diff --git a/src/node-host/config.ts b/src/node-host/config.ts
index 813c3846036..a9ee950a4ba 100644
--- a/src/node-host/config.ts
+++ b/src/node-host/config.ts
@@ -11,7 +11,7 @@ export type NodeHostGatewayConfig = {
   tlsFingerprint?: string;
 };
 
-export type NodeHostConfig = {
+type NodeHostConfig = {
   version: 1;
   nodeId: string;
   token?: string;
diff --git a/src/node-host/exec-policy.ts b/src/node-host/exec-policy.ts
index e72f12842eb..440825b18a5 100644
--- a/src/node-host/exec-policy.ts
+++ b/src/node-host/exec-policy.ts
@@ -1,8 +1,8 @@
 import { requiresExecApproval, type ExecAsk, type ExecSecurity } from "../infra/exec-approvals.js";
 
-export type ExecApprovalDecision = "allow-once" | "allow-always" | null;
+type ExecApprovalDecision = "allow-once" | "allow-always" | null;
 
-export type SystemRunPolicyDecision = {
+type SystemRunPolicyDecision = {
   analysisOk: boolean;
   allowlistSatisfied: boolean;
   shellWrapperBlocked: boolean;
diff --git a/src/node-host/invoke-system-run-allowlist.ts b/src/node-host/invoke-system-run-allowlist.ts
index 36c737fd2ed..49071e8c12f 100644
--- a/src/node-host/invoke-system-run-allowlist.ts
+++ b/src/node-host/invoke-system-run-allowlist.ts
@@ -12,7 +12,7 @@ import {
 import { resolveExecSafeBinRuntimePolicy } from "../infra/exec-safe-bin-runtime-policy.js";
 import type { RunResult } from "./invoke-types.js";
 
-export type SystemRunAllowlistAnalysis = {
+type SystemRunAllowlistAnalysis = {
   analysisOk: boolean;
   allowlistMatches: ExecAllowlistEntry[];
   allowlistSatisfied: boolean;
diff --git a/src/node-host/invoke.ts b/src/node-host/invoke.ts
index a0db79b8c32..7e1597f0aa2 100644
--- a/src/node-host/invoke.ts
+++ b/src/node-host/invoke.ts
@@ -60,7 +60,7 @@ type ExecApprovalsSnapshot = {
   file: ExecApprovalsFile;
 };
 
-export type NodeInvokeRequestPayload = {
+type NodeInvokeRequestPayload = {
   id: string;
   nodeId: string;
   command: string;
diff --git a/src/node-host/runner.ts b/src/node-host/runner.ts
index e0b3b588bfc..90458e6aad9 100644
--- a/src/node-host/runner.ts
+++ b/src/node-host/runner.ts
@@ -57,7 +57,7 @@ export function shouldExitNodeHostOnReconnectPaused(detailCode: string | null):
   return detailCode !== null && NODE_HOST_EXIT_ON_RECONNECT_PAUSE_CODES.has(detailCode);
 }
 
-export function formatNodeHostReconnectPausedMessage(
+function formatNodeHostReconnectPausedMessage(
   info: GatewayReconnectPausedInfo,
   params?: { exiting?: boolean },
 ): string {