[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.51%	4,851 / 5,026
Branches	91.25%	2,714 / 2,974
Functions	98.78%	569 / 576
Lines	96.64%	4,694 / 4,857

137 source files tracked · 100+ test files · thresholds enforced in CI.

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files exceed 50% statement coverage.

---

🟡 Low Coverage (50–89% statement coverage)

File	Stmt%	Branch%	Func%
src/commands/validators/network-options.ts	66.7% (14/21)	50.0% (5/10)	100%
src/squid-log-reader.ts	82.2% (37/45)	80.0% (20/25)	100%
src/services/agent-volumes/etc-mounts.ts	82.5% (47/57)	67.9% (19/28)	100%
src/logs/audit-enricher.ts	83.6% (51/61)	74.1% (43/58)	100%
src/logs/log-parser.ts	86.9% (73/84)	68.6% (48/70)	100%
src/squid/policy-manifest.ts	87.5% (42/48)	88.2% (30/34)	70% (7/10)
src/artifact-preservation.ts	85.4% (70/82)	95.3% (41/43)	100%

---

🛡️ Security-Critical Path Status

src/host-iptables.ts          stmt=100%  branch=100%  func=100%  ✅
  └─ host-iptables-rules.ts   stmt=100%  branch=100%  func=100%  ✅
  └─ host-iptables-shared.ts  stmt=100%  branch=100%  func=100%  ✅
  └─ host-iptables-cleanup.ts stmt=100%  branch=100%  func=100%  ✅

src/squid-config.ts           stmt=100%  branch=100%  func=100%  ✅
  └─ squid/acl-generator.ts   stmt=100%  branch=100%  func=100%  ✅
  └─ squid/access-rules.ts    stmt=100%  branch=100%  func=100%  ✅
  └─ squid/config-sections.ts stmt=100%  branch=82.8% func=100%  ✅
  └─ squid/policy-manifest.ts stmt=87.5% branch=88.2% func=70%   ⚠️

src/docker-manager.ts         stmt=100%  branch=100%  func=100%  ✅

src/domain-patterns.ts        stmt=97.7% branch=95.4% func=100%  ✅

src/cli.ts                    stmt=85.7% branch=50.0% func=100%  ⚠️
  (7-statement entry-point shim; 1 branch uncovered)

---

📋 Files with Branch Coverage < 85%

File	Branch%	Stmt%
src/commands/validators/network-options.ts	50.0%	66.7%
src/services/agent-environment/environment-builder.ts	66.7%	93.5%
src/logs/log-parser.ts	68.6%	86.9%
src/services/agent-volumes/etc-mounts.ts	67.9%	82.5%
src/logs/audit-enricher.ts	74.1%	83.6%
src/services/agent-volumes/docker-host-staging.ts	72.4%	87.8%
src/services/agent-volumes/workspace-mounts.ts	75.0%	96.3%
src/services/agent-volumes/system-mounts.ts	75.0%	92.3%
src/services/doh-proxy-service.ts	75.0%	90.0%
src/commands/validators/log-and-limits.ts	77.6%	90.3%
src/logs/log-streamer.ts	77.8%	92.2%
src/commands/logs-command-helpers.ts	83.3%	88.5%
src/cli.ts	50.0%	85.7%

---

🔍 Notable Findings

1. network-options.ts — 5/10 branches uncovered (added in #4832)
The three Docker-host warning paths (valid: false, !valid && !pathPrefix, dindHint && !pathPrefix) are not tested. These emit security-relevant warnings when an external or non-standard Docker socket is detected.

2. etc-mounts.ts — 9/28 branches uncovered (modified in #4831)
ARC/DinD identity synthesis has gaps: the synthesizeIdentityFile catch branch, the resolveUniqueName counter loop, and augmentation fallbacks (|| passwdPath) are untested. These handle edge cases in minimal ARC containers without /etc/passwd — a security-sensitive path.

3. log-parser.ts — 22/70 branches uncovered
Squid log parser has large branch gaps. Decision codes like NONE/200, TCP_MISS, TCP_HIT, TCP_MEM_HIT and extractDomain fallback paths (no Host header, raw URL) are not covered — affects correctness of awf logs audit output.

4. squid/policy-manifest.ts — 3 functions uncovered
Protocol-specific allow-rule branches for (redacted) and https://`-prefixed domains are not exercised. Since this manifest drives the audit log enricher, gaps here can produce silent misclassification in audit reports.

Note: COVERAGE_SUMMARY.md in the repo root is stale (shows 38.39%). Actual coverage is 96.51% statements across 137 source files.

---

📈 Recommendations

1. High — network-options.ts: Add unit tests mocking checkDockerHost() returning valid: false and dindHint: true. ~3 test cases.
2. High — etc-mounts.ts: Test buildEtcMounts in DinD mode where stageHostFile returns null and where staged file lacks the runner UID; also test synthesizeIdentityFile error path. ~4–5 test cases.
3. Medium — log-parser.ts: Add fixtures for TCP_MISS, TCP_HIT, TCP_MEM_HIT, NONE/200 decisions plus extractDomain fallback. ~6 test cases.
4. Low — policy-manifest.ts: Call generatePolicyManifest with (redacted) and https://` prefixed domains to trigger protocol-specific rule branches. ~2 test cases.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 4:29 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T16:29:07.939Z.

Closed by Workflow