[Coverage Report] Test Coverage Report — 2026-06-02

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.2%	4,452 / 4,625
Branches	90.5%	2,381 / 2,632
Functions	98.3%	512 / 521
Lines	96.4%	4,314 / 4,475

Overall coverage is healthy — no files are below 50%.

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage. ✅

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt %	Branch %	Fn %	Notes
src/commands/validators/network-options.ts	66.7%	50.0%	100%	Branch coverage needs attention

Only one file falls in the 50–79% range.

---

🛡️ Security-Critical Path Status

File	Stmt %	Branch %	Fn %	Status
src/host-iptables.ts	100.0%	100.0%	100%	✅ Fully covered
src/host-iptables-rules.ts	97.7%	96.8%	100%	✅ Excellent
src/host-iptables-shared.ts	100.0%	95.0%	100%	✅ Excellent
src/host-iptables-network.ts	100.0%	100.0%	100%	✅ Fully covered
src/squid-config.ts	100.0%	100.0%	100%	✅ Fully covered
src/domain-patterns.ts	97.7%	96.8%	100%	✅ Excellent
src/docker-manager.ts	100.0%	100.0%	100%	✅ Fully covered
src/cli.ts	85.7%	67.1%	100%	🟡 Branch gaps
src/rules.ts	98.2%	91.9%	100%	✅ Excellent

All primary security-critical paths are well-covered. The cli.ts branch coverage at 67.1% is the most notable gap in this group.

---

📋 Full Coverage Table (files below 98%)

File	Stmt %	Branch %	Fn %
src/commands/validators/network-options.ts	66.7%	50.0%	100%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/cli.ts	85.7%	67.1%	100%
src/logs/log-parser.ts	86.9%	67.1%	100%
src/squid/policy-manifest.ts	87.2%	88.2%	70%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%
src/services/doh-proxy-service.ts	90.0%	75.0%	100%
src/container-cleanup.ts	90.3%	96.8%	100%
src/services/host-path-prefix.ts	90.3%	81.6%	100%
src/config-writer.ts	90.9%	83.0%	100%
src/commands/validators/log-and-limits.ts	91.5%	78.4%	100%
src/commands/validators/agent-options.ts	93.0%	88.6%	100%
src/cli-options.ts	93.0%	60.0%	25%
src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100%
src/pid-tracker.ts	96.3%	76.9%	100%
src/domain-patterns.ts	97.7%	96.8%	100%

Files at 98%+ coverage (click to expand)

All of the following are at 98% statement coverage or above:
src/api-proxy-config.ts, src/cli-workflow.ts, src/constants.ts, src/container-lifecycle-state.ts, src/copilot-api-resolver.ts, src/dind-probe.ts, src/dlp.ts, src/dns-resolver.ts, src/docker-host.ts, src/docker-manager.ts, src/domain-utils.ts, src/env-utils.ts, src/github-env.ts, src/host-identity.ts, src/host-iptables.ts, src/host-iptables-cleanup.ts, src/host-iptables-network.ts, src/host-iptables-shared.ts, src/image-tag.ts, src/log-paths.ts, src/logger.ts, src/redact-secrets.ts, src/schema-validator.ts, src/squid-config.ts, src/squid/ssl-bump.ts, and more.

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — 66.7% stmt / 50.0% branch: This validator handles Docker host and DinD path prefix validation. The 50% branch coverage suggests the error-handling branches (invalid --docker-host, DinD hint without path prefix) are not being exercised in tests. These paths gate network isolation configuration and deserve higher coverage.

2. src/cli.ts — 85.7% stmt / 67.1% branch: The main CLI entry point has 14% of statements uncovered. Likely gaps are error-recovery paths, signal handling (SIGINT/SIGTERM), and edge cases around --keep-containers. These are hard to unit-test but important for production robustness.

3. src/cli-options.ts — 93.0% stmt / 60.0% branch / 25% fn: Critically, only 25% of functions are covered. The custom formatHelp commander override has multiple branches around terminal width and option grouping that appear untested.

4. src/logs/audit-enricher.ts — 83.6% stmt / 74.1% branch: Log enrichment logic with uncovered error-handling branches. Lower priority than the above since it's not on the critical security path, but worth improving for log integrity.

---

📈 Recommendations

1. High — network-options.ts branch coverage: Add tests for the --docker-host validation failure path and the DinD hint-without-prefix warning. These control network isolation configuration; the 50% branch coverage is a risk.

2. High — cli.ts branch coverage: Add integration-style tests covering SIGINT handling, --keep-containers behavior, and container startup failure paths. These represent untested orchestration logic in the main entry point.

3. Medium — cli-options.ts function coverage: Cover the custom formatHelp function by testing terminal-width edge cases (very narrow, very wide terminals) and option group header rendering.

4. Low — logs/audit-enricher.ts: Exercise the error branches in log enrichment (malformed log entries, missing fields). Low security impact but improves log integrity guarantees.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 26799331630

Generated by Test Coverage Reporter · sonnet46 553.4K · ◷

• expires on Jun 9, 2026, 5:00 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-09T05:00:56.056Z.

Closed by Workflow