fix: remove unused exports from public API surface

[lpcox]

Summary

Remove export keywords from symbols that are never imported externally, reducing the public API surface and preventing unintended coupling across 11 files.

Symbols un-exported (18 total)

Symbol	File
LogsCommandOptions	src/commands/logs.ts
StreamOptions	src/logs/log-streamer.ts + re-export in src/logs/index.ts
ParsedDomainList	src/domain-patterns.ts
DomainProtocol, ParsedDomain	src/domain-patterns.ts
Rule	src/rules.ts
ImageDigestKey, ParsedImageTag	src/image-tag.ts
AgentImageResult, ApiProxyValidationResult, FlagValidationResult, LocalhostProcessingResult	src/cli.ts
StatsFormat	src/commands/logs-stats.ts
SummaryFormat	src/commands/logs-summary.ts
LoggingOptions, loadLogsWithErrorHandling	src/commands/logs-command-helpers.ts
LogFormatterOptions	src/logs/log-formatter.ts + re-export in src/logs/index.ts

Skipped (verified as imported externally)

• SslConfig ([Export Audit] SslConfig exported from src/docker-manager.ts but never consumed externally #2490) — imported by container-lifecycle.ts, compose-generator.ts
• DockerService/DockerNetwork ([Export Audit] DockerService and DockerNetwork in src/types.ts exported but never imported #2489) — re-exported from types/index.ts
• pid-tracker helpers ([Export Audit] Unused internal exports in src/pid-tracker.ts leak implementation details #2491) — imported by test files
• discoverAndSelectSource/findPolicyManifestForSource ([Export Audit] Multiple log-commands modules export symbols that are only used internally #2488 partial) — imported by logs-audit.ts

Verification

• npm run build ✅
• npm test ✅ (6 pre-existing failures, no new failures)

Closes #2488, closes #2492, closes #2499, closes #2500, closes #2502, closes #2504, closes #2505

[Copilot]

Pull request overview

This PR reduces the TypeScript public API surface by un-exporting internal-only types/interfaces across the logs, domain parsing, image tag parsing, and rules subsystems, and by trimming a couple of barrel/CLI re-exports.

Changes:

• Removed export from several internal option/result/types (Rule, StreamOptions, LogFormatterOptions, DomainProtocol/ParsedDomain/ParsedDomainList, ImageDigestKey/ParsedImageTag, LogsCommandOptions, StatsFormat/SummaryFormat, LoggingOptions, loadLogsWithErrorHandling).
• Updated src/logs/index.ts to stop re-exporting LogFormatterOptions and StreamOptions.
• Updated src/cli.ts to stop re-exporting several result types from other modules.

Show a summary per file

File	Description
src/rules.ts	Makes Rule interface module-private to reduce exported surface.
src/logs/log-streamer.ts	Makes StreamOptions module-private.
src/logs/log-formatter.ts	Makes LogFormatterOptions module-private.
src/logs/index.ts	Removes barrel re-exports of LogFormatterOptions and StreamOptions.
src/image-tag.ts	Makes ImageDigestKey/ParsedImageTag module-private.
src/domain-patterns.ts	Makes DomainProtocol/ParsedDomain/ParsedDomainList module-private.
src/commands/logs.ts	Makes LogsCommandOptions module-private.
src/commands/logs-summary.ts	Makes SummaryFormat module-private.
src/commands/logs-stats.ts	Makes StatsFormat module-private.
src/commands/logs-command-helpers.ts	Makes LoggingOptions and loadLogsWithErrorHandling module-private.
src/cli.ts	Removes several type re-exports to reduce CLI module’s exported surface.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

src/cli.ts:64

• Similar to AgentImageResult: this change removes the ApiProxyValidationResult type re-export from src/cli.ts, but ApiProxyValidationResult remains exported from src/api-proxy-config.ts. Without an exports map, it remains part of the package’s public API via subpath imports; consider also making the interface non-exported (or restricting subpaths) if the goal is to shrink the overall API surface.

  extractGhecDomainsFromServerUrl,
  extractGhesDomainsFromEngineApiTarget,
  resolveApiTargetsToAllowedDomains,
} from './api-proxy-config';

src/cli.ts:90

• This removes FlagValidationResult/LocalhostProcessingResult from src/cli.ts re-exports, but both interfaces are still exported from src/option-parsers.ts. Because the package allows subpath imports, these types remain publicly importable unless the source declarations are also made non-exported (or subpath exports are restricted).

  escapeShellArg,
  joinShellArgs,
  parseEnvironmentVariables,
  parseVolumeMounts,
  formatItem,
} from './option-parsers';

• Files reviewed: 11/11 changed files
• Comments generated: 1

[lpcox]

@copilot address the review feedback

[Copilot]

@copilot address the review feedback

Done in 5ad83f7. Removed the export keyword from the interface declarations themselves in their source files:

• AgentImageResult in src/domain-utils.ts
• ApiProxyValidationResult in src/api-proxy-config.ts
• FlagValidationResult and LocalhostProcessingResult in src/option-parsers.ts

These types are used only within their own files, so no other imports were affected. TypeScript type-check and lint pass cleanly.

[github-actions]

🔥 Smoke Test: Copilot BYOK — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP (200)	✅
File write/read	✅
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

PR by @lpcox · reviewer @Mossaka · Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

Smoke Tests:
✅ GitHub MCP - Last 2 merged PRs:

• refactor: split docker-manager.ts into focused modules #2501: refactor: split docker-manager.ts into focused modules
• refactor: split cli.ts into focused modules #2498: refactor: split cli.ts into focused modules
  ✅ Playwright - github.com title verified
  ✅ File Writing - smoke-test-claude-25347345785.txt created
  ✅ Bash Verification - file contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

Smoke Test

Titles: "refactor: split docker-manager.ts into focused modules"; "refactor: split cli.ts into focused modules"
GitHub MCP ❌
Safe Inputs GH ❌
Playwright ✅
Tavily ❌
File/Bash ✅
Discussion ✅
Build ✅
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ (template vars not expanded)
File write/read	❌ (template vars not expanded)

Overall: FAIL — pre-step template variables ($\{\{ steps.smoke-data.outputs.* }}) were not resolved at runtime.

PR: fix: remove unused exports from public API surface — author @lpcox, reviewer @Mossaka

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2509 · ● 522.9K · ◷

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all versions match. Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ timeout/no response
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ no response (pg_isready failed)

Overall: FAIL — host.docker.internal is not reachable from this runner environment. Service containers may not be configured or the host alias is not resolvable.

🔌 Service connectivity validated by Smoke Services