[Coverage Report] Test Coverage Report — 2026-05-26

[github-actions[bot]]

Overall Coverage

Metric	Coverage
Statements	96.35%
Branches	90.82%
Functions	98.19%
Lines	96.49%

Test suite: 2187/2188 tests passing across 98 test files (1 flaky test in DNS pre-resolution — environment-specific).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/services/agent-volumes/hosts-file.ts	69.0%	61.9%	100%

Only one file falls below 80%.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions
src/host-iptables.ts	✅ 100%	✅ 100%	✅ 100%
src/squid-config.ts	✅ 100%	✅ 100%	✅ 100%
src/docker-manager.ts	✅ 100%	✅ 100%	✅ 100%
src/domain-patterns.ts	✅ 97.7%	✅ 95.4%	✅ 100%
src/cli.ts	🟡 85.7%	🟡 50.0%	✅ 100%

All four core security modules (host-iptables, squid-config, docker-manager, domain-patterns) are at or near 100% coverage. src/cli.ts has lower branch coverage (50%) due to signal-handler and process-exit paths that are difficult to test in unit tests.

---

📋 Notable Low-Coverage Files

File	Statements	Branches	Functions
src/services/agent-volumes/hosts-file.ts	69.0%	61.9%	100%
src/commands/validators/network-options.ts	81.3%	50.0%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/cli.ts	85.7%	50.0%	100%
src/logs/log-parser.ts	86.9%	67.1%	100%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%
src/cli-workflow.ts	88.9%	85.7%	100%
src/services/host-path-prefix.ts	88.9%	75.0%	100%
src/config-writer.ts	89.3%	80.9%	100%

---

🔍 Notable Findings

1. src/services/agent-volumes/hosts-file.ts (69% stmts, 62% branches) — The lowest-covered file. This module handles pre-resolving allowed domains into a chroot hosts file for the agent container. Uncovered branches likely include DNS resolution failure paths, IPv6-only domain handling, and edge cases for wildcard domains. The one failing test (should pre-resolve allowed domains into chroot-hosts file) is an environment-specific DNS resolution test where github.com resolves to a different IP than expected — worth making the test IP-agnostic.

2. src/commands/validators/network-options.ts (81% stmts, 50% branches) — Branch coverage at 50% suggests many validation error paths (e.g., invalid IP ranges, conflicting options) are not tested. Since this validates user-supplied network configuration that feeds into iptables rules, missed branches here could allow malformed input to reach security-critical code.

3. src/cli.ts (86% stmts, 50% branch) — The main entry point has 50% branch coverage. Uncovered paths include signal handlers (SIGINT/SIGTERM), some error propagation paths, and edge-case CLI flag combinations. These are hard to unit-test but important for graceful shutdown behavior.

4. src/squid/policy-manifest.ts (87% stmts, 70% functions) — Three functions have zero coverage. The policy manifest controls which Squid ACL policies are applied — untested functions here could mean certain policy configurations are never validated by tests.

---

📈 Recommendations

1. High — Fix hosts-file.ts tests and coverage: The failing test (should pre-resolve allowed domains) is IP-address-sensitive and breaks in CI due to different DNS resolution. Make the assertion check that the hostname is present with some IP (not a specific hardcoded IP). Then add tests for: DNS resolution failure handling, IPv6 address formatting, and the branch where a domain cannot be resolved.

2. High — Cover network-options.ts validation error paths: Add unit tests for rejected inputs in src/commands/validators/network-options.ts — invalid CIDR ranges, overlapping subnets, malformed DNS server IPs. These validations protect security-critical iptables rule generation.

3. Medium — Cover squid/policy-manifest.ts uncovered functions: The 3 uncovered functions (30% of the module) represent untested policy combinations. Add tests exercising each policy manifest function to ensure ACL generation is correct for all configurations.

4. Low — Improve log-parser.ts and audit-enricher.ts branch coverage: At 67% and 74% branch coverage respectively, these log analysis files have multiple unexercised parsing edge cases (malformed log lines, missing fields, unusual timestamp formats). These don't affect firewall security but affect the reliability of the awf logs reporting commands.

---

Generated by test-coverage-reporter workflow. Trigger: push — Run ID: 26429094165

Generated by Test Coverage Reporter · sonnet46 663.9K · ◷

• expires on Jun 2, 2026, 2:48 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-02T02:48:06.454Z.

Closed by Workflow