Remove internal-only interfaces and inline return types in `src/cli.ts` by Copilot · Pull Request #2435 · github/gh-aw-firewall

Copilot · 2026-05-03T13:54:17Z

Four interfaces used solely as return types for internal helpers (parseEnvironmentVariables, parseVolumeMounts) were unnecessarily exported, widening the public API surface with unstable implementation details. Additionally, having unexported interfaces referenced by name in exported function signatures is misleading to external consumers.

Changes

src/cli.ts: Removed ParseEnvResult, ParseEnvError, ParseVolumeMountsResult, and ParseVolumeMountsError entirely, replacing them with inline discriminated-union types directly in the exported function signatures.

// Before
export interface ParseEnvResult { ... }
export interface ParseEnvError { ... }
export function parseEnvironmentVariables(envVars: string[]): ParseEnvResult | ParseEnvError

// After
export function parseEnvironmentVariables(
  envVars: string[]
): { success: true; env: Record<string, string> } | { success: false; invalidVar: string }

No named internal types appear in the exported API surface. TypeScript discriminant narrowing is preserved in all call sites, and the functions remain exported for test use.

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/bc9df357-7482-49d1-a6ba-892014a7c40e Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-05-03T23:00:01Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.76%	85.77%	➡️ +0.01%
Statements	85.64%	85.71%	📈 +0.07%
Functions	88.11%	88.15%	📈 +0.04%
Branches	78.65%	78.72%	📈 +0.07%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/pid-tracker.ts`	97.3% → 97.2% (-0.15%)	95.8% → 95.6% (-0.22%)
`src/docker-manager.ts`	87.4% → 87.6% (+0.16%)	87.0% → 87.4% (+0.36%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR aims to narrow the exported TypeScript API of the CLI module by removing export from several result/error interfaces that are described as internal implementation details.

Changes:

Removed export from ParseEnvResult, ParseEnvError, ParseVolumeMountsResult, and ParseVolumeMountsError in src/cli.ts.

Show a summary per file

File	Description
src/cli.ts	Stops exporting several parsing result/error interfaces intended to be internal-only.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

src/cli.ts:1119

Same concern here: ParseVolumeMountsResult / ParseVolumeMountsError are used in the return type of an exported function. Removing export from the interfaces narrows named exports, but it also introduces a breaking change for external consumers who imported these types. If these are intended to be internal, consider also unexporting the function (or avoid referencing the named interfaces in the public signature).

interface ParseVolumeMountsResult {
  success: true;
  mounts: string[];
}

interface ParseVolumeMountsError {
  success: false;
  invalidMount: string;
  reason: string;

Files reviewed: 1/1 changed files
Comments generated: 1

+interface ParseEnvResult {
  success: true;
  env: Record<string, string>;
 }

-export interface ParseEnvError {
+interface ParseEnvError {
  success: false;
  invalidVar: string;
 }


lpcox · 2026-05-03T23:12:17Z

@copilot address the review feedback

Copilot · 2026-05-03T23:16:50Z

@copilot address the review feedback

Addressed in 4092ebb. Removed the four named interfaces entirely and replaced the return type annotations with inline discriminated-union types directly in the function signatures. No unexported names appear in the exported API surface, TypeScript narrowing still works correctly in the callers, and the functions remain exported for the test suite.

github-actions · 2026-05-03T23:26:05Z

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	✅ (fetched merged PR: "fix: unexport internal `DlpPattern` interface")
GitHub.com HTTP connectivity	✅ (confirmed via MCP reachability)
File write/read	⚠️ template vars unresolved — smoke file path not available
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

PR author: @Copilot · Assignees: @lpcox, @Copilot

Overall: PASS (file test inconclusive due to unresolved template variables)

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-03T23:26:34Z

Smoke Test Results ✅ PASS

Test	Status
GitHub MCP (last 2 PRs)	✅
Playwright (GitHub page title)	✅
File Writing	✅
Bash Tool (file verification)	✅

