[Coverage Report] Test Coverage Report — 2026-06-27

[github-actions[bot]]

Overall Coverage (2026-06-27)

Metric	Coverage	Covered / Total
Statements	98.21% ✅	5,283 / 5,379
Branches	94.00% ✅	2,980 / 3,170
Functions	99.53% ✅	643 / 646
Lines	98.28% ✅	5,113 / 5,202

171 test files — latest commit: 50a0d584 (refactor artifact cleanup, extract OIDC auth helpers)

---

Security-Critical File Coverage

File	Statements	Branches	Functions	Status
host-iptables.ts	100%	100%	100%	✅
host-iptables-rules.ts	100%	100%	100%	✅
host-iptables-shared.ts	100%	100%	100%	✅
host-iptables-validation.ts	100%	96.87%	100%	✅
host-iptables-chain.ts	97.61%	90.00%	100%	✅
squid-config.ts	100%	100%	100%	✅
squid/config-sections.ts	100%	82.75%	100%	⚠️
docker-manager.ts	100%	100%	100%	✅
domain-patterns.ts	100%	89.47%	100%	⚠️
domain-validation.ts	100%	100%	100%	✅
domain-matchers.ts	98.14%	95.00%	100%	✅
cli.ts	85.71%	50.00%	100%	⚠️

---

Top Coverage Gaps (by uncovered branches)

File	Branch Coverage	Uncovered	Notes
config-writer.ts	78.94%	8 / 38	Writes squid.conf + docker-compose.yml
workdir-setup.ts	79.62%	11 / 54	Work-directory lifecycle management
logs/log-parser.ts	84.28%	11 / 70	Squid access-log parsing
squid/config-sections.ts	82.75%	5 / 29	Domain ACL generation (security-critical)
ssl-bump.ts	83.33%	4 / 24	TLS inspection / SSL-bump config
host-env.ts	80.00%	4 / 20	Host environment detection
pid-tracker.ts	80.76%	5 / 26	Process tracking
domain-patterns.ts	89.47%	2 / 19	Domain pattern matching (security-critical)
host-iptables-chain.ts	90.00%	1 / 10	iptables chain management
cli.ts	50.00%	1 / 2	Entry-point branch (small file, 7 stmts)

---

Notable Findings

• Security-critical statement coverage is excellent. All five key modules — host-iptables.ts, squid-config.ts, docker-manager.ts, domain-patterns.ts, and domain-validation.ts — are at 100% statement and function coverage. No regressions detected in the firewall core.
• squid/config-sections.ts has 5 uncovered branches (82.75%). This file generates the domain ACL sections that drive Squid's allow/deny decisions. Untested branches here can silently mis-generate ACL rules, allowing or blocking traffic incorrectly.
• config-writer.ts has 8 uncovered branches (78.94%). This module writes squid.conf and docker-compose.yml to disk. The uncovered branches likely include error-handling paths for permission failures and disk-full conditions — exactly the scenarios that matter in a sandboxed environment.
• cli.ts has 50% branch coverage — one of its two branches is untested. The file is small (7 statements), but the entry point is where --enable-api-proxy and similar security flags are toggled; missed branches here can mask misconfiguration.

---

Recommendations

🔴 High Priority

1. Cover error paths in config-writer.ts (78.94% branches, 8 gaps).
   Add tests that simulate EACCES/ENOSPC errors during squid.conf and docker-compose.yml writes. These are the last mile before containers start; silent failures here leave the agent unprotected.

2. Close branch gaps in squid/config-sections.ts (82.75%, 5 gaps).
   The missing branches are in the domain-ACL generation logic — the exact code path that translates --allow-domains into Squid acl / http_access directives. Add tests for edge cases: empty domain list, wildcard-only list, and domains with/without leading dot.

🟡 Medium Priority

3. Improve workdir-setup.ts branch coverage (79.62%, 11 gaps).
   This file manages the lifecycle of /tmp/awf-<ts>/ work directories. Untested branches likely cover cleanup-on-failure and concurrent-run scenarios. Add tests for pre-existing workdir, cleanup after signal interruption, and DinD path-prefix translation.

🟢 Low Priority

4. Close the 2-branch gap in domain-patterns.ts (89.47%).
   Domain-pattern matching is security-critical, but statement and function coverage are already at 100%. Target the 2 uncovered branches (likely edge cases in subdomain vs. exact-match logic) to reach 100% branch coverage on this module.

---

All files with branch coverage < 95%

File	Branches	Stmts
cli.ts	50.00%	85.71%
config-writer.ts	78.94%	82.79%
workdir-setup.ts	79.62%	94.54%
host-env.ts	80.00%	94.11%
pid-tracker.ts	80.76%	98.78%
squid/config-sections.ts	82.75%	100%
ssl-bump.ts	83.33%	93.26%
commands/logs-command-helpers.ts	83.33%	88.52%
commands/preflight.ts	83.78%	100%
logs/log-parser.ts	84.28%	100%
services/agent-volumes/workspace-mounts.ts	85.00%	96.29%
commands/network-setup.ts	86.95%	100%
domain-patterns.ts	89.47%	100%
commands/main-action.ts	89.18%	94.87%
host-iptables-chain.ts	90.00%	97.61%
logger.ts	90.90%	100%
compose-generator.ts	91.66%	98.66%
dns-resolver.ts	91.66%	100%
api-proxy-config-domains.ts	93.10%	98.85%
cli-options.ts	93.33%	100%
compose-sanitizer.ts	93.33%	97.14%
host-iptables-validation.ts	96.87%	100%

Generated by Test Coverage Reporter · 62.7 AIC · ⊞ 4.7K · ◷

• expires on Jul 4, 2026, 4:33 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-04T16:33:41.453Z.

Closed by Workflow