[Coverage Report] Test Coverage Report — 2026-06-02

[github-actions[bot]]

Overall Coverage

Metric	Coverage
Statements	96.25%
Branches	90.46%
Functions	98.27%
Lines	96.40%

Overall health is excellent — 95 test files covering 142 source files.

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files are above 50%.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.7%	50.0%	100.0%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions
src/host-iptables.ts	✅ 100%	✅ 100%	✅ 100%
src/squid-config.ts	✅ 100%	✅ 100%	✅ 100%
src/docker-manager.ts	✅ 100%	✅ 100%	✅ 100%
src/domain-patterns.ts	✅ 97.7%	✅ 95.4%	✅ 100%
src/cli.ts	✅ 85.7%	⚠️ 50.0%	✅ 100%

All primary security-critical files (host-iptables.ts, squid-config.ts, docker-manager.ts) are at 100% across all metrics.

---

📋 Full Coverage Table

Click to expand all files

Status	File	Stmt%	Branch%	Fn%
🟡	src/commands/validators/network-options.ts	66.7	50.0	100.0
✅	src/services/agent-volumes/etc-mounts.ts	82.5	67.8	100.0
✅	src/logs/audit-enricher.ts	83.6	74.1	100.0
✅	src/cli.ts	85.7	50.0	100.0
✅	src/logs/log-parser.ts	86.9	67.1	100.0
✅	src/squid/policy-manifest.ts	87.2	88.2	70.0
✅	src/services/agent-volumes/docker-host-staging.ts	87.8	72.4	100.0
✅	src/commands/logs-command-helpers.ts	88.5	83.3	100.0
✅	src/services/doh-proxy-service.ts	90.0	75.0	100.0
✅	src/container-cleanup.ts	90.3	96.8	100.0
✅	src/services/host-path-prefix.ts	90.3	81.6	100.0
✅	src/config-writer.ts	90.9	83.0	100.0
✅	src/commands/validators/log-and-limits.ts	91.5	78.4	100.0
✅	src/services/agent-volumes/docker-socket.ts	91.7	93.3	100.0
✅	src/logs/log-streamer.ts	92.2	77.8	88.9
✅	src/commands/validators/agent-options.ts	93.0	88.6	100.0
✅	src/cli-options.ts	93.0	60.0	25.0
✅	src/services/agent-volumes/hosts-file.ts	93.2	90.3	100.0
✅	src/services/agent-environment/environment-builder.ts	93.5	66.7	100.0
✅	src/squid/ssl-bump.ts	93.8	91.7	100.0
✅	src/ssl-bump.ts	94.0	84.6	100.0
✅	src/host-env.ts	94.1	80.0	100.0
✅	src/container-lifecycle.ts	94.2	84.2	100.0
✅	src/logs/log-aggregator.ts	94.7	87.5	100.0
✅	src/upstream-proxy.ts	94.9	94.7	100.0
✅	src/commands/main-action.ts	95.5	88.6	100.0
✅	src/services/cli-proxy-service.ts	95.5	93.3	100.0
✅	src/parsers/volume-parsers.ts	95.8	100.0	100.0
✅	src/services/agent-volumes/workspace-mounts.ts	96.3	75.0	100.0
✅	src/pid-tracker.ts	96.3	76.9	100.0
✅	src/commands/validators/config-assembly.ts	96.5	92.8	100.0
✅	src/services/agent-environment/env-passthrough.ts	96.8	92.0	100.0
✅	src/services/agent-volumes/home-strategy.ts	97.4	75.0	100.0
✅	src/logs/log-formatter.ts	97.4	92.8	100.0
✅	src/domain-patterns.ts	97.7	95.4	100.0
✅	src/host-iptables-rules.ts	97.7	96.8	100.0
✅	src/services/agent-service.ts	97.8	94.6	100.0
✅	src/services/api-proxy-service.ts	98.0	90.3	100.0
✅	src/config-file.ts	98.1	97.1	87.5
✅	src/rules.ts	98.2	91.9	100.0
✅	src/compose-generator.ts	98.4	90.0	100.0
✅	src/option-parsers.ts	98.9	95.5	100.0
✅	src/api-proxy-config.ts	100.0	100.0	100.0
✅	src/cli-workflow.ts	100.0	100.0	100.0
✅	src/commands/build-config.ts	100.0	97.7	100.0
✅	src/commands/logs*.ts	100.0	100.0	100.0
✅	src/docker-manager.ts	100.0	100.0	100.0
✅	src/host-iptables.ts	100.0	100.0	100.0
✅	src/squid-config.ts	100.0	100.0	100.0

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts (66.7% stmt, 50% branch) — The lowest-covered file. Lines 48–74 are uncovered, containing Docker host validation warnings (external DOCKER_HOST detection and DinD split-filesystem path prefix warnings). These warn paths depend on environment state, but they affect agent network isolation setup.

2. src/cli.ts (85.7% stmt, 50% branch) — Only DA:12 (the if (require.main === module) guard) is uncovered — expected and harmless. The 50% branch coverage reflects this single untested branch.

3. src/logs/audit-enricher.ts (83.6% stmt, 74.1% branch) — Part of the recently active logs subsystem (changed in the last 7 days); error and edge-case paths may need additional test coverage.

4. src/services/agent-volumes/etc-mounts.ts (82.5% stmt, 67.8% branch) — Handles /etc file mounting (SSL certs, credential exclusions). Branch gaps could indicate untested edge cases in the selective bind-mount logic.

---

📈 Recommendations

1. High: Add tests for src/commands/validators/network-options.ts lines 48–74 — mock DOCKER_HOST env variable to exercise external Docker host detection and DinD warning paths. This is a network isolation configuration path.

2. Medium: Add tests for src/services/agent-volumes/etc-mounts.ts uncovered branches — specifically edge cases around SSL cert path detection and /etc file inclusion/exclusion logic.

3. Low: Cover src/logs/audit-enricher.ts error-handling paths — add tests for malformed log input or missing fields to raise branch coverage above 80%.

---

Generated by test-coverage-reporter workflow. Trigger: push. Run ID: 26799097661

Generated by Test Coverage Reporter · sonnet46 963.9K · ◷

• expires on Jun 9, 2026, 4:55 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here. May the whitelist hold and the build remain unbroken.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-09T04:55:26.119Z.

Closed by Workflow