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-03T23:26:39Z

🤖 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ pre-step data unavailable (template vars unresolved)

PR: "Remove internal-only interfaces and inline return types in src/cli.ts"
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PASS (MCP + connectivity verified; file test skipped due to missing pre-step data)

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-03T23:27:25Z

Smoke test summary
"fix: unexport internal DlpPattern interface in src/dlp.ts" | "refactor(cli-workflow): unexport internal-only interfaces"
"Mark DockerService and DockerNetwork interfaces as @internal" | "Remove unused export from SslBumpConfig in security-critical module"
Merged PR review ✅
safeinputs-gh query ❌
Playwright ✅
Tavily ❌
File write + cat + discussion comment ✅
Build AWF ✅
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-03T23:27:38Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Result: ❌ Not all versions match — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-05-03T23:28:25Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: Maven required --Dmaven.repo.local=/tmp/gh-aw/agent/.m2/repository as /home/runner/.m2/repository was not writable (owned by root). All Java tests passed after this workaround.

Generated by Build Test Suite for issue #2435 · ● 569.9K · ◷

github-actions · 2026-05-03T23:28:26Z

Smoke Test: Services Connectivity

Redis PING: ❌ (timeout — no response)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (not attempted — pg unreachable)

Overall: FAIL — host.docker.internal services are not reachable from this runner.

🔌 Service connectivity validated by Smoke Services

Initial plan

a6fb87f

Copilot AI assigned Copilot and lpcox May 3, 2026

Copilot started work on behalf of lpcox May 3, 2026 13:54 View session

Copilot AI linked an issue May 3, 2026 that may be closed by this pull request

[Export Audit] Unused exported interfaces in src/cli.ts: ParseEnvResult, ParseEnvError, ParseVolumeMountsResult, ParseVolumeMountsError #2419

Closed

Remove export keyword from internal interfaces in src/cli.ts

4a7754c

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/bc9df357-7482-49d1-a6ba-892014a7c40e Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Remove unused exported interfaces from src/cli.ts~~ Remove export from internal-only interfaces in src/cli.ts May 3, 2026

Copilot finished work on behalf of lpcox May 3, 2026 13:56

Copilot AI requested a review from lpcox May 3, 2026 13:56

lpcox marked this pull request as ready for review May 3, 2026 22:59

lpcox requested a review from Mossaka as a code owner May 3, 2026 22:59

Copilot AI review requested due to automatic review settings May 3, 2026 22:59

Copilot started reviewing on behalf of lpcox May 3, 2026 22:59 View session

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot-byok label May 3, 2026

Copilot AI reviewed May 3, 2026

View reviewed changes

Comment thread src/cli.ts Outdated

Comment on lines 1098 to 1106

interface ParseEnvResult {

success: true;

env: Record<string, string>;

}

export interface ParseEnvError {

interface ParseEnvError {

success: false;

invalidVar: string;

}

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot label May 3, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added smoke-claude build-test labels May 3, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 3, 2026 23:12 View session

refactor(cli): inline return types; remove named interfaces

4092ebb

Copilot AI changed the title ~~Remove export from internal-only interfaces in src/cli.ts~~ Remove internal-only interfaces and inline return types in src/cli.ts May 3, 2026

Copilot finished work on behalf of lpcox May 3, 2026 23:17

lpcox merged commit 1b19027 into main May 3, 2026
62 of 67 checks passed

lpcox deleted the copilot/remove-unused-exports-cli branch May 3, 2026 23:41

Conversation

Copilot AI commented May 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented May 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 3, 2026

Uh oh!

Copilot AI commented May 3, 2026

Uh oh!

github-actions Bot commented May 3, 2026

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

github-actions Bot commented May 3, 2026

🤖 Smoke Test Results

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

github-actions Bot commented May 3, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented May 3, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 3, 2026

Smoke Test: Services Connectivity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 3, 2026 •

edited

Loading

github-actions Bot commented May 3, 2026 •

edited

Loading