[Coverage Report] Test Coverage Report — 2026-06-02 #4236
Closed
Replies: 2 comments
-
|
🔮 The ancient spirits stir: the smoke test agent has passed through this thread, and the run remains aligned with the warding sigils. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
0 replies
-
|
This discussion was automatically closed because it expired on 2026-06-09T23:37:13.518Z.
|
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Overall Coverage
Overall health is excellent. No files fall below 50% statement coverage.
🔴 Critical Gaps (< 50% statement coverage)
None. All 149 source files exceed 50% statement coverage.
🟡 Low Coverage (50–79% statement coverage)
src/commands/validators/network-options.ts🛡️ Security-Critical Path Status
src/host-iptables.tssrc/squid-config.tssrc/docker-manager.tssrc/domain-patterns.tssrc/cli.tssrc/host-iptables-rules.tsAll four primary security-critical files are at or near 100%. The only concern in this group is
src/cli.tswith 50% branch coverage.📋 Notable Findings
1.
src/cli.ts— branch coverage at 50%The CLI entry point has full statement/function coverage but only 50% branch coverage. This suggests that error-handling branches and conditional paths (e.g., exception handling in the top-level orchestration, signal-interrupt edge cases) aren't being exercised. Since
cli.tsis the main entry point that callswriteConfigs(),startContainers(),runAgentCommand(), andstopContainers(), covering failure branches here provides end-to-end confidence.Suggested tests: Simulate container-start failures, command execution errors, and SIGINT during startup to cover branches currently missed.
2.
src/commands/validators/network-options.ts— 66.7% statements, 50% branchesThis validator handles network option parsing and validation — a security-relevant path. With only half the branches covered, some input combinations (likely invalid or edge-case domain/DNS configurations) go untested.
Suggested tests: Test with invalid domain formats, conflicting network options, edge-case DNS server lists, and
--upstream-proxycombinations.3.
src/logs/log-parser.ts— 86.9% statements, 67.1% branchesThe log parser processes firewall access logs for the
awf logscommands. Uncovered branches likely include malformed log line handling and edge-case timestamp parsing. While not directly security-critical, incorrect parsing could mask blocked traffic in reports.Suggested tests: Feed malformed Squid log lines, lines with missing fields, and boundary timestamp values.
4.
src/services/agent-volumes/etc-mounts.ts— 82.5% statements, 67.9% branchesThis file controls which
/etcpaths are bind-mounted into the agent container. Uncovered branches may relate to conditional mount logic (e.g., when certain files don't exist on the host). Incorrect/etcmount decisions could exposeshadowor other sensitive files.Suggested tests: Test with missing host files and non-standard host configurations to verify the deny-by-default behavior holds.
📈 Recommendations
High —
src/cli.tsbranch coverage (50%): Add tests for the top-level exception and signal-handling paths. A test that simulatesstartContainers()throwing an error would immediately improve branch coverage and validate that cleanup still runs.High —
src/commands/validators/network-options.ts(66.7% stmt / 50% branch): Add negative validation tests: invalid--allow-domainsformats, conflicting--upstream-proxy+--enable-api-proxyscenarios, and edge-case DNS IP inputs.Medium —
src/logs/log-parser.ts(67.1% branch): Add fuzz-style tests with malformed log lines. This also validates that theawf logs summaryGitHub Actions integration doesn't silently drop blocked-traffic events.Low —
src/services/agent-volumes/etc-mounts.ts(67.9% branch): Cover the "file not found on host" conditional paths to verify that missing system files don't silently change the mount set in unexpected ways.📊 Full Coverage Table
Per-file breakdown (all 149 source files)
Generated by test-coverage-reporter workflow. Trigger:
push· Run: 26854267200Beta Was this translation helpful? Give feedback.
All reactions