[Export Audit] Test-only exports leaking into public API: subnetsOverlap and cleanupFirewallNetwork

[github-actions]

API Surface Issue

Category

Unused export

Summary

Two functions are exported from their respective modules but are consumed only by test files, not by any production code or barrel re-exports.

File	Symbol	Line	Only test consumer
src/host-env.ts	subnetsOverlap	418	src/docker-manager-utils.test.ts
src/host-iptables-network.ts	cleanupFirewallNetwork	54	src/host-iptables-network.test.ts

Neither symbol is re-exported from the relevant barrels (src/docker-manager.ts or src/host-iptables.ts).

Evidence

$ npx ts-prune
src/host-env.ts:418 - subnetsOverlap
src/host-iptables-network.ts:54 - cleanupFirewallNetwork

$ grep -rn "subnetsOverlap" src/ --include="*.ts" | grep -v ".test.ts"
src/host-env.ts:418:export function subnetsOverlap(subnet1: string, subnet2: string): boolean {

$ grep -rn "cleanupFirewallNetwork" src/ --include="*.ts" | grep -v ".test.ts"
src/host-iptables-network.ts:54:export async function cleanupFirewallNetwork(): Promise<void> {

Note: host-iptables.ts barrel re-exports ensureFirewallNetwork but not cleanupFirewallNetwork.

Recommended Fix

1. subnetsOverlap: Remove export and expose via _testing object if test-only, or add production usage.
2. cleanupFirewallNetwork: Either add it to the host-iptables.ts barrel if it's a legitimate public API, or remove export and expose via _testing object.

Impact

• Dead code risk: Medium
• Maintenance burden: Low — test-only exports pollute the module interface and create the false impression that these functions are part of the public API.

---

Detected by Export Audit workflow. Triggered by push to main on 2026-05-15

Generated by API Surface & Export Audit · ● 6.2M · ◷

• expires on Jun 14, 2026, 3:02 PM UTC

[lpcox]

Addressed by #3169 (merged to main). The barrel re-exports have been removed.