[Coverage Report] Test Coverage Report — 2026-06-05

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.40%	4,589 / 4,760
Branches	90.86%	2,477 / 2,726
Functions	98.70%	535 / 542
Lines	96.49%	4,437 / 4,598

Test suite: 113 suites, 2,389 tests — 1 failing (flaky DNS test, see below)

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.7%	50.0%	100%

This file has only one exported function (validateNetworkOptions). The uncovered statements and branches are the warning-emission paths for:

• Invalid/external DOCKER_HOST configurations
• ARC/DinD split-filesystem hints (dindHint flag)

These are hard to exercise in unit tests without mocking the Docker environment detection helpers.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Full
src/squid-config.ts	100%	100%	100%	✅ Full
src/docker-manager.ts	100%	100%	100%	✅ Full
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Excellent
src/cli.ts	85.7%	50.0%	100%	⚠️ Branch gap

src/cli.ts's 50% branch coverage is explained by the top-level if (require.main === module) guard — this branch is never exercised in unit tests (by design), so the metric is expected rather than a real gap.

---

📋 Full Coverage Table

All files (sorted by statement coverage, lowest first)

File	Stmts	Branches	Functions	Lines
src/commands/validators/network-options.ts	66.7%	50.0%	100%	66.7%
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100%	82.5%
src/logs/audit-enricher.ts	83.6%	74.1%	100%	89.4%
src/services/agent-volumes/hosts-file.ts	84.7%	87.1%	100%	83.9%
src/artifact-preservation.ts	85.4%	95.3%	100%	85.4%
src/cli.ts	85.7%	50.0%	100%	85.7%
src/logs/log-parser.ts	86.9%	67.1%	100%	87.8%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%	87.2%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%	88.3%
src/config-writer.ts	89.2%	80.8%	100%	89.2%
src/commands/validators/log-and-limits.ts	89.5%	74.5%	100%	89.5%
src/services/doh-proxy-service.ts	90.0%	75.0%	100%	90.0%
src/services/host-path-prefix.ts	90.3%	81.6%	100%	88.9%
src/services/api-proxy-service.ts	91.7%	50.0%	100%	91.7%
src/services/agent-volumes/docker-socket.ts	91.7%	93.3%	100%	91.7%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
src/diagnostic-collector.ts	92.5%	100%	100%	92.5%
src/commands/validators/agent-options.ts	93.0%	88.6%	100%	93.0%
src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100%	93.5%
src/squid/ssl-bump.ts	93.8%	91.7%	100%	93.8%
src/ssl-bump.ts	94.0%	84.6%	100%	94.7%
src/host-env.ts	94.1%	80.0%	100%	95.9%
src/services/agent-volumes/workspace-mounts.ts	94.4%	72.5%	100%	94.4%
src/logs/log-aggregator.ts	94.7%	87.5%	100%	94.7%
src/upstream-proxy.ts	94.9%	94.7%	100%	94.5%
src/commands/main-action.ts	95.5%	88.6%	100%	95.5%
src/services/cli-proxy-service.ts	95.5%	93.3%	100%	95.5%
src/parsers/volume-parsers.ts	95.8%	100%	100%	95.8%
src/container-lifecycle.ts	96.0%	88.1%	100%	95.8%
src/container-cleanup.ts	96.4%	100%	80.0%	95.8%
src/domain-patterns.ts	97.7%	95.4%	100%	97.6%
src/host-iptables-rules.ts	100%	98.4%	100%	100%
src/host-iptables.ts	100%	100%	100%	100%
src/squid-config.ts	100%	100%	100%	100%
src/docker-manager.ts	100%	100%	100%	100%

---

🔍 Notable Findings

1. src/logs/log-parser.ts — 67.1% branch coverage

The Squid log parser has many nested conditional branches for parsing IPv6 addresses, port extraction, and handling edge cases in CONNECT tunnel entries. Several uncovered branches are IPv6-specific (rawDest.startsWith('[')) and timestamp fallback paths (obj.ts numeric fallback). These cover real production log formats that could silently mis-parse.

2. src/services/agent-volumes/etc-mounts.ts — 67.8% branch coverage

The /etc bind-mount staging code has uncovered branches for the case where passwd/group files don't contain the current UID/GID (fileHasPasswdUid/fileHasGroupGid returning false). These are security-relevant paths that handle credential isolation for the agent container.

3. src/logs/audit-enricher.ts — 74.1% branch coverage (new file, added last 7 days)

The enrichWithPolicyRules and computeRuleStats functions have uncovered branches for regex-based ACL rules, the rule.aclName === 'all' deny case, and the unknownHits > 0 summary path. The transaction-end-before-headers error URL skip is also untested.

4. Flaky test: agent-volumes-mounts.test.ts

One test failed: should pre-resolve allowed domains into chroot-hosts file. The test hardcodes IP addresses for github.com (140.82.121.4) that didn't match the DNS response at test time (140.82.116.3). This is a DNS flakiness issue — the test should use a mock DNS resolver rather than doing live resolution.

---

📈 Recommendations

1. High — Fix flaky DNS test in src/services/agent-volumes-mounts.test.ts: mock dns.resolve4 instead of doing live resolution. The test will fail whenever GitHub's DNS round-robin returns a different IP than the hardcoded value.

2. High — Add IPv6 log-parsing tests to src/logs/log-parser.ts: add test cases with IPv6 destination addresses (e.g. [2606:4700::1]:443) and numeric ts timestamp fallback paths. These cover real Squid production log output.

3. Medium — Add tests for src/logs/audit-enricher.ts edge cases: regex ACL rules, the aclName === 'all' deny path, and the transaction-end-before-headers skip. This file was added in the last 7 days.

4. Low — Cover src/services/agent-volumes/etc-mounts.ts UID/GID mismatch branches: test the case where the staged passwd/group file doesn't contain the current user's UID/GID entry (security-relevant isolation path).

---

Generated by test-coverage-reporter workflow. Trigger: push. Run ID: 26987734842

Generated by Test Coverage Reporter · sonnet46 1.1M · ◷

• expires on Jun 12, 2026, 12:34 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through these halls. The omens are favorable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, and the firewall held its watch.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T00:34:50.271Z.

Closed by Workflow