refactor: trim exec infra exports

src/infra/dispatch-wrapper-resolution.ts

@@ -82,7 +82,7 @@ function isKnownArchNameToken(token: string): boolean {
 
 type WrapperScanDirective = "continue" | "consume-next" | "stop" | "invalid";
 
-export function isEnvAssignment(token: string): boolean {
+function isEnvAssignment(token: string): boolean {
   return /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);
 }
 
@@ -531,12 +531,12 @@ const DISPATCH_WRAPPER_SPEC_BY_NAME = new Map(
   DISPATCH_WRAPPER_SPECS.map((spec) => [spec.name, spec] as const),
 );
 
-export type DispatchWrapperUnwrapResult =
+type DispatchWrapperUnwrapResult =
   | { kind: "not-wrapper" }
   | { kind: "blocked"; wrapper: string }
   | { kind: "unwrapped"; wrapper: string; argv: string[] };
 
-export type DispatchWrapperTrustPlan = {
+type DispatchWrapperTrustPlan = {
   argv: string[];
   wrappers: string[];
   policyBlocked: boolean;

src/infra/exec-approval-forwarder.ts

@@ -40,8 +40,6 @@ import {
 } from "./plugin-approvals.js";
 
 const log = createSubsystemLogger("gateway/exec-approvals");
-export type { ExecApprovalRequest, ExecApprovalResolved };
-
 type DeliverOutboundPayloads = typeof import("./outbound/deliver.js").deliverOutboundPayloads;
 type MaybePromise<T> = T | Promise<T>;
 type ResolveSessionTargetFn = (params: {
@@ -126,7 +124,7 @@ export type ExecApprovalForwarder = {
   stop: () => void;
 };
 
-export type ExecApprovalForwarderDeps = {
+type ExecApprovalForwarderDeps = {
   getConfig?: () => OpenClawConfig;
   deliver?: DeliverOutboundPayloads;
   nowMs?: () => number;

src/infra/exec-approvals-effective.ts

@@ -26,12 +26,12 @@ type ExecPolicyConfig = {
   ask?: ExecAsk;
 };
 
-export type ExecPolicyHostSummary = {
+type ExecPolicyHostSummary = {
   requested: ExecTarget;
   requestedSource: string;
 };
 
-export type ExecPolicyFieldSummary<TValue extends ExecSecurity | ExecAsk> = {
+type ExecPolicyFieldSummary<TValue extends ExecSecurity | ExecAsk> = {
   requested: TValue;
   requestedSource: string;
   host: TValue;
@@ -54,7 +54,7 @@ export type ExecPolicyScopeSnapshot = {
   allowedDecisions: readonly ExecApprovalDecision[];
 };
 
-export type ExecPolicyScopeSummary = Omit<ExecPolicyScopeSnapshot, "allowedDecisions">;
+type ExecPolicyScopeSummary = Omit<ExecPolicyScopeSnapshot, "allowedDecisions">;
 
 type ExecPolicyRequestedField = "security" | "ask";
 

src/infra/exec-approvals-test-helpers.ts

@@ -64,7 +64,7 @@ export function makeMockCommandResolution(params: {
   });
 }
 
-export type ShellParserParityFixtureCase = {
+type ShellParserParityFixtureCase = {
   id: string;
   command: string;
   ok: boolean;
@@ -75,7 +75,7 @@ type ShellParserParityFixture = {
   cases: ShellParserParityFixtureCase[];
 };
 
-export type WrapperResolutionParityFixtureCase = {
+type WrapperResolutionParityFixtureCase = {
   id: string;
   argv: string[];
   expectedRawExecutable: string | null;

src/infra/exec-host.ts

@@ -22,7 +22,7 @@ export type ExecHostRunResult = {
   error?: string | null;
 };
 
-export type ExecHostError = {
+type ExecHostError = {
   code: string;
   message: string;
   reason?: string;

src/infra/exec-inline-eval.ts

@@ -1,7 +1,7 @@
 import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";
 import { normalizeExecutableToken } from "./exec-wrapper-resolution.js";
 
-export type InterpreterInlineEvalHit = {
+type InterpreterInlineEvalHit = {
   executable: string;
   normalizedExecutable: string;
   flag: string;

src/infra/exec-safe-bin-runtime-policy.ts

@@ -14,7 +14,7 @@ import {
   type WritableTrustedSafeBinDir,
 } from "./exec-safe-bin-trust.js";
 
-export type ExecSafeBinConfigScope = {
+type ExecSafeBinConfigScope = {
   safeBins?: string[] | null;
   safeBinProfiles?: SafeBinProfileFixtures | null;
   safeBinTrustedDirs?: string[] | null;

src/infra/exec-safe-bin-semantics.ts

@@ -1,6 +1,6 @@
 import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";
 
-export type SafeBinSemanticValidationParams = {
+type SafeBinSemanticValidationParams = {
   binName?: string;
   positional: readonly string[];
 };
@@ -64,7 +64,7 @@ export function normalizeSafeBinName(raw: string): string {
   return normalized.replace(/\.(?:exe|cmd|bat|com)$/i, "");
 }
 
-export function getSafeBinSemanticRule(binName?: string): SafeBinSemanticRule | undefined {
+function getSafeBinSemanticRule(binName?: string): SafeBinSemanticRule | undefined {
   const normalized = typeof binName === "string" ? normalizeSafeBinName(binName) : "";
   return normalized ? SAFE_BIN_SEMANTIC_RULES[normalized] : undefined;
 }

src/infra/exec-wrapper-trust-plan.ts

@@ -9,7 +9,7 @@ import {
   unwrapKnownShellMultiplexerInvocation,
 } from "./shell-wrapper-resolution.js";
 
-export type ExecWrapperTrustPlan = {
+type ExecWrapperTrustPlan = {
   argv: string[];
   policyArgv: string[];
   wrapperChain: string[];

src/infra/executable-path.ts

@@ -3,7 +3,7 @@ import path from "node:path";
 import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";
 import { expandHomePrefix } from "./home-dir.js";
 
-export function isDriveLessWindowsRootedPath(value: string): boolean {
+function isDriveLessWindowsRootedPath(value: string): boolean {
   return process.platform === "win32" && /^:[\\/]/.test(value);
 }