[Coverage Report] Test Coverage Report — 2026-06-23

[github-actions[bot]]

Coverage Summary

Run date: 2026-06-23 · Commit on main

Metric	Covered	Total	%
Lines	4,990	5,087	98.09 %
Statements	5,160	5,264	98.02 %
Branches	2,879	3,070	93.77 %
Functions	627	630	99.52 %

Overall line and function coverage is excellent. Branch coverage at 93.77 % is the only dimension below 98 % and is the focus of this report.

---

Security-Critical File Breakdown

File	Lines %	Branches %	Notes
src/host-iptables.ts (facade)	100 %	100 %	Re-export; real logic in sub-modules
src/host-iptables-rules.ts	100 %	100 %	✅ Full coverage
src/host-iptables-chain.ts	95.23 %	80 %	2/10 branches uncovered
src/host-iptables-shared.ts	100 %	100 %	✅ Full coverage
src/host-iptables-validation.ts	100 %	96.87 %	✅ Strong coverage
src/squid-config.ts (facade)	100 %	100 %	Re-export; real logic in sub-modules
src/squid/access-rules.ts	100 %	100 %	✅ Full coverage
src/squid/acl-generator.ts	100 %	100 %	✅ Full coverage
src/squid/config-sections.ts	100 %	82.75 %	5/29 branches uncovered
src/squid/domain-acl.ts	100 %	100 %	✅ Full coverage
src/squid/validation.ts	100 %	100 %	✅ Full coverage
src/docker-manager.ts (facade)	100 %	100 %	Re-export
src/domain-patterns.ts	100 %	89.47 %	2/19 branches uncovered
src/cli.ts	85.71 %	50 %	1/2 branches uncovered

---

Top Coverage Gaps (Branch Coverage)

Files sorted by branch coverage, excluding test-utility files:

File	Lines %	Branch %	Uncovered branches
src/services/agent-volumes/etc-mounts.ts	82.45 %	67.85 %	9/28
src/cli.ts	85.71 %	50 %	1/2
src/services/api-proxy-service.ts	91.66 %	50 %	1/2
src/workdir-setup.ts	94.54 %	79.62 %	11/54
src/host-iptables-chain.ts	95.23 %	80 %	2/10
src/pid-tracker.ts	98.7 %	80.76 %	5/26
src/config-writer.ts	85.71 %	80.55 %	7/36
src/squid/config-sections.ts	100 %	82.75 %	5/29
src/ssl-bump.ts	94.05 %	83.33 %	4/24

---

Notable Findings

• src/services/agent-volumes/etc-mounts.ts has the most critical branch gap (67.85 %) — this module decides which /etc files are bind-mounted into the agent container, intentionally excluding sensitive paths like /etc/shadow. Nine of 28 decision branches are untested, meaning edge cases in the exclusion logic (e.g. missing optional files, DinD path-prefix translation) may silently fail, potentially exposing sensitive host files.

• src/cli.ts branch coverage is 50 % — the main CLI entry point has a single untested branch. Although the file is tiny (7 lines, 2 branches), the uncovered path is in the top-level initialization/error flow. If that path triggers unexpectedly in production, it is entirely untested.

• Squid configuration has 5 uncovered branches in src/squid/config-sections.ts — this module assembles the Squid proxy config that enforces domain ACL filtering. The 17.25 % uncovered branches likely correspond to optional configuration sections (e.g. upstream proxy passthrough, SSL-bump toggles). A misconfigured or bypassed section could weaken HTTP/HTTPS egress control.

• Overall quality is high — 98.09 % line coverage across 5,087 lines and 99.52 % function coverage indicate a mature test suite. All iptables-rule generation modules (host-iptables-rules.ts, host-iptables-shared.ts), domain ACL modules (squid/access-rules.ts, squid/acl-generator.ts, squid/domain-acl.ts), and the domain validation stack are at 100 %.

---

Recommendations

🔴 High — Harden etc-mounts.ts branch coverage (67.85 % → ≥ 90 %)

src/services/agent-volumes/etc-mounts.ts controls which host /etc files are exposed to the agent. Add unit tests covering:

• Optional file paths that may not exist on the host (e.g. /etc/alternatives, /etc/ld.so.cache)
• Behaviour when --docker-host-path-prefix is set (DinD path translation through normalizeDockerHostPathPrefix)
• The conditional logic that excludes /etc/shadow and other sensitive files

This is the most security-sensitive untested path in the codebase because a logic error could silently mount credentials into the agent environment.

🟡 Medium — Cover cli.ts and host-iptables-chain.ts error branches

src/cli.ts (50 % branches): The untested branch is in the top-level entry-point boot flow. Add a test that exercises the failure/short-circuit path (e.g. invalid command, missing config) to ensure errors surface cleanly rather than silently succeeding.

src/host-iptables-chain.ts (80 % branches): Two of ten decision branches in the iptables-chain setup module are uncovered. These likely guard rollback or cleanup paths. Add tests that simulate iptables-chain creation failures to confirm the firewall doesn't enter a partially-configured state.

🟢 Low — Improve branch coverage in Squid config assembly and workdir setup

src/squid/config-sections.ts (82.75 %): Five branches covering optional Squid config sections (upstream proxy, SSL-bump mode) are untested. Add targeted unit tests for configs with and without each optional feature enabled.

src/workdir-setup.ts (79.62 %): Eleven branches are uncovered in the temporary work-directory setup. Test failure paths such as mkdir errors, pre-existing directories, and cleanup on early exit to ensure the firewall doesn't leave stale state in /tmp.

Generated by Test Coverage Reporter · 47.8 AIC · ⊞ 4.6K · ◷

• expires on Jun 30, 2026, 10:53 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-30T22:53:01.112Z.

Closed by Workflow