[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.51%	4,871 / 5,047
Branches	91.20%	2,718 / 2,980
Functions	98.79%	574 / 581
Lines	96.63%	4,714 / 4,878

138 source files tracked. 64 dedicated test files at the top-level src/ layer alone (more test files than top-level source files).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 138 files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.66% 🟡	50.00% 🔴	100%

Only one file falls in this range. It validates Docker host detection, domain resolution, and network config — the key warning-branch paths (external Docker host, missing path prefix, DinD hint) are never exercised in tests.

---

🛡️ Security-Critical Path Status

src/host-iptables.ts          stmt=100%  br=100%  fn=100%  ✅ (facade)
src/host-iptables-rules.ts    stmt=100%  br=100%  fn=100%  ✅ (141 stmts, 67 branches)
src/host-iptables-shared.ts   stmt=100%  br=100%  fn=100%  ✅ (85 stmts, 20 branches)
src/host-iptables-cleanup.ts  stmt=100%  br=100%  fn=100%  ✅
src/squid-config.ts           stmt=100%  br=100%  fn=100%  ✅ (facade)
src/squid/config-generator.ts stmt=100%  br=100%  fn=100%  ✅
src/squid/access-rules.ts     stmt=100%  br=100%  fn=100%  ✅ (42 branches)
src/squid/acl-generator.ts    stmt=100%  br=100%  fn=100%  ✅
src/squid/domain-acl.ts       stmt=100%  br=100%  fn=100%  ✅
src/squid/validation.ts       stmt=100%  br=100%  fn=100%  ✅
src/docker-manager.ts         stmt=100%  br=100%  fn=100%  ✅ (facade)
src/domain-patterns.ts        stmt=97.67% br=95.38% fn=100% ✅
src/cli.ts                    stmt=85.71% br=50.00% fn=100% ⚠️  (2 branches; 1 uncovered)

All core security modules (iptables rule generation, Squid ACL/config generation, domain pattern matching) have 100% coverage. The one flag is cli.ts's branch coverage — though with only 2 total branches in that file (it's an entry-point bootstrap), the absolute exposure is minimal.

---

📋 Full Coverage Table — Notable Files

Files with any metric below 90% (test utilities excluded):

File	Stmt%	Branch%	Fn%
src/commands/validators/network-options.ts	66.66%	50.00%	100%
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%
src/logs/audit-enricher.ts	83.60%	74.13%	100%
src/logs/log-parser.ts	86.90%	68.57%	100%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%
src/squid/policy-manifest.ts	87.50%	88.23%	70.00%
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%
src/cli.ts	85.71%	50.00%	100%
src/config-writer.ts	85.33%	80.55%	100%
src/squid-log-reader.ts	82.22%	80.00%	100%
src/artifact-preservation.ts	85.36%	95.34%	100%
src/commands/validators/log-and-limits.ts	90.32%	77.58%	100%
src/logs/log-streamer.ts	92.18%	77.77%	88.88%
src/workdir-setup.ts	94.44%	79.62%	100%
src/services/agent-environment/environment-builder.ts	93.54%	66.66%	100%
src/services/agent-volumes/workspace-mounts.ts	96.29%	75.00%	100%
src/services/agent-volumes/system-mounts.ts	92.30%	75.00%	100%
src/host-env.ts	94.11%	80.00%	100%
src/pid-tracker.ts	98.78%	80.76%	100%

All remaining files (≥ 90% all metrics)

