Refactor container-stop to keep Squid pre-shutdown chmod helper internal

[Copilot]

fixSquidLogPermissionsBeforeShutdown in src/container-stop.ts was exported despite having no external consumers. This PR reduces API surface by making it internal while preserving existing shutdown behavior and branch coverage through public entrypoints.

• API surface cleanup

  • Removed export from fixSquidLogPermissionsBeforeShutdown in src/container-stop.ts.
  • Kept invocation unchanged from stopContainers(...), so runtime behavior is unaffected.

• Test alignment to public contract

  • Removed direct external-use tests for the helper from src/container-stop.test.ts.
  • Updated src/container-stop-coverage.test.ts to exercise the same helper branches indirectly via stopContainers(...), preserving coverage for non-zero docker exec exit paths.

• Illustrative change

  // before
  export async function fixSquidLogPermissionsBeforeShutdown(): Promise<void> { ... }
  
  // after
  async function fixSquidLogPermissionsBeforeShutdown(): Promise<void> { ... }

[Copilot]

Pull request overview

This PR reduces the public API surface of the container shutdown module by making fixSquidLogPermissionsBeforeShutdown an internal helper while keeping the shutdown behavior unchanged. Tests are adjusted to validate behavior and retain branch coverage via the public stopContainers(...) entrypoint instead of importing the helper directly.

Changes:

• Removed the export from fixSquidLogPermissionsBeforeShutdown to keep it internal to src/container-stop.ts.
• Deleted direct unit tests that imported the helper, aligning tests to the module’s public contract.
• Updated branch-coverage tests to exercise the helper’s non-zero-exit logging branches indirectly through stopContainers(...).

Show a summary per file

File	Description
src/container-stop.ts	Makes the pre-shutdown Squid chmod helper internal while preserving its invocation from stopContainers(...).
src/container-stop.test.ts	Removes direct helper imports/tests; validates helper behavior via stopContainers(...).
src/container-stop-coverage.test.ts	Preserves helper branch coverage by driving execution through stopContainers(...) with mocked execa results.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Low

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

✅ Contribution Check completed successfully!

PR #6177 follows the applicable CONTRIBUTING.md guidelines: the internal refactor preserves TypeScript style, updates tests for the changed API boundary, requires no documentation change, has a clear description, and uses appropriate src/ file organization.

[github-actions]

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

[github-actions]

✅ Smoke Claude passed

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test completed. Results: Connectivity PASS, File Writing PASS, GitHub MCP FAIL (tools missing/unauthenticated).

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.92%	98.95%	📈 +0.03%
Statements	98.88%	98.91%	📈 +0.03%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.11%	95.11%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	⚠️ Inconclusive
GitHub.com HTTP	⚠️ Inconclusive
File write/read	⚠️ Inconclusive

Status: INCONCLUSIVE — workflow template variables (${{ steps.smoke-data.outputs.* }}) were not expanded before agent execution; pre-step data was unavailable.

Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Services Connectivity

• Redis PING: ❌ Network unreachable
• PostgreSQL pg_isready: ❌ No response
• PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is unreachable. Service containers may not be running or the host bridge is inaccessible.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test Results

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	✅ (200)
File Write/Read	⚠️ pre-step vars unresolved

Overall: PASS

PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6177 · 34.9 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

@lpcox
Smoke Test Results:
• MCP connectivity: ✅
• github.com connectivity: ✅
• file I/O: ✅
• BYOK inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed — Python and Node.js versions differ between host and chroot.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

• ✅ fix: add mode: gh-proxy to smoke-sink-visibility workflows
• ✅ docs: add D5 failure mode — stale gVisor release pin returns 404
• ✅ File write
• ✅ Build
• ❌ Playwright
• ❌ safeinputs-gh unavailable
  Overall status: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
S1: Module Loading	✅ Pass	otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled + internal test helpers
S2: Test Suite	✅ Pass	59 tests passed, 0 failed across otel.test.js and otel-fanout.test.js
S3: Env Var Forwarding	✅ Pass	src/services/api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID, OTEL_SERVICE_NAME to the api-proxy container
S4: Token Tracker Integration	✅ Pass	onUsage callback exists in token-tracker-http.js (line 343); proxy-request.js calls otel.startRequestSpan() and otel.setTokenAttributes() per request
S5: OTEL Diagnostics	✅ Pass	Falls back to FileSpanExporter (/var/log/api-proxy/otel.jsonl) when no OTLP endpoint configured — graceful degradation confirmed

All 5 scenarios pass. OTEL tracing integration is fully functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ PASS
GitHub.com HTTP connectivity	⚠️ UNKNOWN (template vars unresolved)
File write/read	⚠️ UNKNOWN (template vars unresolved)

Overall: ⚠️ PARTIAL — pre-computed step outputs (steps.smoke-data.outputs.*) were not substituted.

PR: Refactor container-stop to keep Squid pre-shutdown chmod helper internal
Author: @Copilot | Assignees: @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

Gemini Engine Smoke Test Results

• GitHub MCP Testing: ❌ (Tools not found/accessible)
• GitHub.com Connectivity: ✅ (200 via proxy)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Recent PRs found:

• fix: add mode: gh-proxy to smoke-sink-visibility workflows (fix: add mode: gh-proxy to smoke-sink-visibility workflows #6164)

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

✅ Test 1: MCP connectivity
✅ Test 2: GitHub.com connectivity (HTTP 200)
✅ Test 3: File write/read successful
✅ Test 4: BYOK inference path active

Status: PASS
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}