[Coverage Report] Test Coverage Report — 2026-06-11

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.24%	4,763 / 4,949
Branches	90.68%	2,627 / 2,897
Functions	98.77%	563 / 570
Lines	96.32%	4,609 / 4,785

Test suite: 2,476 / 2,477 passing (1 environment-dependent failure in agent-volumes-mounts.test.ts — DNS pre-resolution test expects specific IPs that differ by runner host).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt	Branch	Functions
src/commands/validators/network-options.ts	66.7%	50.0%	100%

This is the only file below 80%. The uncovered statements are the warning-logging branches for external Docker host detection and DinD path-prefix hints (lines 47–74).

---

🛡️ Security-Critical Path Status

File	Stmt	Branch	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Excellent
src/squid-config.ts	100%	100%	100%	✅ Excellent
src/docker-manager.ts	100%	100%	100%	✅ Excellent
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Good
src/cli.ts	85.7%	50.0%	100%	🟡 Branch gap

src/cli.ts has only 7 statements — the 50% branch gap is the require.main === module guard's "not-main" branch, which is structurally uncoverable by Jest in the normal test path.

---

📋 Files with Notable Coverage Gaps (sorted by statement %)

File	Stmt	Branch	Func
src/commands/validators/network-options.ts	66.7%	50.0%	100%
src/squid-log-reader.ts	82.2%	80.0%	100%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.9%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/services/agent-volumes/hosts-file.ts	84.7%	87.1%	100%
src/artifact-preservation.ts	85.4%	95.3%	100%
src/logs/log-parser.ts	86.9%	68.6%	100%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%
src/commands/validators/log-and-limits.ts	90.3%	77.6%	100%

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — 66.7% stmt, 50% branch (DinD warning paths)
The uncovered paths are logger.warn(...) calls for three conditions: external DOCKER_HOST detected, external host without --docker-host-path-prefix, and dindHint without a prefix. These are security-relevant infrastructure checks — a developer could accidentally break them without any test catching it. Tests should mock checkDockerHost() returning valid: false and resolveDockerHostPathPrefix() returning dindHint: true to exercise all warning branches.

2. src/logs/log-parser.ts — 86.9% stmt, 68.6% branch (audit trail integrity)
Log parsing is critical to audit-trail correctness. The 31 uncovered branches likely cover malformed Squid log lines, edge-case field formats (missing timestamps, unexpected status codes, empty Host headers). Untested parsing branches could silently mis-classify traffic as allowed/denied. Tests with deliberately malformed log entries would raise this coverage significantly.

3. src/services/agent-volumes/etc-mounts.ts — 82.5% stmt, 67.9% branch (agent /etc exposure)
This file controls which /etc files are selectively bind-mounted into the agent container. The 10 uncovered branches likely guard optional file inclusions. Silently broken logic here could either over-expose host system files or fail to provide required files (e.g., SSL certificates, nsswitch.conf).

4. src/logs/audit-enricher.ts — 83.6% stmt, 74.1% branch (new code, PR #4678)
artifact-preservation.ts (85.4%) and audit-enricher.ts (83.6%) were both introduced or heavily modified in the recent "Add opt-in diagnostics artifact for blocked LLM request bodies" commit (102c422). Both have coverage gaps in the 14–17% range, suggesting the new diagnostics path has incomplete test coverage at this stage.

---

📈 Recommendations

1. High — network-options.ts DinD warning branches: Add unit tests that mock checkDockerHost() returning { valid: false } and resolveDockerHostPathPrefix() returning { dindHint: true, dockerHostPathPrefix: undefined }. This would bring the file from 66.7% to ~95%+ and protect security-critical DinD detection logic.

2. Medium — logs/log-parser.ts branch coverage (68.6%): Add a test fixture with malformed Squid log lines (truncated entries, unknown result codes, IPv6 addresses, domains with ports). Robust parsing is essential for audit integrity — misclassified log entries could mask blocked traffic in reports.

3. Medium — services/agent-volumes/etc-mounts.ts branch coverage (67.9%): Parameterize existing tests to cover all combinations of optional /etc mount flags. Untested paths here could silently break SSL certificate availability or expose unintended host files in the agent environment.

4. Low — squid/policy-manifest.ts function coverage (70%): Three functions are completely uncovered. Identify them from the coverage report and add targeted unit tests, especially for any error-handling or fallback logic in policy manifest construction.

---

Generated by test-coverage-reporter workflow. Trigger: schedule

Generated by Test Coverage Reporter · 174.9 AIC · ⊞ 30.7K · ◷

• expires on Jun 18, 2026, 6:12 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-18T06:12:06.892Z.

Closed by Workflow