File	Stmt%	Branch%	Fn%
src/api-proxy-config.ts	100%	98.24%	100%
src/cli-options.ts	100%	93.33%	100%
src/cli-workflow.ts	100%	100%	100%
src/compose-generator.ts	98.43%	92.50%	100%
src/compose-sanitizer.ts	97.14%	93.33%	100%
src/config-file.ts	98.11%	97.29%	87.50%
src/container-cleanup.ts	100%	100%	80.00%
src/container-lifecycle.ts	100%	94.73%	100%
src/container-startup-diagnostics.ts	96.15%	93.87%	100%
src/container-stop.ts	100%	100%	100%
src/copilot-api-resolver.internal.ts	100%	92.85%	100%
src/copilot-model.ts	100%	100%	100%
src/diagnostic-collector.ts	92.50%	100%	100%
src/dind-bootstrap.ts	100%	100%	100%
src/dind-probe.ts	100%	93.75%	100%
src/dlp.ts	100%	100%	100%
src/dns-resolver.ts	100%	91.66%	100%
src/docker-host.ts	100%	100%	100%
src/domain-utils.ts	100%	100%	100%
src/env-utils.ts	100%	100%	100%
src/github-env.ts	100%	100%	100%
src/host-identity.ts	100%	96.87%	100%
src/image-tag.ts	100%	100%	100%
src/logger.ts	100%	90.90%	100%
src/option-parsers.ts	97.29%	93.84%	100%
src/redact-secrets.ts	100%	100%	100%
src/rules.ts	98.18%	91.89%	100%
src/schema-validator.ts	100%	100%	100%
src/ssl-bump.ts	93.96%	84.61%	100%
src/upstream-proxy.ts	94.93%	94.73%	100%
src/commands/build-config.ts	92.85%	92.94%	100%
src/commands/logs-audit.ts	100%	95.65%	100%
src/commands/main-action.ts	94.80%	89.18%	100%
src/commands/network-setup.ts	100%	86.95%	100%
src/commands/preflight.ts	100%	83.78%	100%
src/commands/signal-handler.ts	100%	87.50%	100%
src/commands/validators/agent-options.ts	92.98%	88.57%	100%
src/commands/validators/config-assembly.ts	98.09%	92.22%	100%
src/logs/log-aggregator.ts	94.73%	87.50%	100%
src/logs/log-discovery.ts	100%	90.00%	100%
src/logs/log-formatter.ts	97.43%	92.85%	100%
src/logs/stats-formatter.ts	100%	93.47%	100%
src/services/agent-service.ts	97.77%	94.64%	100%
src/services/api-proxy-credential-env.ts	100%	100%	100%
src/services/api-proxy-service-config.ts	100%	97.93%	100%
src/services/api-proxy-service.ts	91.66%	50.00%	100%
src/services/cli-proxy-service.ts	94.73%	92.30%	100%
src/services/doh-proxy-service.ts	90.00%	75.00%	100%
src/services/host-path-prefix.ts	90.32%	81.57%	100%
src/services/agent-environment/environment-builder.ts	93.54%	66.66%	100%
src/services/agent-volumes/docker-socket.ts	91.66%	93.33%	100%
src/services/agent-volumes/hosts-file.ts	93.22%	90.32%	100%
src/squid/config-sections.ts	100%	82.75%	100%
src/squid/ssl-bump.ts	93.75%	91.66%	100%

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — 66.66% stmt, 50% branches
The function validateNetworkOptions() has no dedicated test file (the only test in this directory, config-assembly.test.ts, doesn't call it). Four warning branches are entirely uncovered: when DOCKER_HOST points to an external daemon, when the path prefix is absent on an external host, and when a DinD hint is detected without a prefix. These are exactly the paths most likely to trip up ARC/DinD deployments.

2. src/logs/log-parser.ts — 68.57% branch coverage (22 of 70 branches uncovered)
Despite 100% function coverage, nearly a third of the parser's branches are untested. The firewall_detailed log format parser covers: IPv6 addresses, missing host headers (-), non-CONNECT methods (plain HTTP), and unusual user-agent strings. Misclassification here silently corrupts audit output — allowed vs denied counts could be wrong.

3. src/services/agent-volumes/etc-mounts.ts — 82.45% stmt, 67.85% branches (9/28 uncovered)
Handles construction of the /etc/passwd, /etc/group, and other /etc bind mounts for the agent container. The uncovered branches include the catch path of synthesizeIdentityFile (disk write failure) and conditional UID/GID augmentation logic. A regression here could cause the agent to run as the wrong UID or expose host identity data.

4. src/logs/audit-enricher.ts — 83.6% stmt, 74.13% branches
Replays Squid ACL evaluation order to attribute each log entry to a firewall rule. Untested branches here mean certain rule-match paths (e.g., upstream-proxy rules, DoH rules) have no verified match-reason output. This affects the accuracy of awf logs stats and awf logs summary security reports.

---

📈 Recommendations

1. High — src/commands/validators/network-options.ts: Add a test file covering validateNetworkOptions() with mocked checkDockerHost() returning valid: false, with/without a dockerHostPathPrefix, and with dindHint: true. This covers all 5 currently uncovered branches and brings the only sub-70% file above 90%.

2. Medium — src/logs/log-parser.ts: Expand log-parser.test.ts with adversarial/edge-case inputs: IPv6 client addresses, - in the host field, plain HTTP GET lines (non-CONNECT), very long user-agent strings, and partial/malformed lines. Targeting 22 specific uncovered branches improves security audit reliability.

3. Medium — src/services/agent-volumes/etc-mounts.ts: Mock fs.writeFileSync to throw in the synthesizeIdentityFile tests, and exercise the UID/GID augmentation paths with UIDs already present in passwd/missing from group. The 9 uncovered branches are almost entirely in error-handling paths for credential file synthesis.

4. Low — src/squid/policy-manifest.ts: Cover the 3 uncovered functions (function coverage 70%) — these handle policy manifest serialization. Add round-trip tests (serialize → deserialize → compare) to verify policy state is preserved across awf logs audit runs.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 9:10 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through this discussion. The omens are green, the build is whole, and the firewall holds.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T21:10:31.777Z.

Closed by Workflow