[Coverage Report] Test Coverage Report — 2026-06-13

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-13

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.53%	4,852 / 5,026
Branches	91.25%	2,714 / 2,974
Functions	98.78%	569 / 576
Lines	96.66%	4,695 / 4,857

📁 112 test files · 142 source files (including test-utils)

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt%	Branch%	Fn%
src/commands/validators/network-options.ts	66.66%	50.00%	100%

Only one file falls below 80%. It validates Docker-host, domain-resolution, and network-configuration options at CLI startup (Docker host, allowed/blocked domains, DNS, upstream proxy). Half its 10 conditional branches are untested — including the --docker-host-path-prefix hint warning and the DinD split-filesystem detection path.

---

🛡️ Security-Critical Path Status

File	Stmt%	Branch%	Fn%	Status
src/host-iptables.ts (barrel)	100%	100%	100%	✅
src/host-iptables-rules.ts	100%	100%	100%	✅ Fully covered
src/host-iptables-shared.ts	100%	100%	100%	✅
src/squid-config.ts (barrel)	100%	100%	100%	✅
src/squid/access-rules.ts	100%	100%	100%	✅
src/squid/acl-generator.ts	100%	100%	100%	✅
src/squid/config-generator.ts	100%	100%	100%	✅
src/squid/domain-acl.ts	100%	100%	100%	✅
src/squid/validation.ts	100%	100%	100%	✅
src/squid/policy-manifest.ts	87.5%	88.23%	70%	⚠️ 3/10 functions uncovered
src/docker-manager.ts (barrel)	100%	100%	100%	✅
src/domain-patterns.ts	97.67%	95.38%	100%	✅
src/cli.ts	85.71%	50.00%	100%	⚠️ Tiny (7 lines); 1 branch uncovered

The core iptables and Squid sub-modules are at 100% across all metrics. The policy-manifest module — which documents the logical access control policy for enrichment and auditing — has 3 uncovered functions.

---

🔍 Notable Findings

1. src/squid/policy-manifest.ts — 70% function coverage (7/10 functions)
Three functions within generatePolicyManifest are not covered. These correspond to the conditional rule-building branches for: blocked-domain patterns (regex), HTTP-only regex allow rules, and HTTPS-only regex allow rules. If these branches fire with regex-pattern domains, the generated PolicyManifest will include rule objects that have never been tested — a risk for the logs audit enrichment pipeline which relies on this manifest to attribute allow/deny decisions.

2. src/services/agent-volumes/etc-mounts.ts — 67.85% branch coverage (19/28)
This file controls which /etc files get bind-mounted into the agent container. The uncovered branches sit in the DinD/ARC staging path: specifically the passwd/group file augmentation logic that adds a runner UID entry when the staged file already exists but lacks the runner's UID. These paths are only exercised when dockerHostPathPrefix is set, making them easy to miss in non-DinD test runs. A mismatch here could cause the chroot identity resolution to silently fall back to /etc/passwd, exposing /etc/shadow-adjacent risk surface.

3. src/logs/log-parser.ts — 68.57% branch coverage (48/70 branches)
The Squid firewall_detailed log parser has the largest absolute number of uncovered branches (22). The file contains complex regex-based parsing with many defensive fallback paths for: non-standard HTTP methods, missing/malformed host headers, unusual dest IP formats, and edge-case status codes. Uncovered branches here mean that malformed or unusual log lines could silently fail to parse, producing gaps in the awf logs stats/summary output used in CI job summaries.

4. src/services/agent-environment/environment-builder.ts — 66.66% branch coverage (4/6)
Builds the final environment variable map passed into the agent container. Only 4 of 6 branches are covered. The two uncovered branches likely guard the API-proxy-enabled path or the DinD environment passthrough, meaning the exact variable set seen by agents in those configurations is not fully verified by tests.

---

🌱 Recent Code Without Full Coverage

Recent commits added OTLP fan-out for the API proxy (feat(api-proxy): implement OTLP fan-out to multiple endpoints) and loopback TCP Docker host passthrough (fix(docker-host): pass through loopback TCP DOCKER_HOST for ARC/DinD). The src/services/agent-volumes/etc-mounts.ts and src/services/agent-environment/environment-builder.ts branch gaps may be partially attributable to these changes.

---

📈 Recommendations

1. High — Cover network-options.ts branches: Add 2–3 test cases for the DinD warning path (dockerHostCheck.valid = false + no path prefix) and the dindHint warning path. These are security-relevant startup checks that currently have 0 coverage on the warning branches.

2. Medium — Cover etc-mounts.ts DinD augmentation paths: Write tests with dockerHostPathPrefix set where: (a) the staged passwd file exists but lacks the runner UID, and (b) the staged group file exists but lacks the runner GID. This exercises the identity-file synthesis path that guards against silent fallback to the host /etc/passwd.

3. Medium — Cover log-parser.ts edge cases: Add fuzz-style test cases for: lines with -:- dest IP, lines with missing user-agent field, HTTP/1.0 entries, and CONNECT entries with non-standard port formats. The 70 branches suggest the parser has significant defensive logic that's never been exercised.

4. Low — Cover policy-manifest.ts regex-rule branches: Add a test calling generatePolicyManifest with regex-pattern domains (e.g., *.example.com) and with blocked domain patterns. This ensures the three uncovered functions produce valid PolicyRule objects and that the audit enricher can correctly attribute deny decisions from those rules.

---

Generated by test-coverage-reporter workflow. Trigger: push · 2026-06-13T16:45:56Z

Generated by Test Coverage Reporter · ◷

• expires on Jun 20, 2026, 4:49 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-20T16:49:44.640Z.

Closed by Workflow