diff --git a/src/infra/shell-env.ts b/src/infra/shell-env.ts
index 365bf703472..9465f5ea8b6 100644
--- a/src/infra/shell-env.ts
+++ b/src/infra/shell-env.ts
@@ -194,12 +194,12 @@ function probeLoginShellEnv(params: {
   }
 }
 
-export type ShellEnvFallbackResult =
+type ShellEnvFallbackResult =
   | { ok: true; applied: string[]; skippedReason?: never }
   | { ok: true; applied: []; skippedReason: "already-has-keys" | "disabled" }
   | { ok: false; error: string; applied: [] };
 
-export type ShellEnvFallbackOptions = {
+type ShellEnvFallbackOptions = {
   enabled: boolean;
   env: NodeJS.ProcessEnv;
   expectedKeys: string[];
diff --git a/src/infra/shell-wrapper-resolution.ts b/src/infra/shell-wrapper-resolution.ts
index 59b2f01f24f..3979a35d1ff 100644
--- a/src/infra/shell-wrapper-resolution.ts
+++ b/src/infra/shell-wrapper-resolution.ts
@@ -51,7 +51,7 @@ const SHELL_WRAPPER_SPECS: ReadonlyArray<ShellWrapperSpec> = [
   { kind: "powershell", names: POWERSHELL_WRAPPER_CANONICAL },
 ];
 
-export type ShellWrapperCommand = {
+type ShellWrapperCommand = {
   isWrapper: boolean;
   command: string | null;
 };
@@ -158,7 +158,7 @@ function findShellWrapperSpec(baseExecutable: string): ShellWrapperSpec | null {
   return null;
 }
 
-export type ShellMultiplexerUnwrapResult =
+type ShellMultiplexerUnwrapResult =
   | { kind: "not-wrapper" }
   | { kind: "blocked"; wrapper: string }
   | { kind: "unwrapped"; wrapper: string; argv: string[] };
diff --git a/src/infra/system-presence.ts b/src/infra/system-presence.ts
index d4c99e6cfdd..1fb7398431e 100644
--- a/src/infra/system-presence.ts
+++ b/src/infra/system-presence.ts
@@ -26,7 +26,7 @@ export type SystemPresence = {
   ts: number;
 };
 
-export type SystemPresenceUpdate = {
+type SystemPresenceUpdate = {
   key: string;
   previous?: SystemPresence;
   next: SystemPresence;
diff --git a/src/infra/system-run-command.ts b/src/infra/system-run-command.ts
index 3051a607683..f9974f648e9 100644
--- a/src/infra/system-run-command.ts
+++ b/src/infra/system-run-command.ts
@@ -11,7 +11,7 @@ import {
   resolveInlineCommandMatch,
 } from "./shell-inline-command.js";
 
-export type SystemRunCommandValidation =
+type SystemRunCommandValidation =
   | {
       ok: true;
       shellPayload: string | null;
@@ -24,7 +24,7 @@ export type SystemRunCommandValidation =
       details?: Record<string, unknown>;
     };
 
-export type ResolvedSystemRunCommand =
+type ResolvedSystemRunCommand =
   | {
       ok: true;
       argv: string[];
diff --git a/src/infra/tailnet.ts b/src/infra/tailnet.ts
index c8ab1d2bfe7..4f9d27a2d9c 100644
--- a/src/infra/tailnet.ts
+++ b/src/infra/tailnet.ts
@@ -1,7 +1,7 @@
 import { isIpInCidr } from "../shared/net/ip.js";
 import { listExternalInterfaceAddresses, readNetworkInterfaces } from "./network-interfaces.js";
 
-export type TailnetAddresses = {
+type TailnetAddresses = {
   ipv4: string[];
   ipv6: string[];
 };
diff --git a/src/infra/tailscale.ts b/src/infra/tailscale.ts
index 6dc8a5cf935..8857ece2f88 100644
--- a/src/infra/tailscale.ts
+++ b/src/infra/tailscale.ts
@@ -166,7 +166,7 @@ export function getTestTailscaleBinaryOverride(
   return null;
 }
 
-export async function getTailscaleBinary(): Promise<string> {
+async function getTailscaleBinary(): Promise<string> {
   const forcedBinary = getTestTailscaleBinaryOverride();
   if (forcedBinary) {
     cachedTailscaleBinary = forcedBinary;
diff --git a/src/infra/temp-download.ts b/src/infra/temp-download.ts
index b7f3dbfcf1f..89d10b63962 100644
--- a/src/infra/temp-download.ts
+++ b/src/infra/temp-download.ts
@@ -8,7 +8,7 @@ const logger = createSubsystemLogger("infra:temp-download");
 
 export { resolvePreferredOpenClawTmpDir } from "./tmp-openclaw-dir.js";
 
