[Coverage Report] Test Coverage Report — 2026-05-12

[github-actions[bot]]

📊 Overall Coverage

Metric	Coverage	Threshold
Statements	89.77%	38% ✅
Branches	81.76%	30% ✅
Functions	92.02%	35% ✅
Lines	89.86%	38% ✅

Overall coverage is strong and well above all enforced thresholds.

---

🔴 Critical Gaps (< 50% statement coverage)

File	Statements	Branches	Functions
src/commands/main-action.ts	7.1%	0.0%	12.5%

main-action.ts is the top-level action dispatcher and is almost entirely uncovered. Its 0% branch coverage means no conditional paths have been exercised at all.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/subcommands.ts	50.0%	21.4%	41.7%
src/container-cleanup.ts	77.1%	79.2%	100%

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/squid-config.ts	100%	100%	100%	✅ Excellent
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Excellent
src/host-iptables-rules.ts	97.3%	93.0%	100%	✅ Excellent
src/host-iptables-cleanup.ts	100%	88.2%	100%	✅ Excellent
src/host-iptables-shared.ts	94.9%	90.0%	100%	✅ Good
src/cli.ts	85.7%	50.0%	100%	⚠️ Branch gap
src/docker-manager.ts	—	—	—	(refactored into services)

All primary security-critical files (Squid ACL generation, domain pattern matching, iptables rule generation) are at or above 94% statement coverage. The main concern is cli.ts with only 50% branch coverage.

---

📋 Full Coverage Table

Per-file breakdown (click to expand)

File	Stmt%	Branch%	Fn%	Lines%
src/commands/main-action.ts	7.1%	0.0%	12.5%	7.2%
src/commands/subcommands.ts	50.0%	21.4%	41.7%	50.0%
src/container-cleanup.ts	77.1%	79.2%	100%	77.5%
src/config-writer.ts	81.0%	62.5%	100%	81.0%
src/logs/audit-enricher.ts	83.6%	74.1%	100%	83.6%
src/logs/log-parser.ts	85.5%	65.6%	100%	85.5%
src/cli.ts	85.7%	50.0%	100%	85.7%
src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.2%
src/commands/logs-command-helpers.ts	88.5%	83.3%	100%	88.5%
src/services/doh-proxy-service.ts	88.9%	75.0%	100%	88.9%
src/cli-workflow.ts	88.9%	85.7%	100%	88.9%
src/commands/signal-handler.ts	89.5%	87.5%	71.4%	89.5%
src/services/agent-volumes.ts	89.7%	74.4%	100%	89.7%
src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.2%
src/cli-options.ts	93.0%	60.0%	25.0%	93.0%
src/squid/ssl-bump.ts	93.8%	91.7%	100%	93.8%
src/ssl-bump.ts	94.1%	88.5%	100%	94.1%
src/container-lifecycle.ts	94.2%	84.2%	100%	94.2%
src/logs/log-aggregator.ts	94.7%	87.5%	100%	94.7%
src/services/cli-proxy-service.ts	94.7%	93.3%	100%	94.7%
src/host-iptables-shared.ts	94.9%	90.0%	100%	94.9%
src/upstream-proxy.ts	94.9%	94.7%	100%	94.9%
src/pid-tracker.ts	96.3%	76.9%	100%	96.3%
src/host-iptables-rules.ts	97.3%	93.0%	100%	97.3%
src/logs/log-formatter.ts	97.4%	92.8%	100%	97.4%
src/services/agent-service.ts	97.6%	94.6%	100%	97.6%
src/domain-patterns.ts	97.7%	95.4%	100%	97.7%
src/services/agent-environment.ts	97.9%	92.5%	100%	97.9%
src/config-file.ts	98.0%	96.8%	87.5%	98.0%
src/rules.ts	98.3%	91.9%	100%	98.3%
src/host-env.ts	98.4%	93.2%	100%	98.4%
src/compose-generator.ts	98.5%	91.7%	100%	98.5%
src/services/api-proxy-service.ts	98.7%	94.6%	100%	98.7%
src/option-parsers.ts	99.0%	98.6%	100%	99.0%
src/host-iptables-cleanup.ts	100%	88.2%	100%	100%
src/commands/network-setup.ts	100%	87.0%	100%	100%
src/commands/preflight.ts	100%	78.4%	100%	100%
src/copilot-api-resolver.ts	100%	87.0%	100%	100%
src/logs/log-discovery.ts	100%	90.0%	100%	100%
src/squid-config.ts	100%	100%	100%	100%
src/logger.ts	100%	100%	100%	100%
src/cli-workflow.ts	100%	100%	100%	100%

---

🔍 Notable Findings

1. src/commands/main-action.ts (7.1% stmt, 0% branch) — The top-level action entry point has virtually no test coverage. This includes the GitHub Actions integration path and error handling for the entire command dispatch. Any bug here would be invisible to the test suite.

2. src/cli.ts branch coverage (50%) — All 10 functions are covered, but half the conditional branches are untested. This likely includes error recovery paths (failed container start, signal handling edge cases, cleanup on error) — all security-relevant scenarios.

3. src/commands/subcommands.ts (50% stmt, 21.4% branch) — Subcommand routing logic has very low branch coverage, meaning many command paths are never exercised in tests.

4. src/cli-options.ts function coverage (25%) — Only 1 of 4 exported functions is covered despite 93% statement coverage, suggesting some functions have a single linear path tested but other exported functions remain entirely untouched.

---

📈 Recommendations

1. High — src/commands/main-action.ts: Add integration or unit tests for the main action dispatcher. Focus on: normal invocation, error paths (container start failure, invalid config), and cleanup-on-exit. Even a few smoke tests would dramatically improve this 7% → 60%+.

2. High — src/cli.ts branch coverage: Add tests for the error branches: what happens when startContainers() throws, when the agent exits with non-zero code, or when SIGINT fires during startup. These are exactly the paths that fail silently in production.

3. Medium — src/commands/subcommands.ts: Cover the subcommand routing branches — particularly any switch/if dispatching to logs, stats, and summary sub-commands.

4. Low — src/container-cleanup.ts: 77% statement coverage with 100% function coverage suggests some cleanup error-handling branches (e.g., docker rm failure, partial cleanup) are not tested.

---

Generated by test-coverage-reporter workflow. Trigger: push · Run: 25755368378

Generated by Test Coverage Reporter · ● 283.8K · ◷

• expires on May 19, 2026, 6:59 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-05-19T18:59:06.169Z.

Closed by Workflow