[Coverage Report] Test Coverage Report — 2026-06-16

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Files
Lines	97.31% (4,789 / 4,921)	90 source files
Statements	97.19% (4,947 / 5,090)	—
Functions	98.82% (588 / 595)	—
Branches	91.97% (2,751 / 2,991)	—

Test suite: all suites passing. Branches are the primary area with remaining gaps.

---

Security-Critical File Status

File	Lines	Branches	Functions	Status
host-iptables-rules.ts	100%	100% (67/67)	100%	✅ Full coverage
host-iptables-shared.ts	100%	100% (20/20)	100%	✅ Full coverage
squid/acl-generator.ts	100%	100% (20/20)	100%	✅ Full coverage
squid/access-rules.ts	100%	100% (42/42)	100%	✅ Full coverage
squid/validation.ts	100%	100% (34/34)	100%	✅ Full coverage
domain-validation.ts	100%	100% (30/30)	100%	✅ Full coverage
domain-patterns.ts	100%	89.47% (17/19)	100%	⚠️ 2 branches
squid/policy-manifest.ts	87.23%	88.23% (30/34)	70% (7/10)	⚠️ 3 functions
services/agent-volumes/etc-mounts.ts	82.45%	67.85% (19/28)	100%	❌ 9 branches
logs/audit-enricher.ts	89.36%	74.13% (43/58)	100%	❌ 15 branches

---

🔍 Notable Findings

1. /etc Identity Mount Logic Has Significant Branch Gaps (etc-mounts.ts — 67.85% branches)

etc-mounts.ts controls which /etc files are bind-mounted into the agent container, including the DinD identity synthesis path for /etc/passwd and /etc/group. The 9 uncovered branches include:

• The synthesizeIdentityFile catch block — never tested when mkdirSync or writeFileSync fails, meaning the fallback-to-host-path (|| passwdPath) is untested
• The resolveUniqueName counter loop (lines 53–57) — only fires when both a base name and the first dash-suffixed form already exist in the file; no test exercises this collision path
• The fileHasPasswdUid / fileHasGroupGid negative branches when a staged file exists and the UID/GID is already present (the no-synthesis-needed path inside the DinD branch)

Because these paths govern whether the agent sees the correct identity files, a regression here could cause the container to run as the wrong user or fail to start.

2. Audit Enricher Has 15 Uncovered Branches (audit-enricher.ts — 74.13% branches)

logs/audit-enricher.ts reconstructs the effective allow/deny decision for each Squid log entry using the policy manifest. The 15 missing branches represent enrichment code paths that are never exercised by tests. This is security-relevant because incomplete enrichment means awf logs audit could misclassify blocked traffic as allowed or vice versa, giving a false picture of firewall effectiveness.

3. Policy Manifest Generator Has 3 Uncovered Functions (squid/policy-manifest.ts — 70% function coverage)

generatePolicyManifest() builds the structured policy manifest consumed by the audit enricher. Three functions in this module are unreached by tests. The uncovered paths likely include the conditional branches for --enable-host-access and --allow-host-ports combinations not exercised in the test suite. If these paths produce incorrect rules, the policy manifest will silently diverge from the actual Squid config, breaking audit log analysis.

4. Two Uncovered Branches in Domain Pattern Matching (domain-patterns.ts — 89.47% branches)

domain-patterns.ts is the ACL boundary: it determines which string values are treated as regex patterns vs. plain domain names. The 2 uncovered branches (out of 19) are minor but directly affect the domain allow-list. Any edge case here could cause a domain to be misclassified — either blocked when it should be allowed, or passed through the regex path when it should be exact-matched.

---

📈 Recommendations

🔴 High — Add error-path tests for etc-mounts.ts

Why: The synthesizeIdentityFile failure branch and the resolveUniqueName collision loop are completely untested. A filesystem write failure silently falls back to /etc/passwd without synthesizing the correct UID entry, which can cause the agent to start as root or fail identity resolution inside the chroot.

Action: Add unit tests that mock fs.mkdirSync / fs.writeFileSync to throw, and test a staged passwd file that already contains both runner and runner-<uid> to exercise the counter loop.

🟡 Medium — Cover the 3 uncovered functions in squid/policy-manifest.ts

Why: The policy manifest is the authoritative source used to enrich audit logs. Uncovered functions mean there are policy generation paths (e.g., enableHostAccess + allowHostPorts combinations, blockedDomains with only regex patterns, or the enableDlp branch) that have never been tested end-to-end. A misconfigured manifest silently breaks awf logs audit.

Action: Add tests for generatePolicyManifest with (a) enableHostAccess: true, (b) blockedDomains containing only regex patterns, and (c) enableDlp: true, verifying the returned rules array contains the expected entries in the correct order.

🟢 Low — Close the 2 remaining branches in domain-patterns.ts

Why: Domain pattern matching sits on the ACL trust boundary. The 2 remaining branches (out of 19) are the last gap in this otherwise well-tested module. Closing them brings the ACL decision logic to 100% and eliminates the risk of edge-case bypass.

Action: Inspect the uncovered branches (likely edge cases around empty strings or patterns with only a leading .) and add targeted unit tests in domain-patterns.test.ts.

Generated by Test Coverage Reporter · ◷

• expires on Jun 23, 2026, 11:06 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-23T23:06:44.264Z.

Closed by Workflow

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, and the run remains under favorable omens.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex