From 46e54ad2d6cc99d84c1d6e8efaab2dccad227d16 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 18 Jul 2026 08:43:22 +0000
Subject: [PATCH 1/2] test: cover rethrow branch in
 checkPermissionsAndSetupChain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a test for the case where iptables --version fails with a
non-ENOENT error, causing the error to be re-thrown as-is (line 13
of host-iptables-chain.ts). This was the only uncovered branch in
the host-iptables module (~97.61% → 100% branch coverage).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/host-iptables-chain-branches.test.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/host-iptables-chain-branches.test.ts b/src/host-iptables-chain-branches.test.ts
index 8c880dd47..f4131a301 100644
--- a/src/host-iptables-chain-branches.test.ts
+++ b/src/host-iptables-chain-branches.test.ts
@@ -33,6 +33,21 @@ describe('host-iptables-chain branch coverage', () => {
   // ENOENT / "not found" error.  This path re-throws as a user-readable
   // "iptables is required but was not found" message.
   // -------------------------------------------------------------------------
+  // -------------------------------------------------------------------------
+  // checkPermissionsAndSetupChain – iptables --version fails with a non-ENOENT
+  // error (e.g. unexpected system error).  This path re-throws the original error.
+  // -------------------------------------------------------------------------
+  describe('checkPermissionsAndSetupChain – iptables --version fails with non-ENOENT error', () => {
+    it('rethrows the original error when iptables --version fails for a non-missing-command reason', async () => {
+      const originalError = new Error('Unexpected iptables failure');
+      mockedExeca
+        // iptables --version — fails with a non-ENOENT error
+        .mockRejectedValueOnce(originalError);
+
+      await expect(checkPermissionsAndSetupChain('FW_TEST')).rejects.toThrow('Unexpected iptables failure');
+    });
+  });
+
   describe('checkPermissionsAndSetupChain – DOCKER-USER check fails with ENOENT', () => {
     it('throws a user-readable message when DOCKER-USER list reports iptables not found', async () => {
       mockedExeca

From 54914a217efac6f0bebb3bae870f0b020b73c5d8 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Sat, 18 Jul 2026 08:38:29 -0700
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/host-iptables-chain-branches.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/host-iptables-chain-branches.test.ts b/src/host-iptables-chain-branches.test.ts
index f4131a301..3deeec0eb 100644
--- a/src/host-iptables-chain-branches.test.ts
+++ b/src/host-iptables-chain-branches.test.ts
@@ -44,7 +44,7 @@ describe('host-iptables-chain branch coverage', () => {
         // iptables --version — fails with a non-ENOENT error
         .mockRejectedValueOnce(originalError);
 
-      await expect(checkPermissionsAndSetupChain('FW_TEST')).rejects.toThrow('Unexpected iptables failure');
+      await expect(checkPermissionsAndSetupChain('FW_TEST')).rejects.toBe(originalError);
     });
   });