# refactor\(ssh\): keep package internals private · PR \#10144 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/10144)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: cleanup-ssh/private-exports

Target branch: main

Head commit: 957f823cf58207de7e24f29334213594a5137fae

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/10144)

[Commits](https://git.cafe/pingdotgg/t3code/pull/10144/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/10144/diffs?format=markdown)

## Description

---

SSH exported 16 values and one type that have no consumers outside their defining modules. Keep those declarations private without changing their implementations or existing tests.

Checked repository-wide named references and the desktop namespace imports. Remote runner, authentication, shutdown, and config discovery behavior remain unchanged. The package is private to this monorepo.

Verification: all 42 tests across five SSH suites pass; SSH typecheck, targeted lint, and the scoped Knip export scan pass. Knip reports zero SSH export/type findings after the change, down from 17. Formatting reflows one helper after removing its export modifier. No UI changes.

Model: gpt-6 astra. Harness: Codex in T3 Code.


<!-- Macroscope's pull request summary starts here -->
<!-- Macroscope will only edit the content between these invisible markers, and the markers themselves will not be visible in the GitHub rendered markdown. -->
<!-- If you delete either of the start / end markers from your PR's description, Macroscope will append its summary at the bottom of the description. -->
> [!NOTE]
> ### Remove `export` from `ssh` package internal helpers and constants
> - Removes the `export` modifier from helpers, constants, and types across [auth.ts](https://github.com/pingdotgg/t3code/pull/10144/files#diff-f44637611b224bd98686e1e19fb4ddce93029e086220bd1d2a152e81fbc88d47), [command.ts](https://github.com/pingdotgg/t3code/pull/10144/files#diff-4f1aef4b11679d8551404a853942f04f47c3a80c050bc25b784d2b0c48ec9e5e), [config.ts](https://github.com/pingdotgg/t3code/pull/10144/files#diff-bd8cd3cba70a22c13818f6a099ee23a94386d85db59fd55c32de0979505d88d2), and [tunnel.ts](https://github.com/pingdotgg/t3code/pull/10144/files#diff-7338be65675ab0699d0c8c6426e54f3421747885231f9bbb0ace4ec129cb2072)
> - Keeps these symbols private to their modules: `SshAskpassFile`, `ASKPASS_*` scripts, `getDefaultSshAskpassDirectory`, `ensureSshAskpassHelpers`, `buildSshHostSpec`, `collectSshConfigAliasesFromFile`, `DEFAULT_REMOTE_PORT`, `normalizeSshErrorMessage`, and `REMOTE_*` scripts
> - Risk: any out-of-tree code importing these now-private symbols will break at compile time
>
> <!-- Macroscope's review summary starts here -->
>
> <sup><a href="https://app.macroscope.com">Macroscope</a> summarized 957f823.</sup>
> <!-- Macroscope's review summary ends here -->
>
<!-- Macroscope's pull request summary ends here -->