From 821112078558a3169180fa3659d184ca1ec640e3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:32:00 +0000
Subject: [PATCH 1/2] Initial plan


From 4df32bcf48d5d2474c8f6e567311a1e51ef77f68 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:34:53 +0000
Subject: [PATCH 2/2] fix: unexport LINUX_CAPABILITY_MAP, expose via
 testHelpers

---
 src/capability-filter.test.ts | 4 +++-
 src/capability-filter.ts      | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/capability-filter.test.ts b/src/capability-filter.test.ts
index 070f64b11..0d22452eb 100644
--- a/src/capability-filter.test.ts
+++ b/src/capability-filter.test.ts
@@ -6,8 +6,10 @@ import {
   isCapDropSkipped,
   filterCapDrop,
   filterComposeCapDrop,
-  LINUX_CAPABILITY_MAP,
+  testHelpers,
 } from './capability-filter';
+
+const { LINUX_CAPABILITY_MAP } = testHelpers;
 import { DockerComposeConfig } from './types';
 import { generateDockerCompose } from './compose-generator';
 import { WrapperConfig } from './types';
diff --git a/src/capability-filter.ts b/src/capability-filter.ts
index 4ca8e9b11..f48c7fe9f 100644
--- a/src/capability-filter.ts
+++ b/src/capability-filter.ts
@@ -7,7 +7,7 @@ import { getLocalDockerEnv } from './docker-host';
  * Map of standard Linux capability names (uppercase, without CAP_ prefix) to bit positions in CapBnd.
  * Reference: Linux kernel include/uapi/linux/capability.h
  */
-export const LINUX_CAPABILITY_MAP: Record<string, number> = {
+const LINUX_CAPABILITY_MAP: Record<string, number> = {
   CHOWN: 0,
   DAC_OVERRIDE: 1,
   DAC_READ_SEARCH: 2,
@@ -164,3 +164,7 @@ export function filterComposeCapDrop(
   }
   return composeConfig;
 }
+
+/** @internal Exposed for unit tests only. */
+// ts-prune-ignore-next
+export const testHelpers = { LINUX_CAPABILITY_MAP };