[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-13

Coverage data from coverage/coverage-summary.json · 111 test files / 142 source files (78% ratio)

Overall Coverage

Metric	Coverage	Count
Statements	96.51% ✅	4,851 / 5,026
Branches	91.25% ✅	2,714 / 2,974
Functions	98.78% ✅	569 / 576
Lines	96.64% ✅	4,694 / 4,857

Overall health is excellent. No files fall below the 50% threshold.

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 142 source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Funcs
src/commands/validators/network-options.ts	66.66%	50%	100%

This file was recently modified and validates Docker host, domain resolution, and network configuration options. The uncovered branches correspond to warning paths for external DOCKER_HOST detection and DinD hint scenarios.

---

🛡️ Security-Critical Path Status

Host iptables (network isolation rules)
  src/host-iptables-rules.ts      ✅ 100% stmts  100% branches  100% funcs
  src/host-iptables-shared.ts     ✅ 100% stmts  100% branches  100% funcs
  src/host-iptables-cleanup.ts    ✅ 100% stmts  100% branches  100% funcs
  src/host-iptables-network.ts    ✅ 100% stmts  100% branches  100% funcs

Squid domain filtering (HTTP/HTTPS ACLs)
  src/squid/access-rules.ts       ✅ 100% stmts  100% branches  100% funcs
  src/squid/acl-generator.ts      ✅ 100% stmts  100% branches  100% funcs
  src/squid/domain-acl.ts         ✅ 100% stmts  100% branches  100% funcs
  src/squid/validation.ts         ✅ 100% stmts  100% branches  100% funcs
  src/squid/config-generator.ts   ✅ 100% stmts  100% branches  100% funcs
  src/squid/config-sections.ts    ✅ 100% stmts   82.8% branches 100% funcs
  src/squid/policy-manifest.ts    ⚠️  87.5% stmts  88.2% branches  70% funcs

Domain pattern matching
  src/domain-patterns.ts          ✅  97.7% stmts  95.4% branches 100% funcs

Agent container volume isolation
  src/services/agent-volumes/etc-mounts.ts          ⚠️  82.5% stmts  67.9% branches 100% funcs
  src/services/agent-volumes/docker-host-staging.ts ⚠️  87.8% stmts  72.4% branches 100% funcs

Log parsing (audit trail integrity)
  src/logs/log-parser.ts          ⚠️  86.9% stmts  68.6% branches 100% funcs
  src/logs/audit-enricher.ts      ⚠️  83.6% stmts  74.1% branches 100% funcs

---

📋 Full Coverage Table

Expand full per-file breakdown (sorted by branch coverage, ascending)

File	Stmts	Branches	Funcs	Lines
src/commands/validators/network-options.ts	66.7%	50.0%	100%	66.7%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100%	93.5%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.9%	100%	82.5%
src/logs/log-parser.ts	86.9%	68.6%	100%	87.8%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%	87.2%
src/logs/audit-enricher.ts	83.6%	74.1%	100%	89.4%
src/services/agent-volumes/system-mounts.ts	92.3%	75.0%	100%	92.3%
src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100%	96.3%
src/services/doh-proxy-service.ts	90.0%	75.0%	100%	90.0%
src/commands/validators/log-and-limits.ts	90.3%	77.6%	100%	90.3%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
src/host-env.ts	94.1%	80.0%	100%	95.9%
src/pid-tracker.ts	98.8%	80.8%	100%	98.7%
src/squid-log-reader.ts	82.2%	80.0%	100%	82.2%
src/config-writer.ts	91.1%	81.0%	100%	91.1%
src/services/host-path-prefix.ts	90.3%	81.6%	100%	88.9%
src/squid/config-sections.ts	100%	82.8%	100%	100%
src/commands/preflight.ts	100%	83.8%	100%	100%
src/ssl-bump.ts	94.0%	84.6%	100%	94.7%
src/squid/policy-manifest.ts	87.5%	88.2%	70.0%	87.2%
src/commands/validators/agent-options.ts	93.0%	88.6%	100%	93.0%
src/commands/main-action.ts	94.8%	89.2%	100%	94.8%
src/commands/network-setup.ts	100%	87.0%	100%	100%
src/commands/signal-handler.ts	100%	87.5%	100%	100%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%	88.3%
src/artifact-preservation.ts	85.4%	95.3%	100%	85.4%
src/logs/log-aggregator.ts	94.7%	87.5%	100%	94.7%
src/commands/validators/config-assembly.ts	97.5%	90.7%	100%	98.3%
src/logs/log-discovery.ts	100%	90.0%	100%	100%
src/domain-patterns.ts	97.7%	95.4%	100%	97.6%
src/api-proxy-config.ts	100%	98.2%	100%	100%
src/services/api-proxy-service-config.ts	100%	97.9%	100%	100%
src/option-parsers.ts	97.3%	93.8%	100%	99.0%
(all remaining files)	≥ 90%	≥ 90%	≥ 90%	≥ 90%

