refactor: [Export Audit] Remove test-only re-exports from barrel modules

src/commands/signal-handler.test.ts

@@ -119,5 +119,43 @@ describe('registerSignalHandlers', () => {
     expect(performCleanup).toHaveBeenCalledWith('SIGTERM');
     expect(processExitSpy).toHaveBeenCalledWith(143);
   });
+
+  it('swallows errors thrown during SIGINT handling', async () => {
+    const fastKill = jest.fn().mockRejectedValue(new Error('kill failed'));
+    const performCleanup = jest.fn().mockResolvedValue(undefined);
+
+    const deps: SignalHandlerDependencies = {
+      getContainersStarted: () => true,
+      keepContainers: false,
+      fastKillAgentContainer: fastKill,
+      performCleanup,
+    };
+
+    registerSignalHandlers(deps);
+
+    // Should not throw even though fastKillAgentContainer rejects
+    handlers['SIGINT']();
+    await flushPromises();
+    expect(processExitSpy).toHaveBeenCalledWith(130);
+  });
+
+  it('swallows errors thrown during SIGTERM handling', async () => {
+    const fastKill = jest.fn().mockRejectedValue(new Error('kill failed'));
+    const performCleanup = jest.fn().mockResolvedValue(undefined);
+
+    const deps: SignalHandlerDependencies = {
+      getContainersStarted: () => true,
+      keepContainers: false,
+      fastKillAgentContainer: fastKill,
+      performCleanup,
+    };
+
+    registerSignalHandlers(deps);
+
+    // Should not throw even though fastKillAgentContainer rejects
+    handlers['SIGTERM']();
+    await flushPromises();
+    expect(processExitSpy).toHaveBeenCalledWith(143);
+  });
 });
 

src/compose-generator.test.ts

@@ -1,4 +1,5 @@
-import { generateDockerCompose, ACT_PRESET_BASE_IMAGE } from './docker-manager';
+import { generateDockerCompose } from './compose-generator';
+import { ACT_PRESET_BASE_IMAGE } from './host-env';
 import { WrapperConfig } from './types';
 import { baseConfig, mockNetworkConfig } from './test-helpers/docker-test-fixtures.test-utils';
 import * as fs from 'fs';

src/docker-manager-lifecycle.test.ts

@@ -1,4 +1,6 @@
-import { startContainers, stopContainers, fastKillAgentContainer, isAgentExternallyKilled, resetAgentExternallyKilled, AGENT_CONTAINER_NAME, runAgentCommand, setAwfDockerHost } from './docker-manager';
+import { startContainers, runAgentCommand, fastKillAgentContainer, setAwfDockerHost, stopContainers, getLocalDockerEnv } from './docker-manager';
+import { isAgentExternallyKilled, resetAgentExternallyKilled } from './container-lifecycle';
+import { AGENT_CONTAINER_NAME } from './host-env';
 import { logger } from './logger';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -491,6 +493,12 @@ describe('docker-manager lifecycle', () => {
         fs.rmSync(testDir, { recursive: true, force: true });
       }
     });
+
+    it('getLocalDockerEnv returns a ProcessEnv-shaped object', () => {
+      const env = getLocalDockerEnv();
+      expect(env).toBeDefined();
+      expect(typeof env).toBe('object');
+    });
   });
 
   describe('runAgentCommand', () => {

src/docker-manager-utils.test.ts

@@ -1,4 +1,5 @@
-import { subnetsOverlap, validateIdNotInSystemRange, getSafeHostUid, getSafeHostGid, getRealUserHome, extractGhHostFromServerUrl, readGitHubPathEntries, mergeGitHubPathEntries, readGitHubEnvEntries, parseGitHubEnvFile, readEnvFile, MIN_REGULAR_UID, ACT_PRESET_BASE_IMAGE, stripScheme, parseDifcProxyHost } from './docker-manager';
+import { subnetsOverlap, validateIdNotInSystemRange, getSafeHostUid, getSafeHostGid, getRealUserHome, extractGhHostFromServerUrl, readGitHubPathEntries, mergeGitHubPathEntries, readGitHubEnvEntries, parseGitHubEnvFile, readEnvFile, MIN_REGULAR_UID, ACT_PRESET_BASE_IMAGE, stripScheme } from './host-env';
+import { parseDifcProxyHost } from './docker-manager';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';

src/docker-manager.ts

@@ -1,40 +1,19 @@
 // Re-export public API for backwards compatibility.
-// Symbols previously exported from the original docker-manager.ts are listed
-// explicitly here to avoid unintentionally widening the public API surface with
-// internal-only constants such as SQUID_PORT, *_CONTAINER_NAME, etc.
+// Only production-consumed symbols are re-exported here. Test files should
+// import directly from the source modules (host-env, compose-generator, etc.).
 
 export {
-  AGENT_CONTAINER_NAME,
-  ACT_PRESET_BASE_IMAGE,
-  MIN_REGULAR_UID,
   setAwfDockerHost,
   getLocalDockerEnv,
-  validateIdNotInSystemRange,
-  getSafeHostUid,
-  getSafeHostGid,
-  getRealUserHome,
-  extractGhHostFromServerUrl,
-  readGitHubPathEntries,
-  readGitHubEnvEntries,
-  parseGitHubEnvFile,
-  mergeGitHubPathEntries,
-  readEnvFile,
-  subnetsOverlap,
-  type SslConfig,
-  stripScheme,
   parseDifcProxyHost,
 } from './host-env';
 
-export { generateDockerCompose } from './compose-generator';
-
 export { writeConfigs } from './config-writer';
 
 export {
   startContainers,
   runAgentCommand,
   fastKillAgentContainer,
-  isAgentExternallyKilled,
-  resetAgentExternallyKilled,
 } from './container-lifecycle';
 
 export {

src/host-iptables-network.test.ts

@@ -1,5 +1,6 @@
 import { execaResult, mockedExeca, setupHostIptablesTestSuite } from './test-helpers/host-iptables-test-setup';
-import { cleanupFirewallNetwork, ensureFirewallNetwork } from './host-iptables';
+import { cleanupFirewallNetwork } from './host-iptables-network';
+import { ensureFirewallNetwork } from './host-iptables';
 import { _testing } from './host-iptables-shared';
 
 describe('host-iptables (network)', () => {

src/host-iptables-setup.test.ts

@@ -1,6 +1,7 @@
 import { API_PROXY_PORTS } from './types';
 import { execaError, execaResult, mockedExeca, setupDefaultIptablesMocks, setupHostIptablesTestSuite } from './test-helpers/host-iptables-test-setup';
-import { isValidPortSpec, setupHostIptables } from './host-iptables';
+import { isValidPortSpec } from './host-iptables-rules';
+import { setupHostIptables } from './host-iptables';
 import { _testing } from './host-iptables-shared';
 
 // setupHostIptables intentionally allows the inclusive min:max API proxy port window.