[Coverage Report] Test Coverage Report — 2026-05-26

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.48%	4287 / 4443
Branches	90.89%	2256 / 2482
Functions	98.19%	490 / 499
Lines	96.62%	4155 / 4300

Overall coverage is excellent. No files fall below 50% statement coverage.

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 82 instrumented source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmt%	Branch%	Fn%
src/services/agent-volumes/hosts-file.ts	81.0%	66.7%	100%
src/commands/validators/network-options.ts	81.2%	50.0%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/cli.ts	85.7%	67.1%	100%
src/logs/log-parser.ts	86.9%	67.1%	100%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%
src/cli-workflow.ts	88.9%	75.0%	100%
src/services/host-path-prefix.ts	88.9%	75.0%	100%
src/services/doh-proxy-service.ts	90.0%	75.0%	100%
src/cli-options.ts	93.0%	60.0%	25.0%

Note: src/test-helpers/docker-test-fixtures.test-utils.ts shows 90.9% stmt / 40.0% branch but is a test utility file, not production code.

---

🛡️ Security-Critical Path Status

File	Stmt%	Branch%	Fn%	Status
src/host-iptables.ts	100%	100%	100%	✅ Full coverage
src/host-iptables-rules.ts	97.7%	96.8%	100%	✅ Excellent
src/host-iptables-network.ts	100%	100%	100%	✅ Full coverage
src/host-iptables-cleanup.ts	100%	100%	100%	✅ Full coverage
src/squid-config.ts	100%	100%	100%	✅ Full coverage
src/docker-manager.ts	100%	100%	100%	✅ Full coverage
src/domain-patterns.ts	97.7%	96.8%	100%	✅ Excellent
src/cli.ts	85.7%	67.1%	100%	🟡 Needs attention
src/rules.ts	98.2%	91.9%	100%	✅ Excellent

All primary security-critical paths (iptables rules, Squid domain ACLs, Docker lifecycle) have exceptional coverage. The only security-adjacent concern is src/cli.ts at 85.7%/67.1%.

---

📋 Full Coverage Table

Click to expand per-file breakdown

Stmt%	Branch%	Fn%	Line%	File
81.0%	66.7%	100.0%	79.5%	src/services/agent-volumes/hosts-file.ts
81.2%	50.0%	100.0%	85.7%	src/commands/validators/network-options.ts
83.6%	74.1%	100.0%	89.4%	src/logs/audit-enricher.ts
85.7%	67.1%	100.0%	87.8%	src/cli.ts
86.9%	67.1%	100.0%	87.8%	src/logs/log-parser.ts
87.2%	88.2%	70.0%	87.0%	src/squid/policy-manifest.ts
88.5%	83.3%	100.0%	88.3%	src/commands/logs-command-helpers.ts
88.9%	75.0%	100.0%	87.0%	src/cli-workflow.ts
88.9%	75.0%	100.0%	87.0%	src/services/host-path-prefix.ts
90.0%	75.0%	100.0%	90.0%	src/services/doh-proxy-service.ts
90.3%	96.8%	100.0%	90.2%	src/container-cleanup.ts
90.9%	83.0%	100.0%	90.9%	src/config-writer.ts
92.0%	93.3%	100.0%	92.0%	src/services/agent-volumes/docker-socket.ts
92.2%	77.8%	88.9%	92.1%	src/logs/log-streamer.ts
93.0%	88.6%	100.0%	93.0%	src/commands/validators/agent-options.ts
93.0%	60.0%	25.0%	93.0%	src/cli-options.ts
93.5%	66.7%	100.0%	93.5%	src/services/agent-environment/environment-builder.ts
93.8%	91.7%	100.0%	93.8%	src/squid/ssl-bump.ts
94.0%	84.6%	100.0%	94.7%	src/ssl-bump.ts
94.1%	80.0%	100.0%	95.9%	src/host-env.ts
94.2%	84.2%	100.0%	94.0%	src/container-lifecycle.ts
94.7%	87.5%	100.0%	94.7%	src/logs/log-aggregator.ts
94.9%	94.7%	100.0%	94.5%	src/upstream-proxy.ts
95.2%	86.7%	100.0%	95.2%	src/commands/validators/log-and-limits.ts
95.5%	88.6%	100.0%	95.4%	src/commands/main-action.ts
95.5%	93.3%	100.0%	95.5%	src/services/cli-proxy-service.ts
95.8%	100.0%	100.0%	95.8%	src/parsers/volume-parsers.ts
96.3%	76.9%	100.0%	97.4%	src/pid-tracker.ts
96.5%	92.8%	100.0%	97.6%	src/commands/validators/config-assembly.ts
96.8%	92.0%	100.0%	96.8%	src/services/agent-environment/env-passthrough.ts
97.4%	92.8%	100.0%	97.3%	src/logs/log-formatter.ts
97.4%	75.0%	100.0%	97.4%	src/services/agent-volumes/home-strategy.ts
97.7%	95.4%	100.0%	97.6%	src/domain-patterns.ts
97.7%	96.8%	100.0%	97.6%	src/host-iptables-rules.ts
97.8%	94.6%	100.0%	97.7%	src/services/agent-service.ts
98.0%	96.8%	87.5%	100.0%	src/config-file.ts
98.2%	91.9%	100.0%	98.1%	src/rules.ts
98.4%	90.0%	100.0%	98.4%	src/compose-generator.ts
98.8%	94.7%	100.0%	98.8%	src/option-parsers.ts
99.0%	90.9%	100.0%	98.9%	src/services/api-proxy-service.ts
100%	100%	100%	100%	src/api-proxy-config.ts
100%	100%	100%	100%	src/constants.ts
100%	95.7%	100%	100%	src/copilot-api-resolver.ts
100%	93.8%	100%	100%	src/dind-probe.ts
100%	100%	100%	100%	src/dlp.ts
100%	91.7%	100%	100%	src/dns-resolver.ts
100%	100%	100%	100%	src/docker-host.ts
100%	100%	100%	100%	src/docker-manager.ts
100%	100%	100%	100%	src/domain-utils.ts
100%	100%	100%	100%	src/env-utils.ts
100%	100%	100%	100%	src/github-env.ts
100%	96.9%	100%	100%	src/host-identity.ts
100%	100%	100%	100%	src/host-iptables-cleanup.ts
100%	100%	100%	100%	src/host-iptables-network.ts
100%	95.0%	100%	100%	src/host-iptables-shared.ts
100%	100%	100%	100%	src/host-iptables.ts
100%	100%	100%	100%	src/image-tag.ts
100%	100%	100%	100%	src/log-paths.ts
100%	90.9%	100%	100%	src/logger.ts
100%	100%	100%	100%	src/redact-secrets.ts
100%	100%	100%	100%	src/schema-validator.ts
100%	100%	100%	100%	src/squid-config.ts
100%	97.3%	100%	100%	src/commands/build-config.ts
100%	95.7%	100%	100%	src/commands/logs-audit.ts
100%	100%	100%	100%	src/commands/logs-stats.ts
100%	100%	100%	100%	src/commands/logs-summary.ts
100%	100%	100%	100%	src/commands/logs.ts
100%	87.0%	100%	100%	src/commands/network-setup.ts
100%	100%	100%	100%	src/commands/predownload.ts
100%	83.8%	100%	100%	src/commands/preflight.ts
100%	87.5%	100%	100%	src/commands/signal-handler.ts
100%	100%	100%	100%	src/commands/subcommands.ts
100%	100%	100%	100%	src/commands/validate-options.ts
100%	100%	100%	100%	src/constants/placeholders.ts
100%	100%	100%	100%	src/logs/index.ts
100%	90.0%	100%	100%	src/logs/log-discovery.ts
100%	93.5%	100%	100%	src/logs/stats-formatter.ts

