[Coverage Report] Test Coverage Report — 2026-06-12

[github-actions[bot]]

Overall Coverage

Metric	Coverage
Statements	96.54% (4829/5002)
Branches	91.26% (2694/2952)
Functions	98.78% (568/575)
Lines	96.63% (4676/4839)

137 files measured.

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt%	Branch%
src/commands/validators/network-options.ts	66.66%	50%

Only one file falls below 80%. It validates network-related CLI options (7 uncovered statements, 5 uncovered branches out of 21 statements / 10 branches).

---

🛡️ Security-Critical Path Status

src/host-iptables.ts          stmt=100%  branch=100%  fn=100%  ✅
src/host-iptables-rules.ts    stmt=100%  branch=100%  fn=100%  ✅
src/host-iptables-shared.ts   stmt=100%  branch=100%  fn=100%  ✅
src/host-iptables-network.ts  stmt=100%  branch=100%  fn=100%  ✅
src/host-iptables-cleanup.ts  stmt=100%  branch=100%  fn=100%  ✅
src/squid-config.ts           stmt=100%  branch=100%  fn=100%  ✅
src/squid/acl-generator.ts    stmt=100%  branch=100%  fn=100%  ✅
src/squid/access-rules.ts     stmt=100%  branch=100%  fn=100%  ✅
src/squid/domain-acl.ts       stmt=100%  branch=100%  fn=100%  ✅
src/docker-manager.ts         stmt=100%  branch=100%  fn=100%  ✅
src/domain-patterns.ts        stmt=97.67% branch=95.38% fn=100% ✅
src/cli.ts                    stmt=85.71% branch=50%   fn=100% ⚠️  (1/2 branches)

All iptables rule generators, Squid config, and domain matching are fully covered. cli.ts has one uncovered branch in the 7-statement entry-point shim.

---

📋 Full Coverage Table

Files with < 100% coverage (47 of 137 files; remaining 90 files are at 100%):

File	Stmt	Branch	Fn	Line
🟡 src/commands/validators/network-options.ts	66.66%	50%	100%	66.66%
src/squid-log-reader.ts	82.22%	80%	100%	82.22%
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%	82.45%
src/logs/audit-enricher.ts	83.6%	74.13%	100%	89.36%
src/artifact-preservation.ts	85.36%	95.34%	100%	85.36%
src/cli.ts	85.71%	50%	100%	85.71%
src/logs/log-parser.ts	86.9%	68.57%	100%	87.8%
src/squid/policy-manifest.ts	87.5%	88.23%	70%	87.23%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%	87.23%
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%	88.33%
src/services/doh-proxy-service.ts	90%	75%	100%	90%
src/commands/validators/log-and-limits.ts	90.32%	77.58%	100%	90.32%
src/services/host-path-prefix.ts	90.32%	81.57%	100%	88.88%
src/config-writer.ts	91.07%	80.95%	100%	91.07%
src/services/api-proxy-service.ts	91.66%	50%	100%	91.66%
src/services/agent-volumes/docker-socket.ts	91.66%	93.33%	100%	91.66%
src/logs/log-streamer.ts	92.18%	77.77%	88.88%	92.06%
src/services/agent-volumes/system-mounts.ts	92.3%	75%	100%	92.3%
src/diagnostic-collector.ts	92.5%	100%	100%	92.5%
src/commands/build-config.ts	92.85%	92.94%	100%	92.85%
src/commands/validators/agent-options.ts	92.98%	88.57%	100%	92.98%
src/services/agent-volumes/hosts-file.ts	93.22%	90.32%	100%	92.85%
src/services/agent-environment/environment-builder.ts	93.54%	66.66%	100%	93.54%
src/squid/ssl-bump.ts	93.75%	91.66%	100%	93.75%
src/ssl-bump.ts	93.96%	84.61%	100%	94.69%
src/host-env.ts	94.11%	80%	100%	95.91%
src/logs/log-aggregator.ts	94.73%	87.5%	100%	94.66%
src/services/cli-proxy-service.ts	94.73%	92.3%	100%	94.73%
src/commands/main-action.ts	94.8%	89.18%	100%	94.8%
src/upstream-proxy.ts	94.93%	94.73%	100%	94.52%
src/parsers/volume-parsers.ts	95.83%	100%	100%	95.83%
src/container-startup-diagnostics.ts	96.15%	93.87%	100%	96%
src/services/agent-volumes/workspace-mounts.ts	96.29%	75%	100%	96.29%
src/container-cleanup.ts	96.42%	100%	80%	95.83%
src/services/agent-environment/env-passthrough.ts	96.77%	92.3%	100%	96.77%
src/compose-sanitizer.ts	97.14%	93.33%	100%	97.05%
src/logs/log-formatter.ts	97.43%	92.85%	100%	97.29%
src/commands/validators/config-assembly.ts	97.45%	90.65%	100%	98.27%
src/domain-patterns.ts	97.67%	95.38%	100%	97.61%
src/services/agent-service.ts	97.77%	94.64%	100%	97.67%
src/config-file.ts	98.11%	97.29%	87.5%	100%
src/rules.ts	98.18%	91.89%	100%	98.11%
src/compose-generator.ts	98.43%	92.5%	100%	98.43%
src/pid-tracker.ts	98.78%	80.76%	100%	98.7%
src/option-parsers.ts	98.88%	95.55%	100%	98.82%
src/config-file.ts	98.11%	97.29%	87.5%	100%
src/domain-patterns.ts	97.67%	95.38%	100%	97.61%

