
   Credential-isolation branches in the API proxy sidecar builder are only half covered. Missing branch paths likely include the case where the optional api-proxy service is configured with non-default credential or routing settings, which is directly relevant to the key-injection security boundary.

4. Recent commit 6c1f2b6 (last 7 days) touched action.yml and added several new exported functions (createMainAction, buildConfig, validateApiProxyConfig, preserveIptablesAudit). Most of these are already covered per the JSON report, but preserveIptablesAudit (in src/artifact-preservation.ts at 85.4% stmt / 95.3% branch) has some uncovered statements worth verifying.

---

📈 Recommendations

1. High — src/commands/validators/network-options.ts: Add tests for the three Docker-host warning branches in validateNetworkOptions(): (a) external DOCKER_HOST with no path prefix, (b) dindHint set but no dockerHostPathPrefix. These guard DinD configuration warnings and are the only file below 80%.

2. Medium — src/services/api-proxy-service.ts: Cover the uncovered credential-routing branches in buildApiProxyService(). Target: bring branch coverage from 50% → 80%+ by exercising the non-default API proxy configuration paths.

3. Low — src/cli.ts: Add a single Jest test that stubs require.main !== module to exercise the guard branch around program.parse(), reaching 100% branch coverage on the entry point.

---

Generated by test-coverage-reporter workflow · Trigger: push · Run: 27317331309

Generated by Test Coverage Reporter · 109.2 AIC · ⊞ 30.7K · ◷

• expires on Jun 18, 2026, 1:27 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through this thread. May the build winds remain favorable and the whitelist hold fast.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-18T01:27:19.467Z.

Closed by Workflow