[Coverage Report] Test Coverage Report — 2026-06-02

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.17%	4,497 / 4,676
Branches	90.29%	2,401 / 2,659
Functions	98.12%	522 / 532
Lines	96.30%	4,355 / 4,522

Test suite: 2,329 tests across 110 suites — 1 test failing (flaky DNS resolution in agent-volumes-mounts.test.ts, environment-specific IP mismatch).

---

🔴 Critical Gaps (< 50% statement coverage)

None. All source files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branches	Funcs
src/commands/validators/network-options.ts	🟡 66.7%	🟡 50.0%	100%

---

🛡️ Security-Critical Path Status

File	Stmts	Branches	Funcs	Status
src/host-iptables.ts	100%	100%	100%	✅ Full coverage
src/squid-config.ts	100%	100%	100%	✅ Full coverage
src/docker-manager.ts	100%	100%	100%	✅ Full coverage
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Near-complete
src/cli.ts	85.7%	50.0%	100%	⚠️ Branch gaps

The three most security-sensitive modules (host-iptables.ts, squid-config.ts, docker-manager.ts) all have 100% coverage across all metrics.

---

📋 Coverage Table (files below 100%)

Click to expand — all files with less than 100% statement coverage

File	Stmts	Branches	Funcs	Lines
src/commands/validators/network-options.ts	🟡 66.7%	🟡 50.0%	100%	66.7%
src/services/agent-volumes/etc-mounts.ts	🟢 82.5%	🟡 67.9%	100%	82.5%
src/logs/audit-enricher.ts	🟢 83.6%	🟢 74.1%	100%	89.4%
src/services/agent-volumes/hosts-file.ts	🟢 84.7%	🟢 87.1%	100%	83.9%
src/artifact-preservation.ts	🟢 85.4%	🟢 95.3%	100%	85.4%
src/cli.ts	🟢 85.7%	🟡 50.0%	100%	85.7%
src/logs/log-parser.ts	🟢 86.9%	🟡 67.1%	100%	87.8%
src/squid/policy-manifest.ts	🟢 87.2%	🟢 88.2%	70.0%	87.0%
src/services/agent-volumes/docker-host-staging.ts	🟢 87.8%	🟢 72.4%	100%	87.2%
src/commands/validators/log-and-limits.ts	🟢 88.5%	🟢 72.7%	100%	88.5%
src/commands/logs-command-helpers.ts	🟢 88.5%	🟢 83.3%	100%	88.3%
src/config-writer.ts	🟢 89.3%	🟢 80.9%	100%	89.3%
src/services/doh-proxy-service.ts	🟢 90.0%	🟢 75.0%	100%	90.0%
src/services/host-path-prefix.ts	🟢 90.3%	🟢 81.6%	100%	88.9%
src/services/api-proxy-service.ts	🟢 91.7%	🟡 50.0%	100%	91.7%
src/services/agent-volumes/docker-socket.ts	🟢 91.7%	🟢 93.3%	100%	91.7%
src/logs/log-streamer.ts	🟢 92.2%	🟢 77.8%	88.9%	92.1%
src/diagnostic-collector.ts	🟢 92.5%	🟢 100%	100%	92.5%
src/commands/validators/agent-options.ts	🟢 93.0%	🟢 88.6%	100%	93.0%
src/cli-options.ts	🟢 93.0%	🟡 60.0%	25.0%	93.0%
src/services/agent-environment/environment-builder.ts	🟢 93.5%	🟡 66.7%	100%	93.5%
src/squid/ssl-bump.ts	🟢 93.8%	🟢 91.7%	100%	93.8%
src/ssl-bump.ts	🟢 94.0%	🟢 84.6%	100%	94.7%
src/host-env.ts	🟢 94.1%	🟢 80.0%	100%	95.9%
src/services/agent-volumes/workspace-mounts.ts	🟢 94.4%	🟢 72.5%	100%	94.4%
src/logs/log-aggregator.ts	🟢 94.7%	🟢 87.5%	100%	94.7%
src/upstream-proxy.ts	🟢 94.9%	🟢 94.7%	100%	94.5%
src/commands/main-action.ts	🟢 95.5%	🟢 88.6%	100%	95.4%
src/services/cli-proxy-service.ts	🟢 95.5%	🟢 93.3%	100%	95.5%
src/container-lifecycle.ts	🟢 95.9%	🟢 88.2%	100%	95.7%
src/domain-patterns.ts	🟢 97.7%	🟢 95.4%	100%	97.6%
src/host-iptables-rules.ts	🟢 97.7%	🟢 96.8%	100%	97.6%

---

🔍 Notable Findings

1. src/cli.ts — 50% branch coverage

The main CLI entry point has only half its branches exercised. Uncovered branches likely include error/exception paths after container startup, signal handler edge cases, and --keep-containers cleanup skipping logic. Since this is the orchestration core, these gaps represent untested failure modes.

2. src/commands/validators/network-options.ts — 50% branch / 66.7% statement

The network option validator is the lowest-covered non-test file overall. Missing branches likely cover invalid DNS server formats, conflicting option combinations (e.g., --enable-dind + proxy options), and upstream proxy validation edge cases. This validator runs before any container starts — bugs here could silently misconfigure the firewall.

3. src/services/api-proxy-service.ts — 50% branch coverage

The API proxy service (which handles credential injection for OpenAI/Anthropic/Copilot) has significant branch gaps at 50%. Uncovered branches may include error handling when the upstream API is unreachable, port conflict handling, and the optional activation guard. Security-sensitive given it handles real API keys.

4. src/logs/log-parser.ts — 67.1% branch coverage

The log parser has uncovered branches in Squid access log parsing — likely malformed line handling, unexpected field counts, and timestamp parsing edge cases. While not a security boundary, poor coverage here can hide silent log corruption that would affect awf logs stats accuracy.

⚠️ Flaky test

src/services/agent-volumes-mounts.test.ts is failing due to a DNS IP mismatch — the test expects 140.82.121.4 for github.com but the runner resolved it to 140.82.113.3. This is an environment-specific issue with hardcoded expected IPs in the test.

---

📈 Recommendations

1. High — Fix flaky test: Update agent-volumes-mounts.test.ts to not hardcode specific IP addresses for github.com and npmjs.org. Use a pattern match or mock the DNS resolver to avoid environment-specific failures.

2. High — src/commands/validators/network-options.ts: Add tests for invalid DNS server input, conflicting network options, and upstream proxy validation edge cases. This code gates all firewall configuration.

3. Medium — src/cli.ts branch coverage: Add tests for the error-path branches: what happens when startContainers() throws, when the agent command exits non-zero, and when cleanup is skipped due to --keep-containers. These represent real operational failure scenarios.

4. Medium — src/services/api-proxy-service.ts branch coverage: Test the branches where the api-proxy sidecar is disabled (verify early returns work correctly) and where credential injection fails.

5. Low — src/logs/log-parser.ts: Add tests for malformed Squid log lines (truncated, extra fields, invalid timestamps) to harden the log aggregation pipeline against unexpected Squid output formats.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 26854579797

Generated by Test Coverage Reporter · sonnet46 1.1M · ◷

• expires on Jun 9, 2026, 11:46 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-09T23:46:20.429Z.

Closed by Workflow