Code Metrics¶

Generated: 2026-07-21 21:24 UTC

Lines of Code¶

	Files	Code	Comment	Blank	Total
Source	62	6 801	2 212	739	9 752
Tests	99	15 276	1 813	2 132	19 221
Combined	161	22 077	4 025	2 871	28 973

Comment/code ratio: 33%
Test/source ratio: 224.6%

Source by module (click to expand)

Module	Files	Code	Comment	Blank
`terok_shield/`	62	6 801	2 212	739
`terok_shield/cli/`	3	471	61	28
`terok_shield/cli/__main__.py`	—	8	11	2
`terok_shield/cli/main.py`	—	463	41	25
`terok_shield/dns/`	4	317	211	50
`terok_shield/dns/apparmor.py`	—	31	33	4
`terok_shield/dns/dnsmasq.py`	—	210	109	26
`terok_shield/dns/resolver.py`	—	76	61	19
`terok_shield/hooks/`	4	829	257	82
`terok_shield/hooks/install.py`	—	276	46	33
`terok_shield/hooks/mode.py`	—	530	184	44
`terok_shield/hooks/reader_install.py`	—	23	19	4
`terok_shield/nft/`	3	544	160	53
`terok_shield/nft/constants.py`	—	28	32	12
`terok_shield/nft/rules.py`	—	516	120	40
`terok_shield/podman_info/`	5	174	145	38
`terok_shield/podman_info/__init__.py`	—	20	15	3
`terok_shield/podman_info/_conf.py`	—	13	13	1
`terok_shield/podman_info/hooks_dir.py`	—	42	38	4
`terok_shield/podman_info/info.py`	—	59	55	19
`terok_shield/podman_info/network.py`	—	40	24	11
`terok_shield/resources/`	13	1 927	429	175
`terok_shield/resources/dns/`	7	101	3	24
`terok_shield/resources/_oci_state.py`	—	388	122	36
`terok_shield/resources/nflog_reader.py`	—	872	150	48
`terok_shield/resources/nft_hook.py`	—	158	89	35
`terok_shield/resources/reader_hook.py`	—	267	44	23
`terok_shield/resources/shield_probe.py`	—	141	18	8
`terok_shield/verbs/`	6	370	96	27
`terok_shield/verbs/__init__.py`	—	10	8	1
`terok_shield/verbs/_common.py`	—	51	16	7
`terok_shield/verbs/control.py`	—	147	19	2
`terok_shield/verbs/launch.py`	—	54	14	1
`terok_shield/verbs/observe.py`	—	82	26	1
`terok_shield/verbs/stream.py`	—	26	13	15
`terok_shield/watchers/`	6	355	146	50
`terok_shield/watchers/__init__.py`	—	12	14	3
`terok_shield/watchers/_event.py`	—	29	17	7
`terok_shield/watchers/audit_log.py`	—	41	16	9
`terok_shield/watchers/dns_log.py`	—	64	26	16
`terok_shield/watchers/domain_cache.py`	—	20	17	9
`terok_shield/watchers/nflog.py`	—	189	56	6
`terok_shield/__init__.py`	—	390	101	26
`terok_shield/_hub_events.py`	—	110	41	6
`terok_shield/_wire_sanitize.py`	—	41	23	6
`terok_shield/audit.py`	—	50	37	12
`terok_shield/commands.py`	—	90	8	1
`terok_shield/config.py`	—	117	74	29
`terok_shield/config_file.py`	—	33	23	2
`terok_shield/container.py`	—	86	36	5
`terok_shield/paths.py`	—	28	20	3
`terok_shield/prereqs.py`	—	27	38	15
`terok_shield/profiles.py`	—	44	39	13
`terok_shield/run.py`	—	248	29	11
`terok_shield/simple_clearance.py`	—	238	47	38
`terok_shield/state.py`	—	176	89	15
`terok_shield/subprocess_env.py`	—	15	15	2
`terok_shield/util.py`	—	21	6	8
`terok_shield/validation.py`	—	22	37	13
`terok_shield/watch.py`	—	78	44	31

