You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
136 source files instrumented · 108 test files · 155 total TypeScript source files
🔴 Critical Gaps (< 50% statement coverage)
None. All 136 files exceed 50% statement coverage. ✅
🟡 Low Coverage (50–79% statement coverage)
File
Stmts
Branches
Notes
src/commands/validators/network-options.ts
🟡 67%
50% ⚠️
Only 14/21 statements covered; Docker-host warning paths untested
🛡️ Security-Critical Path Status
File
Stmts
Branches
Functions
Lines
Status
src/host-iptables.ts
100%
100%
100%
100%
✅ Full coverage
src/squid-config.ts
100%
100%
100%
100%
✅ Full coverage
src/docker-manager.ts
100%
100%
100%
100%
✅ Full coverage
src/domain-patterns.ts
98%
95%
100%
98%
✅ Excellent
src/cli.ts
86%
50%
100%
86%
⚠️ Branch gaps
All five security-critical files meet or exceed the 80% statement threshold. The host-iptables.*, squid-config.ts, and docker-manager.ts modules are at 100% across all metrics — a strong result for the firewall's core enforcement layer.
📋 Files with Branch Coverage < 70%
These files have sufficient statement coverage but untested conditional logic:
src/cli.ts — 50% branch coverage (1/2 branches).
The entry-point module has its happy path covered, but the error/rejection branch in the top-level main() call is untested. This is the orchestration entrypoint for the entire firewall — an unhandled-rejection scenario here could silently swallow startup errors.
src/commands/validators/network-options.ts — 67% stmt / 50% branch (lowest in the codebase).
Only 14 of 21 statements are covered. The validateNetworkOptions() function handles Docker-host detection and DinD path-prefix warnings — specifically the three logger.warn() paths triggered when DOCKER_HOST is external or when dindHint is set but no prefix is configured. These are real operational paths in ARC/DinD environments.
src/services/api-proxy-service.ts — 50% branch coverage (91.7% stmt).
The API proxy is the credential-injection layer — keys are never exposed to the agent. Half of its conditional logic is untested. The uncovered branches likely include credential-absent or BYOK fallback paths that are critical for the security model.
src/services/agent-volumes/etc-mounts.ts — 68% branch coverage.
This file controls which /etc files are bind-mounted into the agent container. Uncovered branches here could mean untested paths in credential-exclusion logic (e.g., ensuring /etc/shadow is never mounted even under edge-case inputs).
📈 Recommendations
High — src/commands/validators/network-options.ts: Add tests for the !dockerHostCheck.valid warning path and the dindHint && !dockerHostPathPrefix path in validateNetworkOptions(). These require mocking checkDockerHost() to return { valid: false } and setting AWF_DIND=1.
High — src/cli.ts: Cover the rejected-promise branch in main(). A test that mocks runMainWorkflow() to throw should verify the process exits with a non-zero code rather than silently continuing.
Medium — src/services/api-proxy-service.ts: Add tests for the uncovered 50% of branches. Focus on: cases where credentials are absent, BYOK fallback logic, and the split-proxy configuration paths — these are the branches most relevant to the credential-isolation security guarantee.
Low — src/services/agent-volumes/etc-mounts.ts: Add edge-case tests covering scenarios where the host /etc directory contains unexpected files, verifying that the allowlist logic correctly filters them out and never mounts sensitive files like /etc/shadow.
