[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage	Hit / Total
Statements	96.54%	4,858 / 5,032
Branches	91.25%	2,714 / 2,974
Functions	98.79%	574 / 581
Lines	96.66%	4,701 / 4,863

📁 Source files measured: 120 | Test runner: Jest

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 120 files are above 50% statement coverage. ✅

---

🟡 Low Coverage (50–79% statement coverage)

File	Lines	Branches	Notes
src/commands/validators/network-options.ts	66.7% (14/21)	50% (5/10)	DinD/DOCKER_HOST warning paths uncovered

---

🛡️ Security-Critical Path Status

✅ host-iptables.ts + rules/shared/cleanup/network  Lines:100%  Branches:100%
✅ squid-config.ts (re-export) + squid/access-rules  Lines:100%  Branches:100%
✅ squid/acl-generator.ts + domain-acl.ts            Lines:100%  Branches:100%
✅ squid/validation.ts                               Lines:100%  Branches:100%
✅ domain-patterns.ts                                Lines: 98%  Branches: 95%
✅ docker-manager.ts (re-export)                     Lines:100%  Branches:100%

⚠️ squid/policy-manifest.ts                         Lines: 87%  Branches: 88%  Fns: 70%
⚠️ squid/config-sections.ts                         Lines:100%  Branches: 83%
⚠️ cli.ts                                           Lines: 86%  Branches: 50%
⚠️ services/agent-volumes/etc-mounts.ts             Lines: 83%  Branches: 68%

---

📋 Files with Branch Coverage < 80%

File	Lines	Branches	Fns
src/cli.ts	85.7%	50% (1/2)	100%
src/commands/validators/network-options.ts	66.7%	50% (5/10)	100%
src/services/agent-environment/environment-builder.ts	93.5%	66.7% (4/6)	100%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.9% (19/28)	100%
src/logs/log-parser.ts	87.8%	68.6% (48/70)	100%
src/services/agent-volumes/docker-host-staging.ts	87.2%	72.4% (21/29)	100%
src/logs/audit-enricher.ts	89.4%	74.1% (43/58)	100%
src/services/agent-volumes/system-mounts.ts	92.3%	75% (9/12)	100%
src/services/agent-volumes/workspace-mounts.ts	96.3%	75% (30/40)	100%
src/services/doh-proxy-service.ts	90%	75% (3/4)	100%
src/logs/log-streamer.ts	92.1%	77.8% (28/36)	88.9%
src/commands/validators/log-and-limits.ts	90.3%	77.6% (45/58)	100%

---

🔍 Notable Findings

1. src/services/agent-volumes/etc-mounts.ts — 67.9% branch coverage (security-sensitive)
Controls which /etc files are bind-mounted into the agent container (notably excluding /etc/shadow). The DinD staging path — synthesizing /etc/passwd+/etc/group when the runner lacks them, including resolveUniqueName counter logic for UID/GID conflicts — is undertested. Failures here could surface identity or permission issues in ARC runners.

2. src/logs/log-parser.ts — 68.6% branch coverage
The Squid log parser has 22/70 branches uncovered. Likely missing: IPv6 host headers, bare-IP requests, "-" user-agent variations, and lines with missing fields. Robust parsing is critical for forensic auditability — unhandled log lines are silently dropped.

3. src/commands/validators/network-options.ts — 50% branch coverage (14/21 lines)
The warning-emission paths for external DOCKER_HOST detection and ARC/DinD hint warnings are never triggered in tests. These paths validate the DinD security setup and guide users to configure --docker-host-path-prefix.

4. src/squid/policy-manifest.ts — 70% function coverage (7/10 functions)
Three exported functions are never exercised. These likely handle enableHostAccess/allowHostPorts policy rules. If they represent dead code they should be removed; otherwise they need tests since they feed the audit-enricher that attributes Squid decisions to named rules.

---

📈 Recommendations

1. High — Test etc-mounts.ts DinD staging failures: mock stageHostFile returning null and staged files with conflicting UID/GID entries. Covers the identity-file synthesis that preserves shadow-file exclusion.

2. High — Add log-parser.ts edge-case tests: IPv6 in Host header, – sentinel fields, port-only URLs, extra whitespace, unusual user-agent strings. Prevents silent log drops that could obscure firewall bypass.

3. Medium — Test network-options.ts with `DOCKER_HOST=(10.0.0.1/redacted) and a non-standard unix socket path to trigger the DinD warning branches.

4. Low — Audit 3 uncovered functions in squid/policy-manifest.ts — remove if dead code, or add tests for enableHostAccess/allowHostPorts policy generation.

---

Generated by test-coverage-reporter workflow · Trigger: push · Date: 2026-06-13

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 8:48 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent has passed through the warded gates and left this omen in the thread. May the logs remain clear and the build paths true.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent has passed through the warded gates and left this omen in the thread. May the logs remain clear and the build paths true.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T20:48:24.226Z.

Closed by Workflow