[Coverage Report] Test Coverage Report — 2026-06-11

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Total	Covered
Statements	96.38%	4,949	4,770
Branches	90.78%	2,897	2,630
Functions	98.77%	570	563
Lines	96.46%	4,785	4,616

160 test files across 155 source files.

---

🔴 Critical Gaps (< 50% statement coverage)

None.

🟡 Low Coverage (50–79% statement coverage)

File	Stmt %	Branch %
src/commands/validators/network-options.ts	66.7%	50.0%

---

🛡️ Security-Critical Path Status

File	Stmt %	Branch %	Func %	Status
src/host-iptables.ts	100.0%	100.0%	100.0%	✅ Full coverage
src/squid-config.ts	100.0%	100.0%	100.0%	✅ Full coverage
src/docker-manager.ts	100.0%	100.0%	100.0%	✅ Full coverage
src/domain-patterns.ts	97.7%	95.4%	100.0%	✅ Excellent
src/cli.ts	85.7%	50.0%	100.0%	⚠️ Branch gap (see below)

src/cli.ts branch gap: the require.main === module guard (line 11) is never entered in tests since tests import the module rather than execute it as a script. Low risk — not a logic gap.

---

📋 Files with Notable Branch Gaps (< 70%)

File	Stmt %	Branch %	Uncovered area
src/commands/validators/network-options.ts	66.7%	50.0%	External Docker host warning paths (lines 47–74)
src/cli.ts	85.7%	50.0%	require.main === module guard (line 11)
src/services/api-proxy-service.ts	91.7%	50.0%	throw when proxyIp missing (line 33)
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	Conditional env-builder branches
src/dind-bootstrap.ts	88.9%	66.7%	DinD detection/assertion error paths (lines 23, 28, 33, 70, 78)
src/logs/log-parser.ts	86.9%	68.6%	Bracketed IPv6 destination parsing (lines 180–202)
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	Conditional /etc bind-mount guards

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — external Docker host paths uncovered
Lines 47–74: the !dockerHostCheck.valid branch (triggered when DOCKER_HOST points to an external TCP daemon) is never tested. No test currently sets DOCKER_HOST to a non-standard value when calling validateNetworkOptions.

2. src/logs/log-parser.ts — IPv6 bracketed destination parsing uncovered
Lines 181–189: the rawDest.startsWith('[') branch for entries like [2001:db8::1]:443 is entirely unexercised. Risk: incorrect metrics in awf logs stats output when agents connect to IPv6 upstreams.

3. src/dind-bootstrap.ts — DinD bootstrap failure paths uncovered
Lines 23, 28, 33, 70, 78: assertAbsolutePath throws and non-standard Docker socket detection branches. These cover misconfigured ARC/DinD failure modes.

4. Recent commit well-covered
fix(api-proxy): use 'token' auth prefix for GHES enterprise Copilot API (#4755) — src/api-proxy-config.ts now has 100% statement / 98.2% branch coverage. ✅

---

📈 Recommendations

1. Medium — network-options.ts: Add a test setting DOCKER_HOST=(somehost/redacted) before calling validateNetworkOptions` to cover the external host warning branches (lines 47–74). Only file below 80% statement coverage.

2. Medium — log-parser.ts: Add test cases for IPv6 bracketed log entries (e.g. [2001:db8::1]:443) to ensure awf logs stats/awf logs summary work correctly for IPv6 upstreams.

3. Low — dind-bootstrap.ts: Test assertAbsolutePath error throws and non-standard Docker socket detection. Improves confidence in ARC/DinD setups.

4. Low — etc-mounts.ts: Unit-test conditional /etc bind-mount logic for absent files or differing feature flags.

---

Generated by test-coverage-reporter workflow · Trigger: push · Run: 27356509720

Generated by Test Coverage Reporter · 196.4 AIC · ⊞ 30.7K · ◷

• expires on Jun 18, 2026, 3:14 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, and the latest omens favor this discussion.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has walked this discussion. The omens are clear, the build held, and the firewall stood firm.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent passed through this discussion, and the run remains in alignment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke-test agent has passed through this discussion and left a brief oracle-mark upon the record.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stirred, and the smoke test omen reads true. The Codex agent passed through the fire and returned with a clean sign.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-18T15:14:21.953Z.

Closed by Workflow