[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-13

Overall Coverage

Metric	Coverage	Raw
Statements	96.51%	4,851 / 5,026
Branches	91.25%	2,714 / 2,974
Functions	98.78%	569 / 576
Lines	96.64%	4,694 / 4,857

Overall coverage is excellent — substantially improved from the 38% recorded in COVERAGE_SUMMARY.md (a historical snapshot).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.66% (14/21)	50% (5/10)	100%

This file validates --allow-host-access, --upstream-proxy, and related network flags — uncovered branches here mean some network validation error paths are untested.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts (barrel)	100%	N/A	100%	✅
src/host-iptables-rules.ts	100%	100% (67/67)	100%	✅
src/host-iptables-shared.ts	100%	100% (20/20)	100%	✅
src/host-iptables-cleanup.ts	100%	100% (7/7)	100%	✅
src/host-iptables-network.ts	100%	100% (2/2)	100%	✅
src/squid-config.ts (barrel)	100%	N/A	100%	✅
src/squid/acl-generator.ts	100%	100% (20/20)	100%	✅
src/squid/access-rules.ts	100%	100% (42/42)	100%	✅
src/squid/domain-acl.ts	100%	100% (12/12)	100%	✅
src/squid/config-generator.ts	100%	100% (10/10)	100%	✅
src/squid/config-sections.ts	100%	82.75% (24/29)	100%	⚠️
src/squid/policy-manifest.ts	87.5% (42/48)	88.23% (30/34)	70% (7/10)	⚠️
src/domain-patterns.ts	97.67% (84/86)	95.38% (62/65)	100%	✅
src/docker-manager.ts (barrel)	100%	N/A	100%	✅
src/cli.ts	85.71% (6/7)	50% (1/2)	100%	⚠️
src/services/agent-volumes/etc-mounts.ts	82.45% (47/57)	67.85% (19/28)	100%	⚠️

---

📋 Full Coverage Table (files with branch coverage < 80%)

File	Stmts	Branches	Funcs	Lines
src/cli.ts	85.71%	50%	100%	85.71%
src/commands/validators/network-options.ts	66.66%	50%	100%	66.66%
src/services/agent-environment/environment-builder.ts	93.54%	66.66%	100%	93.54%
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%	82.45%
src/logs/log-parser.ts	86.9%	68.57%	100%	87.8%
src/squid/policy-manifest.ts	87.5%	88.23%	70%	87.23%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%	87.23%
src/services/agent-volumes/workspace-mounts.ts	96.29%	75%	100%	96.29%
src/services/agent-volumes/system-mounts.ts	92.3%	75%	100%	92.3%
src/commands/validators/log-and-limits.ts	90.32%	77.58%	100%	90.32%
src/host-env.ts	94.11%	80%	100%	95.91%
src/logs/log-streamer.ts	92.18%	77.77%	88.88%	92.06%

---

🔍 Notable Findings

1. src/cli.ts — 50% branch coverage: The main entry point has one uncovered branch (1/2). Given it's the top-level orchestrator that wires up signal handling and container lifecycle, the uncovered branch likely relates to an error/edge condition in startup that deserves a dedicated test.

2. src/services/agent-volumes/etc-mounts.ts — 67.85% branch coverage: This module controls which /etc files are bind-mounted into the agent container (SSL certs, passwd, group, nsswitch.conf — but NOT /etc/shadow). With 9 of 28 branches uncovered, there are untested paths in the security-sensitive logic that prevents sensitive files from leaking into the agent environment.

3. src/squid/policy-manifest.ts — 70% function coverage (3 functions uncovered): The policy manifest assembles the final set of Squid rules and ACLs. Three uncovered functions mean some policy-assembly paths (e.g., specific preset combinations or edge-case domain configurations) are never exercised in tests.

4. src/logs/log-parser.ts — 68.57% branch coverage: The Squid access log parser has 22 uncovered branches out of 70. Malformed or unusual log lines may hit unexercised parse paths, making it harder to trust log-based audit trails for security analysis.

---

📈 Recommendations

1. High — Add branch tests for src/services/agent-volumes/etc-mounts.ts: Cover the conditional logic that decides which /etc files are mounted. A test should verify that /etc/shadow and other sensitive paths are never included regardless of configuration. Target: raise branches from 67.85% → 90%+.

2. High — Cover missing functions in src/squid/policy-manifest.ts: The 3 uncovered functions likely handle specific policy presets or domain-list edge cases. Add unit tests for all exported functions to reach 100% function coverage on this security-critical module.

3. Medium — Cover the uncovered branch in src/cli.ts: A single uncovered branch (50%) at the entry point is a blind spot. Identify whether it's an error-path or feature-flag branch and add a test targeting that condition.

4. Low — Improve src/logs/log-parser.ts branch coverage: Add tests for malformed log lines, truncated entries, and unusual timestamp formats to bring branch coverage above 80%. This improves reliability of the awf logs audit commands.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 4:08 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T16:08:52.995Z.

Closed by Workflow