[Coverage Report] Test Coverage Report — 2026-06-05

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.55%	4,601 / 4,765
Branches	91.07%	2,490 / 2,734
Functions	98.70%	535 / 542
Lines	96.65%	4,449 / 4,603

100 test files covering 151 production source files. All configured thresholds pass.

---

🔴 Critical Gaps (< 50% statement coverage)

None. No production file falls below 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
commands/validators/network-options.ts	66.66%	50.0%	100%

Only one file in this range. Validates network-option combinations; uncovered branches are likely conflicting/malformed option combos.

---

🛡️ Security-Critical Path Status

File                              Stmts     Branches  Funcs
─────────────────────────────────────────────────────────────
host-iptables.ts (facade)         ✅ 100%   ✅ 100%   ✅ 100%
host-iptables-rules.ts            ✅ 100%   ✅  98%   ✅ 100%
host-iptables-shared.ts           ✅ 100%   ✅  95%   ✅ 100%
host-iptables-cleanup.ts          ✅ 100%   ✅ 100%   ✅ 100%
host-iptables-network.ts          ✅ 100%   ✅ 100%   ✅ 100%

squid-config.ts (facade)          ✅ 100%   ✅ 100%   ✅ 100%
squid/access-rules.ts             ✅ 100%   ✅ 100%   ✅ 100%
squid/acl-generator.ts            ✅ 100%   ✅ 100%   ✅ 100%
squid/config-generator.ts         ✅ 100%   ✅ 100%   ✅ 100%
squid/config-sections.ts          ✅ 100%   🟡  83%   ✅ 100%
squid/domain-acl.ts               ✅ 100%   ✅ 100%   ✅ 100%
squid/policy-manifest.ts          🟡  87%   🟡  88%   ⚠️  70%
squid/validation.ts               ✅ 100%   ✅ 100%   ✅ 100%

docker-manager.ts (facade)        ✅ 100%   ✅ 100%   ✅ 100%
domain-patterns.ts                ✅  98%   ✅  95%   ✅ 100%
cli.ts                            🟡  86%   ⚠️  50%   ✅ 100%
─────────────────────────────────────────────────────────────

The iptables and Squid ACL stacks are comprehensively covered. Two items worth noting:

• squid/policy-manifest.ts — 3 of 10 functions (70%) uncovered; generates the audit policy manifest attached to each run.
• cli.ts — 50% branch coverage; likely the early-exit OS/version-check path is untested.

---

📋 Files with Branch Coverage < 80%

File	Stmts	Branches	Funcs
commands/validators/network-options.ts	66.66%	50%	100%
cli.ts	85.71%	50%	100%
services/api-proxy-service.ts	91.66%	50%	100%
services/agent-environment/environment-builder.ts	93.54%	66.66%	100%
logs/log-parser.ts	86.9%	67.14%	100%
services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%
squid/policy-manifest.ts	87.23%	88.23%	70%
services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%
logs/audit-enricher.ts	83.6%	74.13%	100%
services/agent-volumes/workspace-mounts.ts	96.29%	75%	100%
services/doh-proxy-service.ts	90%	75%	100%
commands/validators/log-and-limits.ts	90.32%	77.58%	100%
logs/log-streamer.ts	92.18%	77.77%	88.88%

---

🔍 Notable Findings

1. services/api-proxy-service.ts — 50% branch coverage (new in commit 953f8d8, 2026-06-05)
PR #4357 added AI credits accounting and enforcement. The untested branch is the throw new Error(...) guard when networkConfig.proxyIp is missing. One unit test would reach 100% branch coverage.

2. squid/policy-manifest.ts — 70% function coverage
3 of 10 internal functions uncovered — likely helper lambdas for HTTP-only or HTTPS-only protocol-split domain lists. These are audit-path functions; gaps reduce confidence in the correctness of emitted policy manifests.

3. logs/log-parser.ts — 67% branch coverage
23 of 70 branches untested. Likely missing: malformed log lines, partial Squid entries, unexpected timestamp formats. Bugs here silently produce incorrect awf logs stats / awf logs summary output.

4. services/agent-volumes/etc-mounts.ts — 68% branch coverage
Controls which /etc files are bind-mounted into the agent container. Uncovered branches may include DinD path-prefix edge cases — incorrect mounts could expose or hide credentials.

---

📈 Recommendations

1. High — services/api-proxy-service.ts: 1 test (call with missing proxyIp) → 100% branches. Addresses new code from this week.
2. High — squid/policy-manifest.ts: Test generatePolicyManifest with HTTP-only and HTTPS-only domain lists to cover the 3 uncovered functions.
3. Medium — logs/log-parser.ts: Add malformed-input tests (truncated entries, unknown action codes, missing host header).
4. Medium — commands/validators/network-options.ts: Test conflicting option combinations (--dns-servers with invalid IPs, --upstream-proxy conflicts).
5. Low — services/agent-volumes/etc-mounts.ts: Test DinD path-prefix branches for credential-isolation correctness.

---

Generated by test-coverage-reporter workflow. Trigger: push (commit 953f8d8). Source: coverage/coverage-summary.json.

Generated by Test Coverage Reporter · sonnet46 2.8M · ◷

• expires on Jun 12, 2026, 4:50 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T16:50:47.878Z.

Closed by Workflow