[Coverage Report] Test Coverage Report — 2026-05-29

[github-actions[bot]]

Overall Coverage

Metric	Coverage
Statements	96.49%
Branches	90.81%
Functions	98.24%
Lines	96.62%

Overall coverage is excellent. No files fall below 50% statement coverage.

---

🔴 Critical Gaps (< 50% statement coverage)

None — all 138 source files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.66%	50.00%	100%
src/logs/audit-enricher.ts	83.60%	74.13%	100%
src/cli.ts	85.71%	50.00%	100%
src/logs/log-parser.ts	86.90%	67.14%	100%
src/squid/policy-manifest.ts	87.23%	88.23%	70%
src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%
src/commands/logs-command-helpers.ts	88.52%	83.33%	100%
src/services/doh-proxy-service.ts	90.00%	75.00%	100%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions
src/host-iptables.ts	✅ 100%	✅ 100%	✅ 100%
src/squid-config.ts	✅ 100%	✅ 100%	✅ 100%
src/docker-manager.ts	✅ 100%	✅ 100%	✅ 100%
src/domain-patterns.ts	✅ 97.67%	✅ 95.38%	✅ 100%
src/cli.ts	🟡 85.71%	🔴 50.00%	✅ 100%
src/host-iptables-rules.ts	✅ 97.67%	✅ 96.82%	✅ 100%

All four primary security-critical files (host-iptables.ts, squid-config.ts, docker-manager.ts, domain-patterns.ts) are at or near full coverage. The only notable gap is cli.ts branch coverage at 50%, which includes the if (require.main === module) guard — not exercisable by unit tests.

---

📋 Recently Modified Files (past 7 days)

All recently changed files have been covered by corresponding test updates:
src/cli.ts, src/cli-options.ts, src/cli-workflow.ts, src/api-proxy-config.ts, src/commands/logs*.ts, src/commands/build-config.ts, src/commands/logs-audit.ts

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — branch coverage 50%: The validateNetworkOptions function has several warning-path branches (external Docker host detection, missing path prefix warnings) that aren't exercised. These cover security-relevant configuration validation paths.

2. src/cli.ts — branch coverage 50%: The uncovered branch is the if (require.main === module) entry-point guard, which is structurally untestable in unit tests. Not a real gap, but inflates the apparent miss rate.

3. src/logs/log-parser.ts — branch coverage 67%: Log parsing has several conditional paths for malformed/unexpected Squid log line formats. Uncovered paths mean edge-case log entries (e.g., unusual status codes, truncated lines) might silently produce incorrect aggregation results in awf logs stats / awf logs summary.

4. src/squid/policy-manifest.ts — function coverage 70%: Three functions in this file lack test coverage. Given this is part of the Squid policy generation path, missing function coverage here could mask regressions in policy construction.

---

📈 Recommendations

1. High: Add tests for src/commands/validators/network-options.ts warning branches — particularly the external Docker host and missing path prefix paths. These validate critical network isolation configuration and are currently at 50% branch coverage.

2. High: Add edge-case tests for src/logs/log-parser.ts — malformed Squid log lines, unknown status codes, truncated entries. Incorrect parsing silently corrupts coverage reports and audit trails.

3. Medium: Cover the missing functions in src/squid/policy-manifest.ts (currently 70% function coverage). This is in the Squid ACL generation path and regressions here could allow unintended domain access.

4. Low: src/services/agent-volumes/docker-host-staging.ts branch coverage is 72%. Add tests for the DinD split-filesystem edge cases (path prefix translation with kernel VFS exclusions).

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 26637290251

Generated by Test Coverage Reporter · sonnet46 574K · ◷

• expires on Jun 5, 2026, 12:34 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent walked this thread and the omens were recorded.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-05T12:34:12.571Z.

Closed by Workflow