refactor(agents): trim private export surface (#105631)

scripts/deadcode-exports.baseline.mjs

@@ -2121,7 +2121,6 @@ export const KNIP_UNUSED_EXPORT_BASELINE = [
   "src/agents/cli-credentials.ts: readCodexCliCredentials (cliCredentials)",
   "src/agents/cli-credentials.ts: resetCliCredentialCachesForTest",
   "src/agents/cli-executable-identity.ts: CliExecutableFileIdentity",
-  "src/agents/cli-execution-auth.ts: CliExecutionAuthProfileSelection",
   "src/agents/cli-output.ts: parseCliJson",
   "src/agents/cli-output.ts: parseCliJsonl",
   "src/agents/cli-output.ts: supportsCliJsonlToolEvents",
@@ -2323,8 +2322,6 @@ export const KNIP_UNUSED_EXPORT_BASELINE = [
   "src/agents/live-test-helpers.ts: logLiveProgress",
   "src/agents/live-test-helpers.ts: requiresLiveProfileCredential",
   "src/agents/live-test-helpers.ts: resolveLiveCredentialPrecedence",
-  "src/agents/mcp-app-sandbox.ts: MCP_APP_SANDBOX_PORT_OFFSET",
-  "src/agents/mcp-content.ts: McpAgentContentBlock",
   "src/agents/mcp-ui-resource.ts: MCP_APP_RESOURCE_MAX_BYTES",
   "src/agents/mcp-ui-resource.ts: MCP_APP_RESOURCE_MIME_TYPE",
   "src/agents/mcp-ui-resource.ts: testing",
@@ -2335,7 +2332,6 @@ export const KNIP_UNUSED_EXPORT_BASELINE = [
   "src/agents/model-catalog-route.ts: ModelCatalogLogicalIdentity",
   "src/agents/model-catalog-route.ts: ModelCatalogLogicalOverrides",
   "src/agents/model-catalog-route.ts: ModelCatalogRouteMatcher",
-  "src/agents/model-catalog-state-cache.ts: CachedAgentModelCatalogSnapshot",
   "src/agents/model-catalog-visibility.ts: LogicalModelCatalogEntryState",
   "src/agents/model-fallback-observation.ts: resetModelFallbackDecisionLogCoalescingForTest",
   "src/agents/model-fallback.ts: FallbackSummaryError",
@@ -2373,7 +2369,6 @@ export const KNIP_UNUSED_EXPORT_BASELINE = [
   "src/agents/provider-model-auth-source-plan.ts: ProviderModelAuthReadiness",
   "src/agents/provider-model-auth-source-plan.ts: ProviderModelAuthRequiredReason",
   "src/agents/provider-model-route-auth.ts: ProviderModelAuthLogicalAttempt",
-  "src/agents/provider-model-route-auth.ts: ProviderModelAuthSourceDecision",
   "src/agents/provider-model-route-auth.ts: ProviderModelRouteAuthAttempt",
   "src/agents/provider-request-config.ts: mergeProviderRequestOverrides",
   "src/agents/provider-request-config.ts: sanitizeRuntimeProviderRequestOverrides",
@@ -2616,7 +2611,6 @@ export const KNIP_UNUSED_EXPORT_BASELINE = [
   "src/agents/tools/web-fetch.ts: WEB_FETCH_SPILL_MAX_CHARS",
   "src/agents/tools/web-search.ts: testing",
   "src/agents/utility-model.ts: resolveProviderDefaultUtilityModelRef",
-  "src/agents/utility-model.ts: UtilityModelSetting",
   "src/agents/utils/image-resize.ts: formatDimensionNote",
   "src/agents/utils/image-resize.ts: resizeImage",
   "src/agents/utils/syntax-highlight.ts: HighlightFormatter",

src/agents/cli-execution-auth.ts

@@ -9,7 +9,7 @@ import { resolveCliBackendConfig } from "./cli-backends.js";
 const GOOGLE_GEMINI_CLI_PROVIDER_ID = "google-gemini-cli";
 const GOOGLE_PROVIDER_ID = "google";
 
-export type CliExecutionAuthProfileSelection = {
+type CliExecutionAuthProfileSelection = {
   authProfileId?: string;
   authProfileIdSource?: "auto" | "user";
 };

src/agents/mcp-app-sandbox.ts

@@ -6,7 +6,7 @@ export type McpAppCsp = {
 };
 
 export const MCP_APP_SANDBOX_PATH = "/mcp-app-sandbox";
-export const MCP_APP_SANDBOX_PORT_OFFSET = 1;
+const MCP_APP_SANDBOX_PORT_OFFSET = 1;
 const MCP_APP_SANDBOX_CSP_QUERY = "csp";
 const MCP_APP_SANDBOX_CSP_MAX_JSON_BYTES = 5 * 1024;
 const MCP_APP_SANDBOX_CSP_MAX_HEADER_BYTES = 6 * 1024;

src/agents/mcp-content.ts

@@ -1,7 +1,7 @@
 import type { ContentBlock } from "@modelcontextprotocol/sdk/types.js";
 import type { AgentToolResult } from "./runtime/index.js";
 
-export type McpAgentContentBlock = AgentToolResult<unknown>["content"][number];
+type McpAgentContentBlock = AgentToolResult<unknown>["content"][number];
 
 /** Converts the full MCP content union into the agent text/image contract. */
 export function mcpContentBlockToAgentContent(block: ContentBlock): McpAgentContentBlock {

src/agents/model-catalog-state-cache.ts

@@ -22,7 +22,7 @@ type CachedAgentModelCatalogPayload = {
   routeVariants?: readonly unknown[];
 };
 
-export type CachedAgentModelCatalogSnapshot = {
+type CachedAgentModelCatalogSnapshot = {
   entries: unknown[];
   routeVariants: unknown[];
 };

src/agents/provider-model-route-auth.ts

@@ -41,7 +41,7 @@ export type ProviderModelRouteAuthAttempt =
       allowAuthProfileFallback: false;
     };
 
-export type ProviderModelAuthSourceDecision =
+type ProviderModelAuthSourceDecision =
   | {
       kind: "selected";
       selection: ProviderModelAuthSourceSelection;

src/agents/utility-model.ts

@@ -8,7 +8,7 @@ import { resolveAgentConfig, resolveAgentEffectiveModelPrimary } from "./agent-s
 import { splitTrailingAuthProfile } from "./model-ref-profile.js";
 import { resolveDefaultModelForAgent } from "./model-selection.js";
 
-export type UtilityModelSetting =
+type UtilityModelSetting =
   | { kind: "explicit"; modelRef: string }
   | { kind: "disabled" }
   | { kind: "auto" };