Reduce src/squid/config-sections.ts API surface by internalizing helper exports

[Copilot]

src/squid/config-sections.ts was exporting five helper functions that were only consumed inside the squid module, unnecessarily widening the package API surface. This change keeps those helpers module-private and preserves a single exported integration point used by the config generator.

• API surface tightening

  • Removed direct exports for internal helpers:
    • generateDlpSections
    • generateSslSections
    • generatePortAclsAndRules
    • generateApiProxySection
    • generateDnsSection

• Single exported composition entrypoint

  • Added generateConfigSections(...) in src/squid/config-sections.ts.
  • This function composes the internal helpers and returns the section fragments needed by config assembly.

• Consumer update

  • Updated src/squid/config-generator.ts to import and use generateConfigSections(...) instead of importing five helper symbols directly.

// before
import {
  generateApiProxySection,
  generateDlpSections,
  generateDnsSection,
  generatePortAclsAndRules,
  generateSslSections,
} from './config-sections';

// after
import { generateConfigSections } from './config-sections';

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.57%	96.62%	📈 +0.05%
Statements	96.44%	96.48%	📈 +0.04%
Functions	98.22%	98.23%	📈 +0.01%
Branches	90.66%	90.70%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Refactors src/squid/config-sections.ts to reduce its exported API surface by converting five helper functions to module-private and exposing a single composed entrypoint generateConfigSections that the config generator consumes.

Changes:

• Make generateDlpSections, generateSslSections, generatePortAclsAndRules, generateApiProxySection, and generateDnsSection module-private.
• Add generateConfigSections that composes the above helpers and returns all section fragments.
• Update src/squid/config-generator.ts to use the new single entrypoint.

Show a summary per file

File	Description
src/squid/config-sections.ts	Removes export from five helpers and adds the composing generateConfigSections function.
src/squid/config-generator.ts	Replaces five direct helper imports/calls with one call to generateConfigSections.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[github-actions]

🔬 Smoke Test Results

Test	Status
GitHub MCP — PR: "[awf] ARC/DinD chroot: auto-stage runner binary..."	✅
GitHub.com connectivity	✅
File write/read (smoke-test-copilot-26478484733.txt)	✅

Overall: PASS

PR by @Copilot, assigned to @lpcox and @Copilot.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test (Claude) — ✅ PASS

• ✅ GitHub API: 2 recent PR entries found
• ✅ GitHub check (playwright): PASS
• ✅ File verify: smoke-test-claude-26478484635.txt present

Total: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	✅ PR listed successfully
GitHub.com HTTP	⚠️ Pre-step data not substituted (template vars unexpanded)
File write/read	⚠️ Pre-step data not substituted (template vars unexpanded)
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅ Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PARTIAL — BYOK inference and MCP confirmed ✅; pre-step outputs were not injected into the prompt (template variables not expanded).

PR author: @Copilot · Assignees: @lpcox, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

✅ [awf] ARC/DinD chroot: auto-stage runner binary and critical /etc files for split-filesystem Docker hosts
✅ api-proxy: add Anthropic Workload Identity Federation provider
✅ SafeInputs GH query
✅ Playwright title check
✅ Smoke file write/read
✅ Discussion query/comment
✅ Build
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.15.0	v22.22.3	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: ❌ Not all versions match — Python and Node.js differ between host and chroot environments.

Tested by Smoke Chroot

[github-actions]

Smoke test failed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3877 · sonnet46 1.3M · ◷

[github-actions]

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ No response
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ No response

host.docker.internal is not reachable from this runner — service containers appear unavailable.

🔌 Service connectivity validated by Smoke Services