[Coverage Report] Test Coverage Report — 2026-06-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-09

Source: coverage/coverage-summary.json from latest test run · Commit: ad31483 (ci: add smoke-copilot-pat workflow for PAT-based auth validation)
Scope: 155 source files, 108 test files · 265 files tracked total

Overall Coverage (source files, excl. test-utils)

Metric	Coverage	Raw
Statements	96.3%	4607 / 4783
Branches	90.8%	2615 / 2880
Functions	98.9%	518 / 524
Lines	96.4%	4464 / 4630

---

🔴 Critical Gaps (< 50% statement coverage)

None. All source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
commands/validators/network-options.ts	66.66% (14/21)	50% (5/10)	100%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
host-iptables.ts (re-exports)	100%	100%	100%	✅
host-iptables-rules.ts	100%	97.01% (65/67)	100%	✅
host-iptables-shared.ts	100%	95% (19/20)	100%	✅
host-iptables-cleanup.ts	100%	100%	100%	✅
host-iptables-network.ts	100%	100%	100%	✅
squid-config.ts	100%	100%	100%	✅
squid/access-rules.ts	100%	100%	100%	✅
squid/acl-generator.ts	100%	100%	100%	✅
squid/domain-acl.ts	100%	100%	100%	✅
domain-patterns.ts	97.67%	95.38% (62/65)	100%	✅
docker-manager.ts	100%	100%	100%	✅

All security-critical paths are well-covered. The iptables and Squid subsystems have near-perfect branch coverage.

---

📋 Branch Coverage Gaps (< 70% — action warranted)

These files have adequate statement coverage but meaningful branch gaps:

File	Statements	Branches	Uncovered branches
cli.ts	85.71%	50% (1/2)	1
commands/validators/network-options.ts	66.66%	50% (5/10)	5
services/api-proxy-service.ts	91.66%	50% (1/2)	1
dind-bootstrap.ts	88.88%	66.66% (22/33)	11
services/agent-environment/environment-builder.ts	93.54%	66.66% (4/6)	2
services/agent-volumes/etc-mounts.ts	82.45%	67.85% (19/28)	9
logs/log-parser.ts	86.9%	68.57% (48/70)	22

---

🔍 Notable Findings

1. commands/validators/network-options.ts (50% branches) — Validates Docker host configuration for DinD (ARC runners). Three uncovered branches involve dockerHostPathPrefixResolution.dindHint validation — a security-relevant code path that ensures the DinD proxy isn't misconfigured. Tests should cover the case where --docker-host is provided without --docker-host-path-prefix and vice versa.

2. cli.ts main entrypoint (50% branches) — The entrypoint has one uncovered branch out of two. Given this is the top-level orchestration entry point (signal handling, error propagation), the missed branch likely covers a startup or parse-error condition. Integration-style tests for the CLI bootstrap path would close this gap.

3. logs/log-parser.ts (68.57% branches, 22 uncovered) — The Squid log parser has many nested conditionals for handling IPv6 addresses, CONNECT-method host extraction, and malformed log entries. 22 uncovered branches indicate that edge cases — IPv6 literals in [...] brackets, missing port fields, non-standard log lines — are not tested. These affect the accuracy of awf logs stats and awf logs summary.

4. Recent additions in artifact-preservation.ts (85.36% stmts) — Three new exported functions (preserveIptablesAudit, preserveCleanupArtifacts, removeWorkDirectories) were added in the last 7 days. Statements for cleanup/error branches appear uncovered. These functions are called during teardown, so failures would silently drop audit artifacts.

---

📈 Recommendations

1. High — Add tests for commands/validators/network-options.ts covering all 3 branches in validateNetworkOptions(): (a) invalid docker-host alone, (b) docker-host + no path prefix with DinD hint, (c) valid combined config. This is a DinD security-validation path.

2. High — Cover the uncovered branch in cli.ts. Check whether it's an unhandled parse error or an early-exit path and add a unit test. The entrypoint should have deterministic coverage.

3. Medium — Add targeted tests for logs/log-parser.ts IPv6 edge cases (hosts like [::1]:3128) and malformed-line handling. These 22 uncovered branches inflate false-negative risk in the firewall audit trail.

4. Low — Test dind-bootstrap.ts error-recovery paths (11 uncovered branches). Focus on Docker socket probe timeouts and retry logic — failures here leave the agent running without a valid DinD environment.

---

i️ Data note

The repository contains a COVERAGE_SUMMARY.md reflecting an earlier baseline (38.39% statements). Current coverage has improved dramatically to 96.3% across 155 source files, reflecting significant test suite growth. The COVERAGE_SUMMARY.md file is now stale.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run ID: 27239805659

Generated by Test Coverage Reporter · 139.5 AIC · ⊞ 30.7K · ◷

• expires on Jun 16, 2026, 10:32 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir around discussion 4640. The smoke test agent was here, and the omens were read.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-16T22:32:41.338Z.

Closed by Workflow