Generated by test-coverage-reporter workflow. Trigger: push · Run: 27231690555
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
📊 Test Coverage Report — 2026-06-09
Overall Coverage
🔴 Critical Gaps (< 50% statement coverage)
None. All 136 files exceed 50% statement coverage. ✅
🟡 Low Coverage (50–79% statement coverage)
src/commands/validators/network-options.ts🛡️ Security-Critical Path Status
src/host-iptables.tssrc/squid-config.tssrc/docker-manager.tssrc/domain-patterns.tssrc/cli.tsAll five security-critical files meet or exceed the 80% statement threshold. The
host-iptables.*,squid-config.ts, anddocker-manager.tsmodules are at 100% across all metrics — a strong result for the firewall's core enforcement layer.📋 Files with Branch Coverage < 70%
These files have sufficient statement coverage but untested conditional logic:
src/cli.tssrc/commands/validators/network-options.tssrc/services/api-proxy-service.tssrc/dind-bootstrap.tssrc/services/agent-environment/environment-builder.tssrc/services/agent-volumes/etc-mounts.tssrc/logs/log-parser.ts📋 Full Coverage Table (136 files, sorted by statement coverage)
src/commands/validators/network-options.tssrc/squid-log-reader.tssrc/services/agent-volumes/etc-mounts.tssrc/logs/audit-enricher.tssrc/artifact-preservation.tssrc/cli.tssrc/logs/log-parser.tssrc/squid/policy-manifest.tssrc/services/agent-volumes/docker-host-staging.tssrc/commands/logs-command-helpers.tssrc/dind-bootstrap.tssrc/services/doh-proxy-service.tssrc/commands/validators/log-and-limits.tssrc/services/host-path-prefix.tssrc/config-writer.tssrc/services/api-proxy-service.tssrc/services/agent-volumes/docker-socket.tssrc/logs/log-streamer.tssrc/diagnostic-collector.tssrc/commands/build-config.tssrc/commands/validators/agent-options.tssrc/services/agent-volumes/hosts-file.tssrc/services/agent-environment/environment-builder.tssrc/squid/ssl-bump.tssrc/ssl-bump.tssrc/host-env.tssrc/logs/log-aggregator.tssrc/upstream-proxy.tssrc/services/cli-proxy-service.tssrc/commands/main-action.tssrc/parsers/volume-parsers.tssrc/container-startup-diagnostics.tssrc/services/agent-volumes/workspace-mounts.tssrc/container-cleanup.tssrc/container-lifecycle.tssrc/services/agent-environment/env-passthrough.tssrc/commands/validators/config-assembly.tssrc/compose-sanitizer.tssrc/logs/log-formatter.tssrc/domain-patterns.tssrc/services/agent-service.tssrc/services/agent-volumes/home-strategy.tssrc/config-file.tssrc/rules.tssrc/compose-generator.tssrc/pid-tracker.tssrc/option-parsers.tssrc/api-proxy-config.tssrc/cli-options.tssrc/cli-workflow.tssrc/host-iptables.tssrc/host-iptables-rules.tssrc/host-iptables-shared.tssrc/squid-config.tssrc/docker-manager.tssrc/domain-patterns.tssrc/redact-secrets.tssrc/dlp.tssrc/copilot-api-resolver.tssrc/services/agent-volumes/credential-hiding.tssrc/services/service-security.tssrc/squid/access-rules.tssrc/squid/domain-acl.tssrc/squid/validation.ts🔍 Notable Findings
src/cli.ts— 50% branch coverage (1/2branches).The entry-point module has its happy path covered, but the error/rejection branch in the top-level
main()call is untested. This is the orchestration entrypoint for the entire firewall — an unhandled-rejection scenario here could silently swallow startup errors.src/commands/validators/network-options.ts— 67% stmt / 50% branch (lowest in the codebase).Only 14 of 21 statements are covered. The
validateNetworkOptions()function handles Docker-host detection and DinD path-prefix warnings — specifically the threelogger.warn()paths triggered whenDOCKER_HOSTis external or whendindHintis set but no prefix is configured. These are real operational paths in ARC/DinD environments.src/services/api-proxy-service.ts— 50% branch coverage (91.7% stmt).The API proxy is the credential-injection layer — keys are never exposed to the agent. Half of its conditional logic is untested. The uncovered branches likely include credential-absent or BYOK fallback paths that are critical for the security model.
src/services/agent-volumes/etc-mounts.ts— 68% branch coverage.This file controls which
/etcfiles are bind-mounted into the agent container. Uncovered branches here could mean untested paths in credential-exclusion logic (e.g., ensuring/etc/shadowis never mounted even under edge-case inputs).📈 Recommendations
High —
src/commands/validators/network-options.ts: Add tests for the!dockerHostCheck.validwarning path and thedindHint && !dockerHostPathPrefixpath invalidateNetworkOptions(). These require mockingcheckDockerHost()to return{ valid: false }and settingAWF_DIND=1.High —
src/cli.ts: Cover the rejected-promise branch inmain(). A test that mocksrunMainWorkflow()to throw should verify the process exits with a non-zero code rather than silently continuing.Medium —
src/services/api-proxy-service.ts: Add tests for the uncovered 50% of branches. Focus on: cases where credentials are absent, BYOK fallback logic, and the split-proxy configuration paths — these are the branches most relevant to the credential-isolation security guarantee.Low —
src/services/agent-volumes/etc-mounts.ts: Add edge-case tests covering scenarios where the host/etcdirectory contains unexpected files, verifying that the allowlist logic correctly filters them out and never mounts sensitive files like/etc/shadow.Generated by test-coverage-reporter workflow. Trigger:
push· Run: 27231690555Beta Was this translation helpful? Give feedback.
All reactions