Conversation
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
This PR refactors src/container-lifecycle.ts to centralize blocked-domain diagnostic logging so both the startup failure path and the post-run failure path use the same reporting logic.
Changes:
- Added a new
reportBlockedDomainshelper to classify blocked targets and emit remediation messages. - Replaced the duplicated blocked-domain reporting blocks in
handleHealthcheckErrorandrunAgentCommandwith calls to the helper. - Kept the call-site distinction between
logger.errorduring startup failures andlogger.warnafter agent command failures.
Show a summary per file
| File | Description |
|---|---|
src/container-lifecycle.ts |
Extracts shared blocked-domain reporting logic and wires both startup and post-run paths to the new helper. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 3
| const isAllowed = allowedDomains.some(allowed => | ||
| blocked.domain === allowed || blocked.domain.endsWith('.' + allowed) |
| function reportBlockedDomains( | ||
| blockedTargets: BlockedTarget[], | ||
| allowedDomains: string[], | ||
| log: (msg: string) => void, | ||
| ): { missingDomains: string[]; portIssues: BlockedTarget[] } { |
| allowedDomains.forEach(domain => { log(` - Allowed: ${domain}`); }); | ||
|
|
||
| if (missingDomains.length > 0) { | ||
| log(`To fix domain issues: --allow-domains "${[...allowedDomains, ...missingDomains].join(',')}"`); |
This comment has been minimized.
This comment has been minimized.
|
@copilot merge main and address the review feedback |
…-code-in-container-lifecycle Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Done in 97239ab. Merged main and addressed all three review issues:
|
🔥 Smoke Test: Copilot BYOK (Offline) Mode
Running in BYOK offline mode ( Author: Overall: PASS (core BYOK path confirmed working)
|
Smoke Test ResultsTest Results: Merged PRs:
Status: PASS
|
🔬 Smoke Test Results
PR: refactor: extract reportBlockedDomains helper to remove duplicated logic Overall: PARTIAL — MCP connectivity confirmed ✅; pre-computed step outputs were not injected (raw
|
|
🔮 Codex Smoke Test: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 7/8 ecosystems passed — ❌ FAIL ❌ FailuresDeno — CLONE_FAILED
|
Smoke Test Results — FAIL
Overall: FAIL —
|
Chroot Version Comparison Results
Result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot.
|
~37 lines of blocked-domain classification and diagnostic messaging were copy-pasted between
handleHealthcheckError(startup path) andrunAgentCommand(post-run path), differing only in log level.Changes
reportBlockedDomainsinsrc/container-lifecycle.ts— accepts alog: (msg: string) => voidparameter, making theerrorvswarndistinction explicit at each call siteCorrect domain matching —
isAllowednow usesparseDomainWithProtocolto striphttp:///https://prefixes andisWildcardPattern/wildcardToRegexfor wildcard patterns (e.g.*.github.com), consistent with howdomain-patterns.tshandles these elsewhere. Previously, protocol-prefixed or wildcard entries in--allow-domainswould be incorrectly reported as missing from the allowlist.Deduplicated
--allow-domainssuggestion —missingDomainsis now collected in aSetso the same host blocked on multiple targets (e.g. both port 80 and 443) only appears once in the remediation hint.Regression tests — Four new tests in
docker-manager-lifecycle.test.tscovering: wildcard allowlist matching, protocol-prefixed allowlist matching,--allow-domainsdeduplication, and thewarn-vs-errorcall-site distinction.Any future changes to domain classification logic, fix suggestion format, or port-allowlist rules now only need to be made in one place.