---

🔍 Notable Findings

1. src/logs/log-parser.ts — 22 uncovered branches (68.57%)
The log parser has 70 branches with 22 uncovered. This component parses Squid access logs for the audit/reporting pipeline. Uncovered branches likely include malformed-line handling, optional-field fallbacks, and edge-case timestamp formats. A handful of fixture-driven parse tests for invalid/truncated log lines would meaningfully close this gap.

2. src/services/agent-volumes/etc-mounts.ts — 9 uncovered branches (67.85%)
This file controls which /etc files are bind-mounted into the agent container (SSL certs, passwd, group, etc.). With 28 branches and 9 uncovered, unexercised logic may hide paths where sensitive files could be inadvertently exposed. Missing: tests for DinD path-prefix translation, conditional logic when optional host paths are absent, and non-standard /etc layout scenarios.

3. src/commands/validators/network-options.ts — 7 uncovered statements, 5 uncovered branches (66.66%/50%)
The only file below 80% statement coverage. This validator checks network-related CLI flags before the firewall starts. Uncovered paths likely include invalid-combination error branches and edge cases in --dns-servers / --allow-domains parsing. Small-scale unit tests for invalid inputs would bring this to 100%.

4. src/squid/policy-manifest.ts — 3 uncovered functions (70% fn coverage)
Touched in the Jun 11 WIF/OIDC Anthropic auth regression fix (#4748). While statement and branch coverage are good (87.5%/88.23%), three functions remain untested. This file generates the Squid policy manifest used for domain ACL decisions — worth verifying the untested function paths post-refactor.

---

📈 Recommendations

1. High — Add tests for the uncovered input-validation paths in src/commands/validators/network-options.ts: invalid --dns-servers combinations, conflicting network flags, and malformed domain lists. Small surface, high confidence impact.

2. Medium — Improve branch coverage in src/logs/log-parser.ts from 68.57% → ≥80%: add fixture tests with malformed Squid access log lines (truncated entries, missing fields, non-standard timestamps). This is the audit trail for all firewall decisions.

3. Medium — Cover the 9 uncovered branches in src/services/agent-volumes/etc-mounts.ts: test DinD path-prefix scenarios and cases where optional host paths (/etc/alternatives, /etc/ld.so.cache) are absent.

4. Low — Resolve the single uncovered branch in src/cli.ts (the top-level entry-point shim) to reach full coverage on the main orchestration entry point.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · ◷

• expires on Jun 19, 2026, 9:45 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here. May this discussion remember the brief passing of the oracle.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-19T21:45:46.158Z.

Closed by Workflow