[Test Coverage] Add tests for parseDifcProxyHost and preserveIptablesAudit

[github-actions]

Summary

Adds unit tests for two exported but previously untested functions in src/docker-manager.ts.

What was covered

parseDifcProxyHost

This function parses --difc-proxy-host values (host:port strings) used to configure the DIFC proxy. Coverage added:

• Empty / whitespace-only input → returns default host.docker.internal:18443
• Bare host:port without a scheme
• Host without a port → default port 18443
• Scheme prefixes (tcp://, https://) stripped correctly
• IPv6 bracketed notation [::1]:18443
• Invalid format throws Invalid --difc-proxy-host
• Port 0 fails the portNum < 1 guard (throws Invalid --difc-proxy-host port: 0)
• Port > 65535 fails URL parsing (throws Invalid --difc-proxy-host)
• Boundary ports 1 and 65535 are accepted

preserveIptablesAudit

This function copies the iptables audit file from workDir/init-signal/iptables-audit.txt to an audit directory. Coverage added:

• Copies file when both source and target directory exist
• No-op when source file does not exist
• No-op when target audit directory does not exist (does not throw)
• Uses default workDir/audit directory when auditDir is not specified

Before / After Coverage (docker-manager.ts)

Metric	Before	After (est.)
Statements	87.4%	~88%
Branches	84.4%	~85%
Functions	90.5%	~92%

Security relevance

parseDifcProxyHost is used to configure network routing for the DIFC proxy sidecar. The input validation (port range, format) is security-relevant — malformed values should fail clearly rather than silently falling through. The new tests confirm correct error paths.

Generated by Weekly Test Coverage Improver · ● 4.6M · ◷

[Copilot]

Pull request overview

Adds unit test coverage for two previously untested exported helpers in src/docker-manager.ts, improving confidence in DIFC proxy host parsing and iptables audit preservation behavior.

Changes:

• Added unit tests for parseDifcProxyHost covering defaulting, scheme stripping, IPv6 bracket parsing, and invalid/edge port handling.
• Added unit tests for preserveIptablesAudit covering copy/no-op behavior and default audit directory selection.

Show a summary per file

File	Description
src/docker-manager.test.ts	Adds new test suites validating parseDifcProxyHost parsing/error cases and preserveIptablesAudit file copy/no-op behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0

[github-actions]

Smoke Test Results

• ✅ GitHub MCP: refactor: remove unused exports from internal modules, Mark DockerService and DockerNetwork interfaces as @internal
• ✅ Playwright: Page navigation to github.com successful
• ✅ File Writing: smoke-test-claude-25304467901.txt created
• ✅ Bash Tool: File verification passed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🤖 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ (pre-step data unavailable — template vars not expanded)
File write/read	❌ (pre-step data unavailable — template vars not expanded)

PR: [Test Coverage] Add tests for parseDifcProxyHost and preserveIptablesAudit
Author: @github-actions[bot] · Reviewers: @Mossaka, @Copilot

Overall: FAIL — pre-computed test data was not injected (workflow template variables were unexpanded).

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	✅ Listed PRs successfully
GitHub.com HTTP	⚠️ Pre-step data unavailable (template vars not substituted)
File write/read	⚠️ Pre-step data unavailable (template vars not substituted)
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅ Responding now

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Overall: PARTIAL — BYOK inference and MCP ✅; pre-step data tests skipped due to unresolved template variables.

PR by @github-actions[bot] | Reviewer: @Mossaka

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	N/A	❌ FAIL
Bun	hono	❌	N/A	❌ FAIL
C++	fmt	❌	N/A	❌ FAIL
C++	json	❌	N/A	❌ FAIL
Deno	oak	❌	N/A	❌ FAIL
Deno	std	❌	N/A	❌ FAIL
.NET	hello-world	❌	N/A	❌ FAIL
.NET	json-parse	❌	N/A	❌ FAIL
Go	color	❌	N/A	❌ FAIL
Go	env	❌	N/A	❌ FAIL
Go	uuid	❌	N/A	❌ FAIL
Java	gson	❌	N/A	❌ FAIL
Java	caffeine	❌	N/A	❌ FAIL
Node.js	clsx	❌	N/A	❌ FAIL
Node.js	execa	❌	N/A	❌ FAIL
Node.js	p-limit	❌	N/A	❌ FAIL
Rust	fd	❌	N/A	❌ FAIL
Rust	zoxide	❌	N/A	❌ FAIL

Overall: 0/8 ecosystems passed — ❌ FAIL

❌ Error Details

All repository clones failed. The gh CLI is not authenticated (GH_TOKEN not set in environment).

Error for all ecosystems:

gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable.
EXIT:4

All 8 ecosystems (Bun, C++, Deno, .NET, Go, Java, Node.js, Rust) returned CLONE_FAILED — no tests could be executed.

Generated by Build Test Suite for issue #2471 · ● 142.9K · ◷

[github-actions]

PR titles: unavailable
GitHub MCP review: ❌
safeinputs-gh PR query: ❌
Playwright GitHub title check: ✅
Tavily web search: ❌
Temp file write/read: ✅
Discussion query/comment: ❌
AWF build (npm ci + npm run build): ✅
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Chroot Runtime Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Result: ⚠️ Not all runtimes match. Python and Node.js versions differ between host and chroot. Go matches.

Tested by Smoke Chroot

[github-actions]

Smoke Test Results

• Redis PING: ❌ (timeout — no response from host.docker.internal:6379)
• PostgreSQL pg_isready: ❌ (no response from host.docker.internal:5432)
• PostgreSQL SELECT 1: ❌ (skipped — pg unreachable)

Overall: FAIL — service containers unreachable from this runner.

🔌 Service connectivity validated by Smoke Services