[Coverage Report] Test Coverage Report — 2026-06-07

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-07

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.46%	4669 / 4840
Branches	90.73%	2546 / 2806
Functions	98.72%	542 / 549
Lines	96.55%	4515 / 4676

105 test files · 153 source files

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are at 50% or above.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Functions
src/commands/validators/network-options.ts	66.7%	50.0%	100%

---

🛡️ Security-Critical Path Status

File	Stmts	Branches	Functions	Lines	Status
src/host-iptables.ts	100%	100%	100%	100%	✅ Excellent
src/squid-config.ts	100%	100%	100%	100%	✅ Excellent
src/docker-manager.ts	100%	100%	100%	100%	✅ Excellent
src/domain-patterns.ts	97.7%	95.4%	100%	97.6%	✅ Strong
src/cli.ts	85.7%	50.0%	100%	85.7%	⚠️ Branch gap

All four top-priority security-critical files (host-iptables, squid-config, docker-manager, domain-patterns) are at ≥ 95% across all metrics. The cli.ts branch gap is the require.main === module entry-point guard — a structural pattern rather than a security-relevant branch.

---

📋 Files with Branch Coverage < 70%

These files have adequate statement coverage but contain branches not exercised by tests:

File	Stmts	Branches	Notes
src/commands/validators/network-options.ts	66.7%	50.0%	Docker-host warn paths untested
src/services/api-proxy-service.ts	91.7%	50.0%	Null proxy-IP error branch untested
src/cli.ts	85.7%	50.0%	require.main guard (structural)
src/dind-bootstrap.ts	88.9%	66.7%	DinD error/skip paths untested
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	Conditional env assembly paths
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	/etc mount conditional paths
src/logs/log-parser.ts	86.9%	67.1%	IPv6 & edge-case log formats

---

🔍 Notable Findings

1. network-options.ts — Docker-host warning branches untested

validateNetworkOptions has three warning paths when !dockerHostCheck.valid and when dindHint is set without a path prefix. Only the happy-path (valid Docker host) is covered. These branches gate user-visible warnings about split-filesystem DinD setups.

Fix: Add unit tests with mocked checkDockerHost() returning { valid: false } and with DOCKER_HOST set to a non-standard unix socket.

2. api-proxy-service.ts — Null proxy IP path untested

This 43-line file has a single if (!networkConfig.proxyIp) guard that throws. The throw path (mis-configured network) is never exercised, leaving an error path invisible to tests.

Fix: Add a test asserting the service throws when proxyIp is absent.

3. log-parser.ts — IPv6 address parsing edge cases

The parser has nested conditions for IPv6 literal addresses in destination fields (lines ~178–198). Coverage shows ~33% of these branches are unexercised — likely the [::1]-style IPv6 bracket parsing and malformed destination edge cases.

Fix: Add unit tests with IPv6-format Squid log lines and deliberately malformed entries.

4. New code added in the past 7 days

A large batch of functions was added recently:

• validateApiProxyConfig, validateAnthropicCacheTailTtl, emitApiProxyTargetWarnings (api-proxy-config)
• preserveIptablesAudit, preserveCleanupArtifacts, removeWorkDirectories (artifact-preservation)
• runMainWorkflow, buildConfig, auditCommand (cli-workflow, build-config, logs-audit)

All are covered by the existing test suite (85–100% per file). No regression detected.

---

📈 Recommendations

1. High — Add DinD/external-Docker-host test cases to src/commands/validators/network-options.test.ts covering the !dockerHostCheck.valid and dindHint branches. These gate security-relevant warnings about split-filesystem setups.

2. Medium — Add edge-case tests to src/logs/log-parser.ts for IPv6 bracket-notation log lines ([::1]:443) and malformed destination fields. The log parser is in the audit trail path.

3. Low — Add a single test to src/services/api-proxy-service.ts asserting that a missing proxyIp throws. Small but closes the only remaining uncovered branch in that file.

---

Generated by test-coverage-reporter workflow. Trigger: schedule

Generated by Test Coverage Reporter · sonnet46 1.1M · ◷

• expires on Jun 14, 2026, 6:01 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-14T06:01:42.470Z.

Closed by Workflow