refactor: decompose 287-line assembleAndValidateConfig into named helpers

[Copilot]

assembleAndValidateConfig mixed three unrelated concerns in a single 287-line function: an env-file parsing utility, config assembly, and seven independent post-assembly validation guards.

Changes

src/parsers/env-parsers.ts

• Adds readEnvVarFromEnvFiles(envFile, key) as a reusable module-level export, replacing the 29-line nested closure that was previously only accessible inside assembleAndValidateConfig.

src/commands/validators/config-assembly.ts

Seven inline guard blocks extracted into named helpers:

Helper	Responsibility
validateInfrastructureOptions	--docker-host URI, path prefix & chroot binaries path
applyRateLimitConfig	Rate-limit config build + flag/proxy compatibility
validateFeatureFlagCompatibility	Token-steering flag + --env-all/--env-file logging
validateHostAccessConfig	Host ports, --skip-pull/--build-local, host.docker.internal warn
validateApiProxyOptions	API proxy key validation, status logging, target-domain warnings
validateCopilotModelOption	Resolves COPILOT_MODEL from all sources and validates identifier

assembleAndValidateConfig is now a ~40-line orchestrator:

export function assembleAndValidateConfig(...): WrapperConfig {
  const config = buildConfig({ ... });
  validateInfrastructureOptions(config);
  applyAgentTimeout(options.agentTimeout as string | undefined, config, logger);
  applyRateLimitConfig(config, options);
  validateFeatureFlagCompatibility(config);
  validateHostAccessConfig(config, networkOptions);
  validateApiProxyOptions(config, networkOptions);
  validateCopilotModelOption(config, agentOptions);
  return config;
}

No behaviour changes; all 39 existing tests pass.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.62%	96.66%	📈 +0.04%
Statements	96.49%	96.54%	📈 +0.05%
Functions	98.78%	98.79%	📈 +0.01%
Branches	91.22%	91.25%	📈 +0.03%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
src/commands/validators/config-assembly.ts	98.3% → 98.1% (-0.20%)	97.5% → 98.1% (+0.62%)
src/parsers/env-parsers.ts	100.0% → 100.0% (+0.00%)	100.0% → 96.5% (-3.45%)
src/config-writer.ts	89.9% → 91.1% (+1.19%)	89.9% → 91.1% (+1.19%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Refactors assembleAndValidateConfig by extracting env-file parsing and post-assembly validation logic into named helper functions, aiming to keep config assembly readable while preserving existing behavior.

Changes:

• Added a reusable readEnvVarFromEnvFiles(envFile, key) export for env-file key lookup.
• Extracted post-assembly validation/guard blocks into focused helper functions and simplified assembleAndValidateConfig into an orchestrator.

Show a summary per file

File	Description
src/parsers/env-parsers.ts	Introduces exported env-file variable reader used by config validation.
src/commands/validators/config-assembly.ts	Decomposes post-assembly guard logic into helper functions and streamlines assembleAndValidateConfig.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2

[github-actions]

🔥 Smoke Test: PAT Auth — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅
File write/read	✅

Overall: PASS — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

cc @lpcox @Copilot

🔑 PAT report filed by Smoke Copilot PAT

[github-actions]

Smoke Test Results: Copilot BYOK (Direct Mode) ✅

Status: PASS

Test	Result
MCP Connectivity	✅
GitHub.com (HTTP 200)	✅
File Write/Read	✅
BYOK Inference Path	✅

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) → api-proxy sidecar → api.githubcopilot.com

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🤖 Smoke Test Results — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

PR: refactor: decompose 287-line assembleAndValidateConfig into named helpers
Author: @Copilot — Assignees: @lpcox @Copilot

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.16.0	v22.22.3	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all versions match — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

[github-actions]

✅ fix(workflow): use gpt-5.4-mini and raise max-ai-credits for copilot-token-usage-analyzer
✅ Honor workflow-level COPILOT_MODEL in Copilot BYOK smoke workflows
✅ GitHub title check, file write, and build
PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

@Copilot @lpcox
refactor: decompose 287-line assembleAndValidateConfig into named helpers
MCP connectivity: ✅
GitHub.com connectivity: ✅
File write/read test: ✅
BYOK inference: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

[github-actions]

@lpcox

• GitHub MCP connectivity: ✅
• GitHub.com connectivity: ✅
• File write/read test: ❌
• BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall status: FAIL

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ timeout (no response on host.docker.internal:6379)
PostgreSQL pg_isready	❌ no response on host.docker.internal:5432
PostgreSQL SELECT 1	❌ timeout (connection failed)

Overall: FAIL — Service containers are not reachable via host.docker.internal from this runner.

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #4894 · ◷