[Coverage Report] Test Coverage Report — 2026-06-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-09

Test suite: 122 suites · 2,471 tests · 1 failing (environment-specific DNS IP, see findings)
Trigger: push · Commit: 7f51699 (Bundle models.dev catalog)

---

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.25%	4,751 / 4,936
Branches	90.65%	2,618 / 2,888
Functions	98.76%	562 / 569
Lines	96.33%	4,597 / 4,772

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 155 source files are above 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts %	Branch %	Note
src/commands/validators/network-options.ts	66.66%	50%	⚠️ New file, added this week

This file was introduced in the most recent commit (7f51699) and has no dedicated test file. The uncovered code consists of 3 warning branches triggered by external Docker host detection and DinD split-filesystem hints.

---

🛡️ Security-Critical Path Status

File	Stmts %	Branch %	Funcs %	Status
src/host-iptables.ts	100%	100%	100%	✅ Full coverage
src/squid-config.ts	100%	100%	100%	✅ Full coverage
src/docker-manager.ts	100%	100%	100%	✅ Full coverage
src/domain-patterns.ts	97.67%	95.38%	100%	✅ Excellent
src/cli.ts	85.71%	50%	100%	⚠️ Low branch (13-line file, minimal logic)

The four highest-risk security files (host-iptables.ts, squid-config.ts, docker-manager.ts, domain-patterns.ts) all have near-perfect or full coverage. The cli.ts branch gap is cosmetic — the file is only 13 lines and the uncovered branch is require.main === module.

---

📋 Full Coverage Table

All files sorted by statement coverage (lowest first)

File	Stmts %	Branch %	Funcs %	Lines %
🟡 src/commands/validators/network-options.ts	66.66	50	100	66.66
src/squid-log-reader.ts	82.22	80	100	82.22
src/services/agent-volumes/etc-mounts.ts	82.45	67.85	100	82.45
src/logs/audit-enricher.ts	83.6	74.13	100	89.36
src/services/agent-volumes/hosts-file.ts	84.74	87.09	100	83.92
src/artifact-preservation.ts	85.36	95.34	100	85.36
src/cli.ts	85.71	50	100	85.71
src/logs/log-parser.ts	86.9	68.57	100	87.8
src/squid/policy-manifest.ts	87.23	88.23	70	86.95
src/services/agent-volumes/docker-host-staging.ts	87.75	72.41	100	87.23
src/commands/logs-command-helpers.ts	88.52	83.33	100	88.33
src/dind-bootstrap.ts	88.88	66.66	100	88.46
src/config-writer.ts	89.25	80.85	100	89.25
src/services/doh-proxy-service.ts	90	75	100	90
src/commands/validators/log-and-limits.ts	90.32	77.58	100	90.32
src/services/host-path-prefix.ts	90.32	81.57	100	88.88
src/services/api-proxy-service.ts	91.66	50	100	91.66
src/services/agent-volumes/docker-socket.ts	91.66	93.33	100	91.66
src/logs/log-streamer.ts	92.18	77.77	88.88	92.06
src/services/agent-volumes/system-mounts.ts	92.3	75	100	92.3
src/diagnostic-collector.ts	92.5	100	100	92.5
src/commands/build-config.ts	92.85	92.2	100	92.85
src/commands/validators/agent-options.ts	92.98	88.57	100	92.98
src/services/agent-environment/environment-builder.ts	93.54	66.66	100	93.54
src/squid/ssl-bump.ts	93.75	91.66	100	93.75
src/ssl-bump.ts	93.96	84.61	100	94.69
src/host-env.ts	94.11	80	100	95.91
src/services/agent-volumes/workspace-mounts.ts	94.44	72.5	100	94.44
src/logs/log-aggregator.ts	94.73	87.5	100	94.66
src/upstream-proxy.ts	94.93	94.73	100	94.52
src/services/cli-proxy-service.ts	95.45	93.33	100	95.45
src/commands/main-action.ts	95.58	88.57	100	95.58
src/parsers/volume-parsers.ts	95.83	100	100	95.83
src/container-startup-diagnostics.ts	96.15	93.87	100	96
src/container-cleanup.ts	96.42	100	80	95.83
src/container-lifecycle.ts	96.77	86.84	100	96.59
src/compose-sanitizer.ts	97.14	93.33	100	97.05
src/commands/validators/config-assembly.ts	97.29	91.48	100	98.16
src/logs/log-formatter.ts	97.43	92.85	100	97.29
src/domain-patterns.ts	97.67	95.38	100	97.61
src/services/agent-service.ts	97.77	94.64	100	97.67
src/services/agent-volumes/home-strategy.ts	97.77	83.33	100	97.72
src/config-file.ts	98.11	97.29	87.5	100
src/rules.ts	98.18	91.89	100	98.11
src/compose-generator.ts	98.43	92.5	100	98.43
src/pid-tracker.ts	98.78	80.76	100	98.7
src/option-parsers.ts	98.88	95.55	100	98.82
src/api-proxy-config.ts	100	98.19	100	100
src/cli-options.ts	100	93.33	100	100
src/cli-workflow.ts	100	100	100	100
src/docker-manager.ts	100	100	100	100
src/domain-patterns.ts	97.67	95.38	100	97.61
src/host-iptables.ts	100	100	100	100
src/host-iptables-rules.ts	100	97.01	100	100
src/host-iptables-shared.ts	100	95	100	100
src/squid-config.ts	100	100	100	100
src/redact-secrets.ts	100	100	100	100
src/services/agent-volumes/credential-hiding.ts	100	100	100	100
src/squid/access-rules.ts	100	100	100	100
src/squid/acl-generator.ts	100	100	100	100
src/squid/domain-acl.ts	100	100	100	100

