[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.51%	4,871 / 5,047
Branches	91.20%	2,718 / 2,980
Functions	98.79%	574 / 581
Lines	96.63%	4,714 / 4,878

Overall health is strong. No files fall below 50% statement coverage.

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt %	Branch %	Fn %
src/commands/validators/network-options.ts	66.66%	50.00%	100%

This file validates Docker host, domain resolution, and network configuration options — security-relevant input validation with only half its branches tested.

---

🛡️ Security-Critical Path Status

src/host-iptables.ts            100% stmt | 100% branch | 100% fn  ✅
src/host-iptables-rules.ts      100% stmt | 100% branch | 100% fn  ✅
src/host-iptables-shared.ts     100% stmt | 100% branch | 100% fn  ✅
src/host-iptables-cleanup.ts    100% stmt | 100% branch | 100% fn  ✅
src/squid-config.ts             100% stmt | 100% branch | 100% fn  ✅
src/squid/acl-generator.ts      100% stmt | 100% branch | 100% fn  ✅
src/squid/access-rules.ts       100% stmt | 100% branch | 100% fn  ✅
src/squid/config-generator.ts   100% stmt | 100% branch | 100% fn  ✅
src/squid/validation.ts         100% stmt | 100% branch | 100% fn  ✅
src/squid/domain-acl.ts         100% stmt | 100% branch | 100% fn  ✅
src/domain-patterns.ts          97.67% stmt |  95.38% branch | 100% fn  ✅
src/docker-manager.ts           100% stmt | 100% branch | 100% fn  ✅
src/squid/policy-manifest.ts    87.50% stmt |  88.23% branch |  70% fn  ⚠️
src/logs/log-parser.ts          86.90% stmt |  68.57% branch | 100% fn  ⚠️
src/services/agent-volumes/etc-mounts.ts   82.45% stmt |  67.85% branch | 100% fn  ⚠️
src/commands/validators/network-options.ts 66.66% stmt |  50.00% branch | 100% fn  🟡

The iptables rules engine and Squid ACL generation are fully covered. The gaps are in higher-level validators, log parsing, and the etc-mounts isolation logic.

---

📋 Notable Files by Coverage (sorted by statement %)

Full per-file coverage table (click to expand)

File	Stmt %	Branch %	Fn %
src/commands/validators/network-options.ts	66.66%	50.00%	100%
src/squid-log-reader.ts	82.22%	80.00%	100%
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%
src/logs/audit-enricher.ts	83.60%	74.13%	100%
src/config-writer.ts	85.33%	80.55%	100%
src/artifact-preservation.ts	85.36%	95.34%	100%
src/logs/log-parser.ts	86.90%	68.57%	100%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%
src/squid/policy-manifest.ts	87.50%	88.23%	70%
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%
src/logs/log-aggregator.ts	94.73%	87.50%	100%
src/logs/log-streamer.ts	92.18%	77.77%	88.88%
src/commands/validators/log-and-limits.ts	90.32%	77.58%	100%
src/workdir-setup.ts	94.44%	79.62%	100%
src/services/agent-volumes/workspace-mounts.ts	96.29%	75.00%	100%
src/pid-tracker.ts	98.78%	80.76%	100%
src/host-env.ts	94.11%	80.00%	100%
src/ssl-bump.ts	93.96%	84.61%	100%
src/upstream-proxy.ts	94.93%	94.73%	100%
src/domain-patterns.ts	97.67%	95.38%	100%
All remaining files	≥ 90%	≥ 80%	≥ 87%

---

🔍 Notable Findings

1. src/logs/log-parser.ts — 68.57% branch coverage

This file parses Squid's firewall_detailed log format. With 70 total branches and only 48 covered, there are ~22 untested decision points. Likely gaps: malformed log line handling in parseLogLine(), edge cases in extractDomain() (non-standard URLs, IPv6 addresses), and JSONL parse error paths in parseAuditJsonlLine(). Since this drives the awf logs stats and awf logs summary reporting commands, bugs here could silently misclassify allowed/denied traffic.

2. src/services/agent-volumes/etc-mounts.ts — 67.85% branch coverage

Handles the selective bind-mounting of /etc files into the agent container sandbox (passwd, group, nsswitch.conf, etc.). 9 of 28 branches are uncovered. Missing coverage likely includes: fallback to synthesizeIdentityFile() when host files are unreadable, DinD path-prefix interactions, and the readFileContent() exception paths. Errors here can break UID/GID mapping in the container.

3. src/commands/validators/network-options.ts — 50% branch coverage

The validateNetworkOptions() function is the security gatekeeper that assembles domain allowlists, DNS config, and upstream proxy settings before they're passed to Squid. Only 5 of 10 branches are exercised — the uncovered half likely includes invalid/absent domain lists, conflicting DNS-over-HTTPS settings, and upstream proxy validation failures. Given that misconfigured options here could weaken the domain ACL, this is the highest-priority gap.

4. src/squid/policy-manifest.ts — 70% function coverage (7/10 functions)

Three functions in the policy manifest generator are entirely untested. The manifest is used by the audit enricher to classify Squid log entries as allowed/denied; uncovered functions may handle edge cases like empty domain lists or DLP rule generation. generatePolicyManifest() with host-port access and DLP features enabled is likely undertested.

---

📈 Recommendations

1. High — src/commands/validators/network-options.ts: Add unit tests covering: (a) missing --allow-domains flag, (b) --dns-over-https combined with custom --dns-servers, (c) invalid upstream proxy URLs. These are security-validation branches that determine what traffic Squid will allow.

2. High — src/logs/log-parser.ts: Add tests for malformed log lines (truncated entries, IPv6 client addresses, URLs with query strings, missing User-Agent field). Also cover the parseAuditJsonlLine() error branch when JSON is invalid. Ensures the reporting pipeline accurately reflects what the firewall allowed or blocked.

3. Medium — src/services/agent-volumes/etc-mounts.ts: Add tests for when host /etc/passwd or /etc/group files are absent or unreadable (synthesize fallback path), and for DinD mode where path-prefix translation changes mount sources. These paths affect container sandbox integrity.

4. Low — src/squid/policy-manifest.ts: Cover the 3 uncovered functions with tests that enable --enable-host-access, --allow-host-ports, and --enable-dlp together. This ensures the audit enricher correctly classifies log entries under complex policies.

---

Generated by test-coverage-reporter workflow · Trigger: push · Date: 2026-06-13

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 8:56 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T20:56:19.034Z.

Closed by Workflow