refactor: remove dead exports flagged by export audit

[lpcox]

Summary

Addresses three [Export Audit] issues by removing or namespacing dead exports.

Changes

containers/api-proxy/providers/copilot.js (closes #2752)

• Moved 5 internal helpers (stripBearerPrefix, resolveCopilotAuthToken, deriveCopilotApiTarget, deriveGitHubApiTarget, deriveGitHubApiBasePath) from top-level exports to a _testing namespace
• Updated test imports in server.auth.test.js and server.routing.test.js

containers/api-proxy/providers/opencode.js (closes #2756)

• Moved resolveOpenCodeRoute from top-level export to _testing namespace
• Updated test import in server.routing.test.js

src/types/docker.ts (closes #2746)

• Removed export keyword from DockerService, DockerNetwork, DockerVolume interfaces — these are @internal sub-types used only within DockerComposeConfig in the same file and never imported elsewhere
• Removed stale comment in src/types/index.ts

Testing

• All 129 api-proxy tests pass
• TypeScript build clean
• Schema sync test passes

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	87.48%	87.55%	📈 +0.07%
Statements	87.44%	87.51%	📈 +0.07%
Functions	82.66%	82.66%	➡️ +0.00%
Branches	79.65%	79.69%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/container-lifecycle.ts	87.1% → 88.2% (+1.14%)	87.5% → 88.6% (+1.11%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

This PR reduces the repository’s exposed API surface by removing or namespacing exports that are only used by unit tests, and by making internal-only Docker Compose sub-types non-exported.

Changes:

• Moved Copilot/OpenCode provider helper functions from top-level CommonJS exports into a _testing namespace and updated api-proxy unit tests accordingly.
• Made DockerService, DockerNetwork, and DockerVolume interfaces file-internal within src/types/docker.ts and removed a now-stale barrel comment.
• Updated the environment merge precedence wording in src/awf-config-schema.json.

Show a summary per file

File	Description
src/types/index.ts	Removes stale barrel comment referencing Docker sub-types that are no longer intended for direct import.
src/types/docker.ts	Converts Docker Compose sub-type interfaces to non-exported/internal declarations.
src/awf-config-schema.json	Adjusts schema description text for environment merge precedence.
containers/api-proxy/server.routing.test.js	Updates test imports to read provider helpers from _testing namespace.
containers/api-proxy/server.auth.test.js	Updates test imports to read auth helpers from _testing namespace.
containers/api-proxy/providers/opencode.js	Namespaces resolveOpenCodeRoute under _testing instead of exporting it top-level.
containers/api-proxy/providers/copilot.js	Namespaces internal Copilot helper exports under _testing instead of exporting them top-level.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 7/7 changed files
• Comments generated: 1

[github-actions]

Smoke test: FAIL
✅ docs: add missing apiProxy CLI mappings and sync schema descriptions
✅ docs: proofread AWF config spec for W3C-style conformance
❌ safeinputs-gh / github-discussion-query unavailable
✅ Playwright, file, bash, discussion comment, build
❌ Tavily search unavailable (no registered tools)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke Test Results

✅ GitHub MCP: Last 2 merged PRs retrieved
✅ Playwright: GitHub page title verified
✅ File Writing: Test file created
✅ Bash Tool: File verification passed

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🧪 Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.14.1	v20.20.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: FAILED — Python and Node.js versions differ between host and chroot. Go matches.

Tested by Smoke Chroot

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2762 · ● 667.8K · ◷

[lpcox]

@copilot investigate this failed ci check https://github.com/github/gh-aw-firewall/actions/runs/25577465450/job/75088082592?pr=2762

[Copilot]

@copilot investigate this failed ci check https://github.com/github/gh-aw-firewall/actions/runs/25577465450/job/75088082592?pr=2762

I checked that failed run/job. The failure is in step “Execute GitHub Copilot CLI” and it’s a timeout, not a test/build error:

• ##[error]The action 'Execute GitHub Copilot CLI' has timed out after 15 minutes.
• The agent made early MCP calls (list_pull_requests, pull_request_read) and then produced no further progress before timing out.
• Firewall/network blocking does not appear to be the cause (summary shows 6 allowed / 0 blocked, domain api.githubcopilot.com).

So this looks like a stuck/slow agent run in the smoke workflow rather than a regression from the export-audit code changes. A rerun of the check should be the next step.

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ PASS — fetched PR list successfully
GitHub.com HTTP connectivity	⚠️ UNKNOWN — pre-step output not expanded
File write/read	⚠️ UNKNOWN — pre-step output not expanded

PR under test: "refactor: remove dead exports flagged by export audit" by @lpcox

Overall: PARTIAL — MCP connectivity confirmed; pre-step template variables were not expanded so HTTP and file tests could not be verified.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list PRs)	✅ PR #2770 retrieved
GitHub.com HTTP	⚠️ Pre-step data not expanded
File write/read	⚠️ Pre-step data not expanded
BYOK inference (this response)	✅ api-proxy → api.githubcopilot.com

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

PR author: @lpcox · Assignees: @lpcox, @Copilot

Overall: PARTIAL PASS (BYOK path confirmed; pre-step variables not expanded in workflow template)

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout/no response
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Failed

Overall: FAIL — host.docker.internal is not reachable from this runner. Service containers may not be configured or the host alias is not resolving.

🔌 Service connectivity validated by Smoke Services