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — New file, zero test coverage for warning branches
   Added in 7f51699, this 108-line file orchestrates Docker host detection, DinD hints, and domain resolution. Its 5 uncovered branches are all logger.warn(...) paths triggered when !dockerHostCheck.valid or dindHint is set. A dedicated test file network-options.test.ts with mock checkDockerHost() returning invalid/dind states would close this gap entirely.

2. src/services/agent-volumes/etc-mounts.ts — Low branch coverage (67.85%)
   This security-adjacent file selects which /etc files are bind-mounted into the chroot. Uncovered branches likely cover missing-file fallbacks and conditional mount logic. Gaps here could mask an incorrect file exclusion (e.g., accidentally mounting /etc/shadow).

3. src/dind-bootstrap.ts — Uncovered error paths (66.66% branch)
   DinD bootstrap error-handling branches are not exercised. These paths handle Docker daemon initialization failures, which are important for operational reliability in ARC/DinD environments.

4. Flaky test: src/services/agent-volumes-mounts.test.ts
   One test fails with: Expected "140.82.121.4\tgithub.qkg1.top" — the hardcoded IP is stale; the actual DNS pre-resolution in CI resolved github.com to 140.82.112.4. The test should use a mock resolver or a fixture DNS response rather than a live lookup result.

---

📈 Recommendations

1. High — Add src/commands/validators/network-options.test.ts: mock checkDockerHost() to return { valid: false } and { dindHint: true } to cover the 5 warning branches. This is new code from this week with no tests.

2. Medium — Add branch tests for src/services/agent-volumes/etc-mounts.ts: cover the case where an /etc source file is missing on the host — ensure the mount is gracefully skipped and no unexpected fallbacks expose restricted files.

3. Low — Fix the flaky DNS test in src/services/agent-volumes-mounts.test.ts: replace the hardcoded IP assertion (140.82.121.4) with a dynamic lookup or mock the DNS resolver so the test is environment-independent.

---

Generated by test-coverage-reporter workflow · Trigger: push · Commit: 7f51699

Generated by Test Coverage Reporter · 149.9 AIC · ⊞ 32.2K · ◷

• expires on Jun 16, 2026, 9:15 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir over discussion 4629. The smoke test agent was here, and the omens of verification are recorded.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed through this discussion. May the logs remain clear and the build winds be kind.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent has visited and the signs are favorable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here. The oracle has witnessed this discussion and leaves a brief sigil of passage.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through this discussion in silence. May the build remain sealed and the paths stay true.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex