[Coverage Report] Test Coverage Report — 2026-06-02

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage
Statements	96.3%
Branches	90.43%
Functions	98.1%
Lines	96.44%

Overall coverage is strong. 96 test files cover 147 source files across 27,554 lines of tests.

---

🔴 Critical Gaps (< 50% statement coverage)

None. All files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt	Branch	Fn
src/commands/validators/network-options.ts	66.7%	50.0%	100%

Note: src/cli-options.ts has 93% statement coverage but only 25% function coverage — most exported functions go unused in tests.

---

🛡️ Security-Critical Path Status

File	Stmt	Branch	Fn	Status
src/host-iptables.ts	100%	100%	100%	✅ Full
src/squid-config.ts	100%	100%	100%	✅ Full
src/docker-manager.ts	100%	100%	100%	✅ Full
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Excellent
src/cli.ts	85.7%	50.0%	100%	⚠️ Branch gaps
src/host-iptables-rules.ts	97.7%	96.8%	100%	✅ Excellent

All primary security-critical files (host-iptables, squid-config, docker-manager) have 100% coverage. The only concern is src/cli.ts branch coverage at 50%.

---

📋 Files Needing Attention (80–89% range)

File	Stmt	Branch	Fn
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/artifact-preservation.ts	85.4%	95.3%	100%
src/cli.ts	85.7%	50.0%	100%
src/logs/log-parser.ts	86.9%	67.1%	100%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%
src/commands/validators/log-and-limits.ts	88.5%	72.7%	100%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%

---

🔍 Notable Findings

1. src/cli.ts — 50% branch coverage (security orchestration entrypoint)
The main CLI entry has full statement coverage but only 50% branch coverage. This means error/edge branches in the orchestration flow (e.g., signal handling paths, config failure modes) aren't exercised. Given this is the top-level coordinator, uncovered branches could hide silent failures in cleanup or shutdown sequences.

2. src/commands/validators/network-options.ts — 66.7% statements, 50% branches
Only 3 conditional branches are tested in this validator. The uncovered branches handle the dockerHostPathPrefixResolution.dindHint warning path (line 64) and the dockerHostPathPrefix missing warning path (line 59). These relate to DinD (Docker-in-Docker) detection — a security-relevant configuration check.

3. src/logs/log-parser.ts — 86.9% statements, 67.1% branches
Log parsing has one-third of its branches untested. Uncovered paths likely include malformed-line handling and edge-case timestamp parsing. While not a direct security control, log integrity is important for audit trails.

4. src/cli-options.ts — 25% function coverage
Only 2 of ~8 exported functions are called in tests. The untested functions appear to be CLI option definitions/helpers. This is likely acceptable (they're declarative Commander.js option configs), but worth verifying none contain validation logic.

5. Recent commit activity (last 7 days)
One commit landed: feat: optimize export-audit workflow (~94% weekly cost reduction) — touching src/artifact-preservation.ts, src/cli-workflow.ts, src/cli.ts, src/commands/logs-*.ts and related files. Coverage on src/artifact-preservation.ts is 85.4% (statements) / 95.3% (branches), indicating the new paths added are mostly covered.

---

📈 Recommendations

1. High — src/cli.ts branch coverage: Add tests for the signal-handling shutdown paths and config-failure cleanup branches. Target: bring branch coverage from 50% → 80%+. These control whether containers are properly torn down on error.

2. Medium — src/commands/validators/network-options.ts: Add 2–3 unit tests covering (a) external Docker host with missing path prefix (dindHint branch) and (b) external Docker host without dindHint. These are DinD security-configuration validators.

3. Medium — src/logs/log-parser.ts: Add tests for malformed log line inputs and boundary timestamp values to close the 33% branch gap. This strengthens audit log integrity.

4. Low — src/cli-options.ts function coverage: Audit the 6 uncovered functions — if they contain validation logic rather than pure option declarations, add targeted tests.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run ID: 26853958273

Generated by Test Coverage Reporter · sonnet46 691.7K · ◷

• expires on Jun 9, 2026, 11:27 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-09T23:27:35.737Z.

Closed by Workflow