-export type TempDownloadTarget = {
+type TempDownloadTarget = {
   dir: string;
   path: string;
   cleanup: () => Promise<void>;
diff --git a/src/infra/update-global.ts b/src/infra/update-global.ts
index ca3054a5f75..88f910c2f55 100644
--- a/src/infra/update-global.ts
+++ b/src/infra/update-global.ts
@@ -21,7 +21,7 @@ export type CommandRunner = (
   options: { timeoutMs: number; cwd?: string; env?: NodeJS.ProcessEnv },
 ) => Promise<{ stdout: string; stderr: string; code: number | null }>;
 
-export type ResolvedGlobalInstallCommand = {
+type ResolvedGlobalInstallCommand = {
   manager: GlobalInstallManager;
   command: string;
 };
diff --git a/src/infra/update-package-manager.ts b/src/infra/update-package-manager.ts
index fea5651a2c9..5cfec4c7752 100644
--- a/src/infra/update-package-manager.ts
+++ b/src/infra/update-package-manager.ts
@@ -4,9 +4,9 @@ import path from "node:path";
 import { detectPackageManager as detectPackageManagerImpl } from "./detect-package-manager.js";
 import { applyPathPrepend } from "./path-prepend.js";
 
-export type BuildManager = "pnpm" | "bun" | "npm";
+type BuildManager = "pnpm" | "bun" | "npm";
 
-export type UpdatePackageManagerRequirement = "allow-fallback" | "require-preferred";
+type UpdatePackageManagerRequirement = "allow-fallback" | "require-preferred";
 
 export type UpdatePackageManagerFailureReason =
   | "preferred-manager-unavailable"
@@ -19,7 +19,7 @@ export type PackageManagerCommandRunner = (
   options: { timeoutMs: number; env?: NodeJS.ProcessEnv },
 ) => Promise<{ stdout: string; stderr: string; code: number | null }>;
 
-export type ResolvedBuildManager =
+type ResolvedBuildManager =
   | {
       kind: "resolved";
       manager: BuildManager;
@@ -34,7 +34,7 @@ export type ResolvedBuildManager =
       reason: UpdatePackageManagerFailureReason;
     };
 
-export async function detectBuildManager(root: string): Promise<BuildManager> {
+async function detectBuildManager(root: string): Promise<BuildManager> {
   return (await detectPackageManagerImpl(root)) ?? "npm";
 }
 
diff --git a/src/infra/voicewake-routing.ts b/src/infra/voicewake-routing.ts
index 6ebcc5d5f50..aad5320bc61 100644
--- a/src/infra/voicewake-routing.ts
+++ b/src/infra/voicewake-routing.ts
@@ -7,12 +7,12 @@ import {
 } from "../routing/session-key.js";
 import { createAsyncLock, readJsonFile, writeJsonAtomic } from "./json-files.js";
 
-export type VoiceWakeRouteTarget =
+type VoiceWakeRouteTarget =
   | { mode: "current"; agentId?: undefined; sessionKey?: undefined }
   | { agentId: string; sessionKey?: undefined; mode?: undefined }
   | { sessionKey: string; agentId?: undefined; mode?: undefined };
 
-export type VoiceWakeRouteRule = {
+type VoiceWakeRouteRule = {
   trigger: string;
   target: VoiceWakeRouteTarget;
 };
@@ -288,12 +288,9 @@ export async function setVoiceWakeRoutingConfig(
   });
 }
 
-export type VoiceWakeResolvedRoute =
-  | { mode: "current" }
-  | { agentId: string }
-  | { sessionKey: string };
+type VoiceWakeResolvedRoute = { mode: "current" } | { agentId: string } | { sessionKey: string };
 
-export function resolveVoiceWakeRouteTarget(
+function resolveVoiceWakeRouteTarget(
   routeTarget: VoiceWakeRouteTarget | undefined,
 ): VoiceWakeResolvedRoute {
   if (!routeTarget || ("mode" in routeTarget && routeTarget.mode === "current")) {
diff --git a/src/infra/voicewake.ts b/src/infra/voicewake.ts
index 1362417789f..a232a6beea3 100644
--- a/src/infra/voicewake.ts
+++ b/src/infra/voicewake.ts
@@ -3,7 +3,7 @@ import { resolveStateDir } from "../config/paths.js";
 import { normalizeOptionalString } from "../shared/string-coerce.js";
 import { createAsyncLock, readJsonFile, writeJsonAtomic } from "./json-files.js";
 
-export type VoiceWakeConfig = {
+type VoiceWakeConfig = {
   triggers: string[];
   updatedAtMs: number;
 };
diff --git a/src/infra/windows-install-roots.ts b/src/infra/windows-install-roots.ts
index 00d1bb76b36..b6344bed190 100644
--- a/src/infra/windows-install-roots.ts
+++ b/src/infra/windows-install-roots.ts
@@ -18,7 +18,7 @@ type WindowsInstallRootsTestOverrides = {
   isReadableFile?: IsReadableFile;
 };
 
-export type WindowsInstallRoots = {
+type WindowsInstallRoots = {
   systemRoot: string;
   programFiles: string;
   programFilesX86: string;