[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Raw
Statements	96.51%	4851 / 5026
Branches	91.25%	2714 / 2974
Functions	98.78%	569 / 576
Lines	96.64%	4694 / 4857

🔴 Critical Gaps (< 50% statement coverage)

None. All 107 instrumented files are above 50%.

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Funcs
🟡 src/commands/validators/network-options.ts	66.66%	50% ⚠️	100%

Note: This file was modified in the most recent commit (fix(docker-host): pass through loopback TCP DOCKER_HOST #4832). The 5 uncovered branches are all Docker-host warning paths triggered only in DinD/ARC environments.

🛡️ Security-Critical Path Status

src/host-iptables.ts      stmts=100%  branches=100%  funcs=100%  ✅
src/squid-config.ts       stmts=100%  branches=100%  funcs=100%  ✅
src/docker-manager.ts     stmts=100%  branches=100%  funcs=100%  ✅
src/domain-patterns.ts    stmts=97.67% branches=95.38% funcs=100% ✅
src/cli.ts                stmts=85.71% branches=50%   funcs=100%  ⚠️ (1/2 branches — tiny 7-stmt file)

All four highest-priority security modules are at perfect or near-perfect coverage. cli.ts has only 2 branch points total; the uncovered branch is a single guard condition.

📋 Coverage Table (files below 100%)

45 files with statement coverage below 100% (click to expand)

File	Stmts	Branches	Funcs
🟡 src/commands/validators/network-options.ts	66.66%	50% ⚠️	100%
src/squid-log-reader.ts	82.22%	80%	100%
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85% ⚠️	100%
src/logs/audit-enricher.ts	83.60%	74.13%	100%
src/artifact-preservation.ts	85.36%	95.34%	100%
src/cli.ts	85.71%	50% ⚠️	100%
src/logs/log-parser.ts	86.90%	68.57% ⚠️	100%
src/squid/policy-manifest.ts	87.50%	88.23%	70%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%
src/services/doh-proxy-service.ts	90.00%	75%	100%
src/commands/validators/log-and-limits.ts	90.32%	77.58%	100%
src/services/host-path-prefix.ts	90.32%	81.57%	100%
src/config-writer.ts	91.07%	80.95%	100%
src/services/api-proxy-service.ts	91.66%	50% ⚠️	100%
src/services/agent-volumes/docker-socket.ts	91.66%	93.33%	100%
src/logs/log-streamer.ts	92.18%	77.77%	88.88%
src/services/agent-volumes/system-mounts.ts	92.30%	75%	100%
src/diagnostic-collector.ts	92.50%	100%	100%
src/commands/build-config.ts	92.85%	92.94%	100%
src/commands/validators/agent-options.ts	92.98%	88.57%	100%
src/services/agent-volumes/hosts-file.ts	93.22%	90.32%	100%
src/services/agent-environment/environment-builder.ts	93.54%	66.66% ⚠️	100%
src/squid/ssl-bump.ts	93.75%	91.66%	100%
src/ssl-bump.ts	93.96%	84.61%	100%
src/host-env.ts	94.11%	80%	100%
src/logs/log-aggregator.ts	94.73%	87.50%	100%
src/services/cli-proxy-service.ts	94.73%	92.30%	100%
src/commands/main-action.ts	94.80%	89.18%	100%
src/upstream-proxy.ts	94.93%	94.73%	100%
src/parsers/volume-parsers.ts	95.83%	100%	100%
src/container-startup-diagnostics.ts	96.15%	93.87%	100%
src/services/agent-volumes/workspace-mounts.ts	96.29%	75%	100%
src/container-cleanup.ts	96.42%	100%	80%
src/services/agent-environment/env-passthrough.ts	96.77%	92.30%	100%
src/compose-sanitizer.ts	97.14%	93.33%	100%
src/option-parsers.ts	97.29%	93.84%	100%
src/logs/log-formatter.ts	97.43%	92.85%	100%
src/commands/validators/config-assembly.ts	97.47%	90.74%	100%
src/domain-patterns.ts	97.67%	95.38%	100%
src/services/agent-service.ts	97.77%	94.64%	100%
src/config-file.ts	98.11%	97.29%	87.50%
src/rules.ts	98.18%	91.89%	100%
src/compose-generator.ts	98.43%	92.50%	100%
src/pid-tracker.ts	98.78%	80.76%	100%

62 additional files (test helpers and 100%-covered source files) omitted.

🔍 Notable Findings

1. src/commands/validators/network-options.ts — newly merged code, 50% branch coverage.
   Modified in the latest commit (fix(docker-host): pass through loopback TCP DOCKER_HOST for ARC/DinD orchestration #4832, loopback TCP DOCKER_HOST passthrough). All 5 uncovered branches are in warning-emission blocks: if (!dockerHostCheck.valid) (lines 49–56), the split-filesystem hint (lines 61–65), and the ARC/DinD hint (lines 66–79). These are environment-variable-driven code paths never exercised in the test suite.

2. src/logs/log-parser.ts — 22 uncovered branches in Squid log field parsing.
   Fallback values for missing method, decision, dest, url, and host fields (e.g. obj.method || '') are never tested with null/undefined inputs. IPv6 destination parsing (if (rawDest.startsWith('['))) and lastColon === -1 edge case are also untested. These paths are hit when Squid produces non-standard or truncated log lines.

3. src/services/agent-volumes/etc-mounts.ts — 9 uncovered branches in /etc/passwd synthesis.
   Fallback paths when synthesizeIdentityFile() returns undefined (i.e., file-write failure) are untested — the || passwdPath and || '/etc/passwd' fallbacks both remain cold. This path directly affects container identity isolation and is worth hardening with a test that simulates write failure.

4. src/services/agent-environment/environment-builder.ts — 2 uncovered branches (66.66% branch).
   Two conditional edge cases in the environment assembly pipeline are untested. Minor, but the environment builder feeds all agent container environment variables, including proxy settings.

📈 Recommendations

1. High — network-options.ts DinD warning branches: Add a test that sets DOCKER_HOST to a non-loopback TCP address and verifies the three warning logger.warn() calls are made. This is the most recently touched file with the lowest branch coverage, and the DinD warning path is relevant to ARC runner security.

2. Medium — log-parser.ts malformed/IPv6 log entries: Add test cases with log entries where method/decision/url are missing (or null), and at least one entry with an IPv6 destination ([::1]:443). This ensures awf logs stats and awf logs summary don't crash on real-world atypical Squid output.

3. Low — etc-mounts.ts synthesis failure fallback: Mock synthesizeIdentityFile to return undefined and assert that the bind mounts fall back to /etc/passwd and /etc/group rather than crashing. This covers the last untested path in the container credential-isolation layer.

---

Generated by test-coverage-reporter workflow. Trigger: push. Run: 27450830497

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 12:36 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T00:36:32.738Z.

Closed by Workflow