Narrow domain-utils API by privatizing agent-image helper exports

[Copilot]

src/domain-utils.ts exposed validateAgentImage and isAgentImagePreset even though they were only used internally and by tests, which unnecessarily widened the module API. This change keeps processAgentImageOption as the public entrypoint and moves helper validation coverage behind that API.

• API surface reduction

  • Removed export from isAgentImagePreset and validateAgentImage in src/domain-utils.ts.
  • Kept helper usage internal to processAgentImageOption, preserving runtime behavior while preventing external callsites from bypassing the intended wrapper.

• Test alignment with public contract

  • Updated src/domain-utils.test.ts to stop importing internal helpers.
  • Reworked image-validation assertions to evaluate behavior through processAgentImageOption (via a local test helper), so tests validate externally supported behavior rather than internal function availability.
  • Removed direct isAgentImagePreset import-driven tests tied to the removed exports.

// src/domain-utils.ts
function isAgentImagePreset(value: string | undefined): value is 'default' | 'act' { ... }

function validateAgentImage(image: string): { valid: boolean; error?: string } { ... }

export function processAgentImageOption(...) { ... }

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	95.55%	95.62%	📈 +0.07%
Statements	95.36%	95.43%	📈 +0.07%
Functions	96.76%	96.76%	➡️ +0.00%
Branches	88.16%	88.20%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	83.0% → 85.6% (+2.54%)	83.0% → 85.6% (+2.54%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

This PR narrows the domain-utils public API by making agent-image helper functions private while preserving the public processAgentImageOption entrypoint.

Changes:

• Removed exports from isAgentImagePreset and validateAgentImage.
• Updated tests to validate agent image behavior through processAgentImageOption.
• Removed tests that directly exercised the now-private preset helper.

Show a summary per file

File	Description
src/domain-utils.ts	Privatizes agent-image validation helper functions.
src/domain-utils.test.ts	Updates test imports and coverage to use the public agent-image processing API.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[github-actions]

🧪 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ Pass
GitHub.com HTTP connectivity	⚠️ N/A (pre-step data not expanded)
File write/read	⚠️ N/A (pre-step data not expanded)

PR: "Narrow domain-utils API by privatizing agent-image helper exports"
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PARTIAL — MCP test passed; pre-computed step outputs were not substituted into the prompt.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test Results

✅ GitHub API: 2 PR entries found
✅ Playwright: GitHub page title confirmed
✅ File verify: Test file exists

Result: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	✅ (listed PRs successfully)
GitHub.com HTTP	⚠️ pre-step data not expanded
File write/read	⚠️ pre-step data not expanded
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

PR author: @Copilot · Assignees: @lpcox, @Copilot

Overall: PARTIAL (BYOK inference ✅, pre-step template vars not expanded in prompt)

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

✅ GitHub PR review: chore: recompile workflows after --ignore-scripts revert; Narrow rules API surface by making mergeRuleSets internal
❌ safeinputs-gh PR query: safeinputs-gh unavailable
✅ Playwright: GitHub title verified
❌ Tavily search: no exposed search tool/results
✅ File/bash/build: temp file verified; npm build passed
❌ Discussion: github-discussion-query unavailable
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.15.0	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot.

Tested by Smoke Chroot

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3385 · ● 4.4M · ◷

[github-actions]

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ timeout (no response)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout

host.docker.internal is unreachable from this environment — the agent is not running inside a Docker container, so service containers are not accessible via that hostname. Overall: FAIL

🔌 Service connectivity validated by Smoke Services

[github-actions]

Smoke Test: Gemini Engine Validation

• GitHub MCP Testing: ❌ (Tools missing)
• GitHub.com Connectivity: ❌ (Blocked/SSL error)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini