[Export Audit] Test helper `iptablesSharedTestHelpers` exported from security-critical production module (regression from #3872)

[github-actions]

API Surface Issue

Category

Test importing from wrong location / Dead export in security-critical module

Summary

• File: src/host-iptables-shared.ts
• Symbol: iptablesSharedTestHelpers
• Issue: A test-only helper object is exported from a security-critical production module (host-iptables-shared.ts) but is only ever imported by test files. This pollutes the public API surface with test-only symbols and exposes internal state-mutation functions (resetIpv6State) through the production module.

Evidence

src/host-iptables-shared.ts:27:export const iptablesSharedTestHelpers = { resetIpv6State };

Import sites (all are .test.ts files):

src/host-iptables-host-access.test.ts:  import { iptablesSharedTestHelpers } from './host-iptables-shared';
src/host-iptables-setup.test.ts:        import { iptablesSharedTestHelpers } from './host-iptables-shared';
src/host-iptables-doh.test.ts:          import { iptablesSharedTestHelpers } from './host-iptables-shared';
src/host-iptables-cleanup.test.ts:      import { iptablesSharedTestHelpers } from './host-iptables-shared';
src/host-iptables-network.test.ts:      import { iptablesSharedTestHelpers } from './host-iptables-shared';
src/host-iptables-shared.test.ts:       import { iptablesSharedTestHelpers } from './host-iptables-shared';

No non-test files import iptablesSharedTestHelpers.

This is a regression of the same pattern fixed in #3872 (iptablesNetworkTestHelpers).

Recommended Fix

1. Remove export from iptablesSharedTestHelpers in src/host-iptables-shared.ts
2. Move the test helper (or expose resetIpv6State directly) into a co-located host-iptables-shared.test-utils.ts file
3. Update all test files to import from the new location

Impact

• Dead code risk: High — state-mutation helper exposed on a security module's public surface
• Maintenance burden: Medium — any refactor of resetIpv6State must account for this leaking export

---

Detected by Export Audit workflow. Triggered by push to main on 2026-05-28

Generated by API Surface & Export Audit · sonnet46 1.3M · ◷

• expires on Jun 27, 2026, 4:47 PM UTC