[Coverage Report] Test Coverage Report — 2026-05-08

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Status
Statements	87.51%	🟢 Good
Branches	79.69%	🟡 Acceptable
Functions	82.66%	🟢 Good
Lines	87.55%	🟢 Good

49 test files covering 56 source files.

---

🔴 Critical Gaps (< 50% statement coverage)

File	Statements	Branches	Functions
src/cli.ts	28.6%	5.3%	11.6%

cli.ts is the main entry point and orchestration layer. It has 1,200+ lines with only ~5% branch coverage, meaning nearly all argument parsing, validation logic, and command dispatch paths are untested.

---

🟡 Low Coverage (50–79% statement coverage)

None — all other files exceed 77%.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	88.5%	74.1%	100%	🟡 Branches need attention
src/squid-config.ts	97.0%	94.2%	88.0%	🟢 Well covered
src/docker-manager.ts	(re-exported module)	—	—	—
src/domain-patterns.ts	97.7%	95.4%	100%	🟢 Well covered
src/cli.ts	28.6%	5.3%	11.6%	🔴 Critical gap

host-iptables.ts branch coverage at 74.1% — 18 branches total, ~5 uncovered. These likely include IPv6 path handling, error recovery in ensureFirewallNetwork(), and edge cases in cleanupHostIptables().

---

📋 Full Coverage Table

File	Stmts	Branches	Funcs	Lines
src/cli.ts	28.6%	5.3%	11.6%	28.6%
src/container-cleanup.ts	77.1%	79.2%	100%	77.1%
src/logs/audit-enricher.ts	83.6%	74.1%	100%	83.6%
src/logs/log-parser.ts	86.9%	68.6%	100%	86.9%
src/host-iptables.ts	88.5%	74.1%	100%	88.5%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%	88.5%
src/container-lifecycle.ts	88.6%	77.2%	100%	88.6%
src/services/doh-proxy-service.ts	88.9%	75.0%	100%	88.9%
src/cli-workflow.ts	88.9%	85.7%	100%	88.9%
src/services/agent-volumes.ts	91.8%	73.2%	100%	91.8%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.2%
src/ssl-bump.ts	94.1%	88.5%	100%	94.1%
src/logs/log-aggregator.ts	94.7%	87.5%	100%	94.7%
src/services/cli-proxy-service.ts	94.7%	93.3%	100%	94.7%
src/upstream-proxy.ts	94.9%	94.7%	100%	94.9%
src/squid-config.ts	97.0%	94.2%	88.0%	97.0%
src/pid-tracker.ts	97.3%	66.7%	100%	97.3%
src/logs/log-formatter.ts	97.4%	92.8%	100%	97.4%
src/services/agent-service.ts	97.6%	94.6%	100%	97.6%
src/domain-patterns.ts	97.7%	95.4%	100%	97.7%
src/services/agent-environment.ts	97.8%	92.2%	100%	97.8%
src/config-file.ts	98.0%	96.8%	87.5%	98.0%
src/rules.ts	98.3%	91.9%	100%	98.3%
src/host-env.ts	98.4%	93.2%	100%	98.4%
src/compose-generator.ts	98.5%	93.6%	100%	98.5%
src/services/api-proxy-service.ts	98.5%	91.7%	100%	98.5%
src/option-parsers.ts	99.4%	99.2%	100%	99.4%
src/copilot-api-resolver.ts	100%	87.0%	100%	100%
src/logs/log-discovery.ts	100%	90.0%	100%	100%
src/logger.ts	100%	90.9%	100%	100%

---

🔍 Notable Findings

1. src/cli.ts is nearly untested (28.6% stmts, 5.3% branches) — This 1,200+ line file is the orchestration layer for all flag parsing, validation, and command dispatch. Recent additions include validateFormat() and handlePredownloadAction(). With only ~1 in 20 branches covered, any regression in argument validation would go undetected.

2. src/host-iptables.ts branch coverage at 74.1% — All 5 exported functions are called in tests, but ~5 branches remain uncovered. These are likely IPv6 detection paths (_resetIpv6State, ip6tables availability checks) and error recovery paths in cleanupHostIptables() when rules don't exist.

3. src/logs/log-parser.ts branch coverage at 68.6% — Log parsing handles malformed/partial log lines from Squid. Uncovered branches are likely malformed-input paths. For a security tool, unhandled log formats could silently hide blocked/allowed traffic from reports.

4. src/pid-tracker.ts branch coverage at 66.7% — Despite 97% statement coverage, the low branch figure suggests conditional cleanup paths (e.g., process-already-dead, file-not-found) are not exercised, which could cause cleanup failures to go undetected.

---

📈 Recommendations

1. High — src/cli.ts integration tests: Add tests covering the main argument parsing paths (--allow-domains, --enable-api-proxy, --dns-servers), validation functions (validateFormat, validateApiProxyConfig), and the predownload subcommand. A commander test harness or a CLI smoke-test approach would rapidly increase branch coverage here.

2. High — src/host-iptables.ts IPv6 branches: Mock execSync to simulate IPv6 unavailability in tests, covering the _resetIpv6State path and the ip6tables-not-found code paths in setupHostIptables(). This is security-critical: an uncovered IPv6 path could allow firewall bypass.

3. Medium — src/logs/log-parser.ts malformed input paths: Add unit tests with truncated, malformed, or empty log lines to cover the remaining 31% of branches. This protects against silent log-parsing failures that would make coverage/audit reports unreliable.

4. Low — src/pid-tracker.ts cleanup edge cases: Test the ENOENT (file-not-found) and already-dead-process branches to ensure cleanup doesn't throw when called on a process that has already exited.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · ● 302.7K · ◷

• expires on May 15, 2026, 4:12 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-05-15T04:12:27.078Z.

Closed by Workflow