---

🔍 Notable Findings

1. src/services/agent-volumes/etc-mounts.ts — 67.9% branch coverage
Controls which /etc files (passwd, group, SSL certs) are bind-mounted into the agent container — a key security isolation surface. Uncovered branches include: the synthesizeIdentityFile catch/failure path, resolveUniqueName counter loop (when both preferred name and name-id are already taken), and the case where DinD staging returns undefined and falls back to /etc/passwd. These are reachable via minimal ARC containers.

2. src/logs/log-parser.ts — 68.6% branch coverage
The parseAuditJsonlLine function has 22 uncovered branches, including: bracketed IPv6 address parsing (e.g. [2001:db8::1]:443), the closeBracket === -1 edge case, the timestamp fallback from an invalid ISO string to the legacy ts epoch field, and IPv4 lastIndexOf(':') when the port candidate fails the /^\d+$/ test. Gaps here risk silently dropping or misclassifying audit log entries.

3. src/squid/policy-manifest.ts — 70% function coverage (7/10)
Three functions generating protocol-specific allow rules are not exercised: allow-http-only-regex, allow-https-only-regex, and allow-both-regex branches. These fire only when callers pass domain patterns (regex-style entries) with protocol qualifiers. Missing coverage means the policy manifest output for regex-whitelisted domains is untested.

4. src/commands/validators/network-options.ts — 50% branch coverage (recently changed)
Both warning branches (!dockerHostCheck.valid and dindHint && !dockerHostPathPrefix) have no test coverage. Since this validator recently landed, adding tests for the DinD/ARC warning paths would prevent silent regressions in split-filesystem setups.

---

📈 Recommendations

1. High — src/services/agent-volumes/etc-mounts.ts: Add unit tests for DinD mode with: (a) missing /etc/passwd triggering synthesis, (b) synthesizeIdentityFile fs failure returning undefined, and (c) resolveUniqueName collision loop. This file directly governs identity file isolation in agent containers.

2. Medium — src/logs/log-parser.ts: Add test cases for parseAuditJsonlLine with bracketed IPv6 destinations, invalid ISO timestamps falling back to ts, and malformed dest strings. Ensures audit trail integrity under non-standard log formats.

3. Medium — src/squid/policy-manifest.ts: Test generatePolicyManifest with configs containing regex-style domain patterns (e.g. *.example.com) split by HTTP-only and HTTPS-only protocol qualifiers to exercise the three uncovered protocol-specific rule generators.

4. Low — src/commands/validators/network-options.ts: Add tests simulating DOCKER_HOST=(192.168.1.1/redacted) (external host, no path prefix) and AWF_DIND=1` with a non-standard socket path to cover the warning-branch paths and prevent regressions in the newly refactored network options validator.

---

Generated by test-coverage-reporter workflow · Trigger: push · 2026-06-13T16:14Z

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 4:18 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent has passed through and left a brief oracle-mark upon this discussion.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T16:18:21.570Z.

Closed by Workflow