Narrow rules API surface by making mergeRuleSets internal

[Copilot]

src/rules.ts exposed mergeRuleSets even though it is only used internally by loadAndMergeDomains and not consumed by production callers. This PR removes that unnecessary export and shifts coverage to the public API path.

• API surface cleanup

  • Removed export from mergeRuleSets in src/rules.ts, making it a module-private helper.
  • Keeps behavior unchanged for runtime callers while reducing implied public contract.

• Test realignment to public contract

  • Removed direct mergeRuleSets import and its dedicated internal-helper tests from src/rules.test.ts.
  • Added/kept assertions on loadAndMergeDomains to validate deduplication and merging behavior through the supported interface.

• Representative change

  // src/rules.ts
  -export function mergeRuleSets(ruleSets: RuleSet[]): string[] {
  +function mergeRuleSets(ruleSets: RuleSet[]): string[] {

[Copilot]

Pull request overview

Narrows the src/rules.ts API surface by un-exporting mergeRuleSets (only used internally by loadAndMergeDomains) and reroutes its test coverage through the public loadAndMergeDomains entry point.

Changes:

• Removed export keyword from mergeRuleSets in src/rules.ts.
• Dropped the dedicated mergeRuleSets describe block and its import from src/rules.test.ts.
• Added a loadAndMergeDomains test asserting cross-file deduplication to preserve coverage.

Show a summary per file

File	Description
src/rules.ts	Makes mergeRuleSets module-private.
src/rules.test.ts	Removes internal-helper tests and adds a public-API dedup test.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	95.55%	95.62%	📈 +0.07%
Statements	95.36%	95.43%	📈 +0.07%
Functions	96.76%	96.76%	➡️ +0.00%
Branches	88.16%	88.20%	📈 +0.04%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/rules.ts	98.2% → 98.1% (-0.04%)	98.2% → 98.2% (-0.03%)
src/config-writer.ts	83.0% → 85.6% (+2.54%)	83.0% → 85.6% (+2.54%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list PRs)	✅ PR #3363 "fix: add resilient gh-aw installer..."
GitHub.com connectivity	✅ HTTP 200/301
File write/read	✅ smoke file confirmed
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS — PR by @Copilot, assignees: @lpcox, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🤖 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ PR data fetched successfully
GitHub.com HTTP connectivity	⚠️ Pre-step data unavailable (template vars not expanded)
File write/read	⚠️ Pre-step data unavailable (template vars not expanded)

Overall: PARTIAL — MCP test passed; HTTP and file tests could not be verified (workflow pre-step outputs were not substituted).

PR: "Narrow rules API surface by making mergeRuleSets internal" by @Copilot — assignees: @lpcox, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke test: FAIL
Merged PRs: fix: add resilient gh-aw installer and --ignore-scripts to lock files; Refactor container cleanup to deduplicate log/session preservation paths
✅ GitHub PR review
❌ Safe Inputs GH CLI: safeinputs-gh unavailable
✅ Playwright title contains GitHub
❌ Tavily search: no registered tools
✅ File write/read, discussion comment, npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke test FAIL. MCP: ❌, Conn: ❌, File: ✅, Bash: ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[github-actions]

Chroot Version Comparison — Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.15.0	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot. Go matches.

Tested by Smoke Chroot

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3373 · ● 8.4M · ◷

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ No response (timeout)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ No response (timeout)

Overall: FAIL — host.docker.internal service containers are not reachable from this runner.

🔌 Service connectivity validated by Smoke Services