Make OTLP_ENDPOINT_ENV_VARS module-private

[Copilot]

OTLP_ENDPOINT_ENV_VARS is exported despite having no consumers outside its defining module or documented public API role.

• Scope: Remove export; preserve OTLP endpoint resolution behavior.
• Regression coverage: Assert that the constant is absent from the module’s exports.

• Fixes [Export Audit] OTLP_ENDPOINT_ENV_VARS exported but unused outside defining file #9465

[Copilot]

Copilot review overview

🟢 Approval recommended

The narrow visibility change preserves internal behavior and has appropriate regression coverage; tests were not run.

Review effort: Balanced
Findings: None

What changed in this PR

Makes OTLP_ENDPOINT_ENV_VARS module-private, addressing #9465 without changing endpoint resolution behavior.

Changes:

• Removes the constant’s export.
• Adds a regression assertion that it is absent from module exports.

File	Description
src/​api-proxy-config-domains.ts	Makes the endpoint variable list private.
src/​api-proxy-config-domains.test.ts	Verifies the constant is not exported.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.78%	92.79%	📈 +0.01%
Statements	91.21%	91.22%	📈 +0.01%
Functions	89.67%	89.67%	➡️ +0.00%
Branches	84.84%	84.85%	➡️ +0.01%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

[github-actions]

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

[github-actions]

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9470

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

✅ Smoke Claude passed

Generated by Smoke Claude for #9470

[github-actions]

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

Smoke test incomplete: builtins-only shell available; missing gh, playwright-cli, npm, node, git, mkdir, cat, sed. File write/read via shell redirection succeeded at /tmp/gh-aw/agent/smoke-test-codex-37332768256.txt, but GitHub reads/comments, Playwright navigation, and npm ci && npm run build could not run.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test: Cloud Hypervisor + Copilot

1. List merged PRs (github-list_pull_requests): PASS
2. curl https://github.com → 200: PASS
3. Write/read file in /tmp/gh-aw/agent: PASS
4. curl (example.com/redacted) blocked → 000: PASS

All checks passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

[github-actions]

Services smoke test: ✅ Redis PONG · ✅ pg_isready accepting connections · ✅ SELECT 1 = 1. PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

EGRESS_RESULT allow=pass deny=pass

• ✅ Allowed domain (api.github.com → HTTP 403, reachable)
• ✅ Blocked domain (example.com blocked)

Overall: PASS — @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

✅ 1. GitHub MCP Testing — Retrieved 2 recent PRs, data matches pre-fetched results
✅ 2. GitHub.com Connectivity — HTTP 200 OK
✅ 3. File Write/Read Test — File verified at /tmp/gh-aw/agent/smoke-test-copilot-byok.txt
✅ 4. BYOK Inference Test — Responding via direct BYOK mode (COPILOT_PROVIDER_API_KEY) through api-proxy sidecar

Overall Status: PASS
Running in direct BYOK mode (agent → api-proxy sidecar → api.githubcopilot.com)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

• API status: ✅ PASS
• GH check: ✅ PASS
• File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9470 · claude · haiku45 · 49.8 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Copilot: PASS

• ✅ GitHub MCP (latest merged: "Fix ARM64 enclave Copilot launcher under BuildKit QEMU")
• ✅ github.com HTTP 200
• ✅ File write/read
  cc @Copilot @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

OTEL smoke test (re-run locally)

• ✅ S1 Module loading: otel.js exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, and others.
• ✅ S2 Tests: 3 OTEL suites, 68/68 passed.
• ✅ S3 Env forwarding: GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID are forwarded in env-passthrough.ts. OTEL_EXPORTER_OTLP_* is forwarded in api-proxy-env-config.ts.
• ✅ S4 Token tracker: the onUsage hook is present in token-tracker-http.js.
• ⚠️ S5 Diagnostics: I couldn't read the post-step output, so I can't say whether spans were exported.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v2.98.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Node.js differs between host and chroot, so the tests did not all pass and the smoke-chroot label was not added. The chroot's reported v2.98.0 looks unusual for a Node version. It may be a different binary or a mis-parsed output, so it's worth checking.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌ (install blocked)	not run	❌ FAIL
Bun	hono	❌ (install blocked)	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	not run	❌ FAIL
Deno	std	N/A	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

• Bun / Deno: the tool installers (curl ... | bash / | sh) were denied by the sandbox permission layer ("Permission denied and could not request permission"). Bun and Deno never installed, so their tests did not run. I did not work around this.
• Java note: ~/.m2 is root-owned, so Maven could not create ~/.m2/repository. I used -Dmaven.repo.local=/tmp/gh-aw/agent/m2 instead. The existing settings.xml already had the squid-proxy config.

The build-test label was not added because of the failures.

Generated by Build Test Suite for #9470 · copilot · auto · 30 AIC · ⊞ 11.9K · ◷
_{Add label ready-for-aw to run again}