[Coverage Report] Test Coverage Report — 2026-06-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-21

Overall Coverage

Metric	Coverage
Statements	97.82%
Branches	93.58%
Functions	99.5%
Lines	97.89%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table (security-critical files + files below 80% stmts)

File	Stmts	Branch	Funcs	Lines	Status
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/config-writer.ts	85.71%	80.55%	100%	85.71%	✅
src/squid-log-reader.ts	82.22%	80%	100%	82.22%	✅
src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%	82.45%	✅
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%	88.33%	✅
src/workdir-setup.ts	94.54%	79.62%	100%	94.54%	✅
src/logs/log-parser.ts	100%	84.28%	100%	100%	✅
src/squid/config-sections.ts	100%	82.75%	100%	100%	✅
src/domain-patterns.ts	100%	89.47%	100%	100%	✅
src/host-iptables-rules.ts	98.68%	96.05%	100%	98.66%	✅
src/host-iptables.ts	100%	100%	100%	100%	✅
src/squid-config.ts	100%	100%	100%	100%	✅
src/docker-manager.ts	100%	100%	100%	100%	✅
TOTAL	97.82%	93.58%	99.5%	97.89%

🔧 Function Audit

=== host-iptables.ts ===
4: export { setupHostIptables } from './host-iptables-rules';
5: export type { ... }
9: export { ensureFirewallNetwork } from './host-iptables-network';
10: export { cleanupHostIptables } from './host-iptables-cleanup';

=== squid-config.ts ===
1: export { generateSquidConfig } from './squid/config-generator';
2: export { generatePolicyManifest } from './squid/policy-manifest';

=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 135 / Source files: 170

📅 Recent Source Changes (last 7 days)

[Test Coverage] Cover regex rules in policy-manifest and signals in log-streamer (#5317)
  - src/squid/policy-manifest.ts: 87.5% → 100%
  - src/logs/log-streamer.ts: 92.18% → 100% (statements/lines)

---

🔍 Notable Findings

• cli.ts branch coverage is 50% (1/2 branches covered): The main CLI entry point has an uncovered branch — likely an error/fallback path in the top-level invocation. This is the highest-risk gap since all traffic flows through this entry point.
• services/agent-volumes/etc-mounts.ts branch coverage is 67.85% (19/28 branches): This file controls which /etc files are selectively bind-mounted into the agent container (e.g., SSL certs, passwd, group). Untested branches may expose misconfiguration paths that could over-expose sensitive host files or under-expose required ones.
• Overall coverage is strong at 97.89% lines / 93.58% branches: The recent [Test Coverage] PR ([Test Coverage] Cover regex rules in policy-manifest and signals in log-streamer #5317) improved policy-manifest.ts and log-streamer.ts to 100%, demonstrating the test-coverage-improver workflow is effective.
• Branch coverage is the primary gap category: All files meet the ≥80% statement coverage threshold; the remaining debt is concentrated in branch paths for error handling, edge cases, and optional configuration flows.

📌 Recommendations

Priority	Recommendation
🔴 High	Add tests for src/cli.ts to cover the missing branch — inspect the uncovered line (6/7 lines covered) and write a test that exercises the alternate code path (e.g., a missing --allow-domains flag or early exit scenario). Target: 100% branch.
🟡 Medium	Add tests for src/services/agent-volumes/etc-mounts.ts branch paths (currently 67.85%). Focus on conditional logic around which /etc files are included/excluded — particularly paths where optional files may be skipped. This directly impacts container isolation security.
🟢 Low	Improve branch coverage in src/workdir-setup.ts (79.62%) and src/config-writer.ts (80.55%) — both are involved in temp directory and config file creation. Add tests for error handling paths (e.g., filesystem permission failures, missing directories).

---

Generated by test-coverage-reporter workflow. Trigger: schedule

Generated by Test Coverage Reporter · 152.4 AIC · ⊞ 4.6K · ◷

• expires on Jun 28, 2026, 6:18 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-28T06:18:20.633Z.

Closed by Workflow