---

🔍 Notable Findings

1. src/cli.ts — 85.7% stmt / 67.1% branch: This is the main orchestration entry point. The 32.9% uncovered branches likely represent error-handling paths (failed container starts, signal interrupts mid-flow, unexpected exit codes). Given its role coordinating the entire firewall lifecycle, improving branch coverage here would catch orchestration failure modes. 1 recent commit touched this file.

2. src/commands/validators/network-options.ts — 50.0% branch coverage: Only half the conditional branches are exercised. Network option validation guards inputs like --allow-domains, --dns-servers, and --docker-host. Uncovered branches likely include malformed inputs and edge-case combinations.

3. src/cli-options.ts — 60.0% branch / 25.0% function coverage: Three out of four exported functions are never called in tests. This file likely handles CLI option defaults and parsing helpers; the uncovered functions may represent option combinations exercised only in integration tests.

4. src/logs/audit-enricher.ts + src/logs/log-parser.ts — 74.1% and 67.1% branch coverage: Log parsing and enrichment paths for malformed or unexpected log entries are likely untested. These matter for operational visibility — silent parse failures could cause coverage reports to silently under-count denied connections.

---

📈 Recommendations

1. High — src/cli.ts branch coverage: Add unit tests covering the error-handling branches (e.g., startContainers failure, SIGTERM during container startup, container exit before command completes). Target: bring branch coverage from 67% → 85%+.

2. Medium — src/commands/validators/network-options.ts: Add parameterized tests for invalid domain formats, conflicting DNS options, and missing required fields. The 50% branch gap suggests entire validation paths are untested.

3. Medium — src/logs/log-parser.ts and src/logs/audit-enricher.ts: Add tests with malformed Squid log lines (truncated entries, missing fields, unexpected formats) to cover the 33%/26% of uncovered branches. These safeguard the accuracy of security audit trails.

4. Low — src/cli-options.ts function coverage: Identify and test the 3 uncovered exported functions, or consider removing them if they're dead code.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 26429076455

Generated by Test Coverage Reporter · sonnet46 698.1K · ◷

• expires on Jun 2, 2026, 2:42 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-02T02:42:52.747Z.

Closed by Workflow