Architecture¶

Module Dependency Graph¶

graph TD
    terok_shield.podman_info --> terok_shield.nft.constants
    terok_shield.state --> terok_shield.paths
    terok_shield.prereqs --> terok_shield.run
    terok_shield._hub_events --> terok_shield._wire_sanitize
    terok_shield._hub_events --> terok_shield.validation
    terok_shield.dns.apparmor --> terok_shield.dns.dnsmasq
    terok_shield.hooks.install --> terok_shield.hooks.reader_install
    terok_shield.hooks.mode --> terok_shield.dns.apparmor
    terok_shield.hooks.mode --> terok_shield.dns.dnsmasq
    terok_shield.hooks.mode --> terok_shield.hooks.install
    terok_shield.hooks.mode --> terok_shield.nft.rules
    terok_shield --> terok_shield.audit
    terok_shield --> terok_shield.profiles
    terok_shield --> terok_shield.watchers
    terok_shield.cli --> terok_shield.config_file
    terok_shield.config
    terok_shield.util
    terok_shield.validation
    terok_shield.paths
    terok_shield.run
    terok_shield._wire_sanitize
    terok_shield.nft
    terok_shield.nft.constants
    terok_shield.nft.rules
    terok_shield.dns
    terok_shield.dns.resolver
    terok_shield.dns.dnsmasq
    terok_shield.hooks
    terok_shield.hooks.reader_install
    terok_shield.audit
    terok_shield.profiles
    terok_shield.watchers
    terok_shield.config_file

Module Boundaries¶

27 modules, 15 dependency edges — all boundaries validated.

Module Summary¶

27 modules (click to expand)

Module	Deps	Description
`terok_shield.config`	0
`terok_shield.util`	0
`terok_shield.validation`	0
`terok_shield.podman_info`	1
`terok_shield.state`	1	Per-container state bundle layout — imports host-wide path constants
`terok_shield.paths`	0	Host-wide filesystem paths (reader script, hook entrypoint filename)
`terok_shield.run`	0	Subprocess helpers — zero internal deps
`terok_shield.prereqs`	1	the canonical sbin-aware binary lookup.
`terok_shield._hub_events`	2	Hub event emitter — stdlib-only client for the terok-clearance unix ingester
`terok_shield._wire_sanitize`	0	bypasses the package) can mirror the function inline.
`terok_shield.nft`	0	nft domain package
`terok_shield.nft.constants`	0	Security boundary — literals only, no dependencies
`terok_shield.nft.rules`	0	Security boundary — only stdlib + nft.constants
`terok_shield.dns`	0	dns domain package
`terok_shield.dns.resolver`	0	DNS resolution and caching
`terok_shield.dns.dnsmasq`	0	dnsmasq lifecycle — config generation, launch, cleanup
`terok_shield.dns.apparmor`	1	AppArmor confinement probe + dnsmasq-tier selection
`terok_shield.hooks`	0	hooks domain package
`terok_shield.hooks.install`	1	the OCI hook needs (entrypoint, both hook-JSON pairs, reader script).
`terok_shield.hooks.reader_install`	0	NFLOG reader resource installer
`terok_shield.hooks.mode`	4	Hook mode — OCI hooks, per-container netns
`terok_shield.audit`	0	Audit logging — no internal deps
`terok_shield.profiles`	0	Profile loading
`terok_shield.watchers`	0	Watchers — event-stream classes
`terok_shield`	3	Package root — public API facade
`terok_shield.config_file`	0	pull in pydantic; the sole importer is cli/main.py.
`terok_shield.cli`	1

Test Coverage¶

Overall line coverage: 99.5% (3514/3530 statements).

Each rectangle is a source file. Area is proportional to the number of statements; colour encodes the coverage percentage (green = fully covered, red = uncovered). Files are grouped by the first 3 directory levels.

Cognitive Complexity¶

Threshold: 15 (functions above this are listed below)

Functions analyzed: 398
Median complexity: 1.0 · Average: 2.6 · Max: 16
Within threshold (15): 99% (396/398)

    0–  3 │ ██████████████████████████████ 284 (71.4%)
    4–  6 │ ███████                         66 (16.6%)
    7–  9 │ ███                             25 ( 6.3%)
   10– 12 │ ██                              17 ( 4.3%)
   13– 15 │                                  4 ( 1.0%) ◄ threshold
   16– 18 │                                  2 ( 0.5%)

2 functions exceeding threshold:

Complexity	Function	File
16	`_read_installed_hook_version`	`src/terok_shield/__init__.py`
16	`DnsResolver::resolve_domains`	`src/terok_shield/dns/resolver.py`

Dead Code Analysis¶

No dead code found at 80% confidence threshold.

Docstring Coverage¶

Needed: 16; Found: 14; Missing: 2; Coverage: 87.5%
Needed: 499 - Found: 497 - Missing: 2
Total coverage: 99.6% - Grade: Excellent

Generated by scc, complexipy, vulture, tach, and docstr-coverage.