[Coverage Report] Test Coverage Report — 2026-05-09

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage
Statements	87.51% (3527/4030)
Branches	79.69% (1841/2310)
Functions	82.66% (372/450)
Lines	87.55% (3420/3906)

Test suite: 49 test files · 56 source files · all suites passing

---

🔴 Critical Gaps (< 50% statement coverage)

File	Statements	Branches	Functions
src/cli.ts	28.6%	5.3%	11.6%

cli.ts is the main entry point and orchestration layer — it coordinates argument parsing, container lifecycle, and signal handling, yet only 11.6% of its functions are exercised. This is the single largest coverage risk.

---

🟡 Low Coverage (50–79%)

File	Statements	Branches	Functions
src/container-cleanup.ts	77.1%	5.3%	100%

Branch coverage for container-cleanup.ts is extremely low (5.3%) despite 100% function coverage — conditional error-handling paths are almost entirely untested.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	88.5%	74.1%	100%	🟡 Branch gap
src/squid-config.ts	97.0%	94.2%	100%	✅
src/docker-manager.ts	100%	100%	96.5%	✅
src/domain-patterns.ts	97.7%	95.4%	100%	✅

host-iptables.ts has solid statement coverage but branch coverage at 74.1% — some conditional iptables rule paths (e.g. IPv6 handling, optional apiProxyIp/dohProxyIp, hostAccess configs) are not fully exercised.

---

📋 Full Per-File Coverage Table

File	Statements	Branches	Functions
src/cli.ts	28.6%	5.3%	11.6%
src/container-cleanup.ts	77.1%	5.3%	100%
src/logs/audit-enricher.ts	83.6%	74.1%	100%
src/logs/log-parser.ts	86.9%	68.6%	100%
src/host-iptables.ts	88.5%	74.1%	100%
src/commands/logs-command-helpers.ts	88.5%	81.0%	100%
src/container-lifecycle.ts	88.6%	77.2%	100%
src/cli-workflow.ts	88.9%	85.7%	100%
src/services/doh-proxy-service.ts	88.9%	75.0%	100%
src/services/agent-volumes.ts	91.8%	73.2%	100%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%
src/ssl-bump.ts	94.1%	88.5%	100%
src/logs/log-aggregator.ts	94.7%	87.5%	100%
src/services/cli-proxy-service.ts	94.7%	93.3%	100%
src/upstream-proxy.ts	94.9%	94.7%	100%
src/squid-config.ts	97.0%	94.2%	100%
src/pid-tracker.ts	97.3%	66.7%	100%
src/logs/log-formatter.ts	97.4%	92.8%	100%
src/services/agent-service.ts	97.6%	94.6%	100%
src/domain-patterns.ts	97.7%	95.4%	100%
src/services/agent-environment.ts	97.8%	92.2%	100%
src/config-file.ts	98.0%	96.8%	87.5%
src/rules.ts	98.3%	91.9%	100%
src/host-env.ts	98.4%	93.2%	100%
src/services/api-proxy-service.ts	98.5%	91.7%	100%
src/compose-generator.ts	98.5%	93.6%	100%
src/option-parsers.ts	99.4%	99.2%	100%
src/api-proxy-config.ts	100%	100%	100%
src/docker-manager.ts	100%	100%	96.5%
src/domain-utils.ts	100%	100%	100%
src/dlp.ts	100%	100%	100%
src/squid-config.ts	100%	100%	100%
(+ other 100% files)	100%	90–100%	100%

---

🔍 Notable Findings

1. src/cli.ts — entry point almost untested (28.6% stmt, 5.3% branch): The main orchestration function, signal handlers (SIGINT/SIGTERM), and most CLI sub-command actions lack test coverage. Given 105 source files changed in the past 7 days and many additions flowing through cli.ts, this gap is growing.

2. src/container-cleanup.ts — error branches dark (77.1% stmt, 5.3% branch): Every function is called at least once, but conditional error paths (e.g. Docker API failures, timeout handling) are essentially untested. These are exactly the paths that matter during incident recovery.

3. src/host-iptables.ts — optional parameter branches uncovered (88.5% stmt, 74.1% branch): setupHostIptables accepts optional apiProxyIp, dohProxyIp, hostAccess, and cliProxyConfig parameters. Combinations of these flags likely contain untested iptables rule generation paths that directly affect network isolation correctness.

4. src/logs/log-parser.ts — branch coverage 68.6%: Log parsing is exercised for happy paths, but malformed log line handling and edge-case timestamp/field formats are not covered. Incorrect parsing here could silently drop or mis-attribute firewall events.

---

📈 Recommendations

1. High — cli.ts integration tests: Add integration-style tests using Commander's .parseAsync() with mocked DockerManager/startContainers to cover the main action handler, --help, signal handling, and error exits. This is the fastest lever for overall coverage improvement.

2. High — container-cleanup.ts error injection: The branch gap (5.3%) means virtually no error-path testing. Add unit tests that mock execa to throw/reject, covering Docker removal failures, network teardown errors, and timeout scenarios.

3. Medium — host-iptables.ts optional parameter combinations: Add parameterized tests for setupHostIptables covering: apiProxyIp present/absent, dohProxyIp present/absent, IPv6 enabled/disabled, hostAccess custom ranges. These branches control actual firewall rules.

4. Low — src/logs/log-parser.ts malformed input: Add unit tests for truncated lines, missing fields, non-numeric timestamps, and Squid log format variations to harden the audit trail.

---

Generated by test-coverage-reporter workflow · Trigger: push · 2026-05-09

Generated by Test Coverage Reporter · ● 234K · ◷

• expires on May 16, 2026, 11:36 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-05-16T23:36:05.249Z.

Closed by Workflow