diff --git a/packages/builtin-tools/src/tools/BashTool/bashCommandHelpers.ts b/packages/builtin-tools/src/tools/BashTool/bashCommandHelpers.ts
index 48f405ac6..457e142d2 100644
--- a/packages/builtin-tools/src/tools/BashTool/bashCommandHelpers.ts
+++ b/packages/builtin-tools/src/tools/BashTool/bashCommandHelpers.ts
@@ -15,7 +15,7 @@ import { createPermissionRequestMessage } from 'src/utils/permissions/permission
 import { BashTool } from './BashTool.js'
 import { bashCommandIsSafeAsync_DEPRECATED } from './bashSecurity.js'
 
-export type CommandIdentityCheckers = {
+type CommandIdentityCheckers = {
   isNormalizedCdCommand: (command: string) => boolean
   isNormalizedGitCommand: (command: string) => boolean
 }
diff --git a/src/services/api/errors.ts b/src/services/api/errors.ts
index bd0514a0d..b583693b4 100644
--- a/src/services/api/errors.ts
+++ b/src/services/api/errors.ts
@@ -130,7 +130,7 @@ export function getPromptTooLongTokenGap(
  * wording drift causes graceful degradation (errorDetails stays undefined,
  * caller short-circuits), not a false negative.
  */
-export function isMediaSizeError(raw: string): boolean {
+function isMediaSizeError(raw: string): boolean {
   return (
     (raw.includes('image exceeds') && raw.includes('maximum')) ||
     (raw.includes('image dimensions exceed') && raw.includes('many-image')) ||
diff --git a/src/services/api/withRetry.ts b/src/services/api/withRetry.ts
index 3e844d744..32f201e5a 100644
--- a/src/services/api/withRetry.ts
+++ b/src/services/api/withRetry.ts
@@ -544,7 +544,7 @@ export function getRetryDelay(
   return baseDelay + jitter
 }
 
-export function parseMaxTokensContextOverflowError(error: APIError):
+function parseMaxTokensContextOverflowError(error: APIError):
   | {
       inputTokens: number
       maxTokens: number
diff --git a/src/services/internalLogging.ts b/src/services/internalLogging.ts
index c70cad735..3fcc2b8b7 100644
--- a/src/services/internalLogging.ts
+++ b/src/services/internalLogging.ts
@@ -32,7 +32,7 @@ const getKubernetesNamespace = memoize(async (): Promise<string | null> => {
 /**
  * Get the OCI container ID from within a running container
  */
-export const getContainerId = memoize(async (): Promise<string | null> => {
+const getContainerId = memoize(async (): Promise<string | null> => {
   if (process.env.USER_TYPE !== 'ant') {
     return null
   }
diff --git a/src/utils/startupProfiler.ts b/src/utils/startupProfiler.ts
index 2e8f9f2b4..b7f462564 100644
--- a/src/utils/startupProfiler.ts
+++ b/src/utils/startupProfiler.ts
@@ -163,7 +163,7 @@ export function getStartupPerfLogPath(): string {
  * Log startup performance phases to Statsig.
  * Only logs if this session was sampled at startup.
  */
-export function logStartupPerf(): void {
+function logStartupPerf(): void {
   // Only log if we were sampled (decision made at module load)
   if (!STATSIG_LOGGING_SAMPLED) return
 
diff --git a/src/utils/statsCache.ts b/src/utils/statsCache.ts
index 109268d7c..cfb534de8 100644
--- a/src/utils/statsCache.ts
+++ b/src/utils/statsCache.ts
@@ -11,7 +11,7 @@ import { logError } from './log.js'
 import { jsonParse, jsonStringify } from './slowOperations.js'
 import type { DailyActivity, DailyModelTokens, SessionStats } from './stats.js'
 
-export const STATS_CACHE_VERSION = 3
+const STATS_CACHE_VERSION = 3
 const MIN_MIGRATABLE_VERSION = 1
 const STATS_CACHE_FILENAME = 'stats-cache.json'