[Coverage Report] Test Coverage Report — 2026-06-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-09

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.39%	4758 / 4936
Branches	90.75%	2621 / 2888
Functions	98.76%	562 / 569
Lines	96.47%	4604 / 4772

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files are above 50% statement coverage. ✅

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branch	Funcs	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%

---

🛡️ Security-Critical Path Status

File	Stmts	Branch	Funcs	Lines	Status
src/host-iptables.ts	100.0%	100.0%	100.0%	100.0%	✅
src/squid-config.ts	100.0%	100.0%	100.0%	100.0%	✅
src/docker-manager.ts	100.0%	100.0%	100.0%	100.0%	✅
src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%	✅
src/cli.ts	85.7%	50.0%	100.0%	85.7%	⚠️

The four core security modules (host-iptables, squid-config, docker-manager, domain-patterns) are all at or near 100% coverage. src/cli.ts (the orchestration entry point) has notably low branch coverage (50.0%), meaning roughly half of its conditional logic paths are untested.

---

📋 Files With Coverage Gaps

Files below 95% in any metric (test-utils excluded from recommendations):

File	Stmts	Branch	Funcs	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%
src/squid-log-reader.ts	82.2%	80.0%	100.0%	82.2%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100.0%	82.5%
src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
src/cli.ts	85.7%	50.0%	100.0%	85.7%
src/logs/log-parser.ts	86.9%	68.6%	100.0%	87.8%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
src/dind-bootstrap.ts	88.9%	66.7%	100.0%	88.5%
src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
src/services/api-proxy-service.ts	91.7%	50.0%	100.0%	91.7%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100.0%	93.5%

---

🔍 Notable Findings

1. src/cli.ts — 50% branch coverage (entry point / orchestration). The CLI's main orchestration logic has half its branches untested. Missing coverage likely includes signal-interrupt edge cases (SIGINT/SIGTERM mid-startup), the --keep-containers flag path, and error-handling branches when container startup fails. Any regression here could silently bypass the security sandbox setup.

2. src/commands/validators/network-options.ts — 66.7% statements, 50% branches. This validator enforces Docker-host checking, DinD path-prefix resolution, and upstream-proxy setup — all gating logic for whether network isolation is applied correctly. The three if branches on lines 47, 59, and 64 (external Docker host detection, missing path prefix, DinD hint without prefix) have no corresponding test cases.

3. src/services/api-proxy-service.ts — 50% branch coverage. The API proxy service mediates all credential injection. The untested branches (50%) likely cover failure-mode paths in credential forwarding and sidecar health-check failure handling, leaving credential-leak edge cases unexplored.

4. src/squid/policy-manifest.ts — 70% function coverage. Three of ten exported functions are not exercised by any test. This module manages the Squid policy manifest (domain ACL rules); uncovered functions may include error paths in manifest validation or serialization that could produce a silently-malformed policy.

5. Recent churn (last 7 days): 30+ files touched. Significant changes landed in src/commands/, src/squid/, and src/types/ (new type modules). Many of these files are well-covered, but newly introduced files like src/squid/policy-manifest.ts and src/commands/validators/network-options.ts have below-average coverage, suggesting tests were not shipped alongside the new code.

---

📈 Recommendations

1. High — Add branch tests for src/cli.ts: Cover signal-interrupt paths (SIGINT/SIGTERM during startup), the --keep-containers cleanup bypass, and the container-startup-failure error branch. Use the existing src/cli.test.ts test file (recently updated) as the base.

2. High — Cover src/commands/validators/network-options.ts: Write unit tests for the three conditional blocks: (a) !dockerHostCheck.valid warning path, (b) external Docker host without a path prefix, and (c) DinD hint without dockerHostPathPrefix. These guard whether network isolation is applied correctly.

3. Medium — Cover src/services/api-proxy-service.ts failure branches: The credential-injection sidecar must handle failures gracefully. Test the unhappy-path branches in sidecar startup/healthcheck failure to prevent credential leaks going undetected.

4. Medium — Cover missing functions in src/squid/policy-manifest.ts: Identify and exercise the 3 uncovered functions (out of 10). Given this module affects domain ACL policy generation, untested functions are a security-relevant coverage gap.

5. Low — Improve src/services/agent-volumes/etc-mounts.ts branches (67.8%): This module controls which /etc files are bind-mounted into the agent (excluding /etc/shadow). The uncovered branches may include edge cases around file availability and platform detection.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run ID: 27240486200

Generated by Test Coverage Reporter · 132 AIC · ⊞ 30.7K · ◷

• expires on Jun 16, 2026, 10:48 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-16T22:48:14.867Z.

Closed by Workflow