diff --git a/packages/cli/src/commands/index.ts b/packages/cli/src/commands/index.ts
index 8e23891f..77523d80 100644
--- a/packages/cli/src/commands/index.ts
+++ b/packages/cli/src/commands/index.ts
@@ -1,4 +1,4 @@
-// Barrel re-export — keeps all existing `import { ... } from "./commands.js"` working.
+// Barrel re-export — all command modules re-exported from this index.
 
 // run.ts — cmdRun, cmdRunHeadless, script failure guidance
 export type { HeadlessOptions } from "./run.js";
diff --git a/packages/cli/src/shared/oauth.ts b/packages/cli/src/shared/oauth.ts
index e958b191..0a691f8e 100644
--- a/packages/cli/src/shared/oauth.ts
+++ b/packages/cli/src/shared/oauth.ts
@@ -16,7 +16,7 @@ const OAuthKeySchema = v.object({
 
 // ─── Key Validation ──────────────────────────────────────────────────────────
 
-export async function verifyOpenrouterKey(apiKey: string): Promise<boolean> {
+async function verifyOpenrouterKey(apiKey: string): Promise<boolean> {
   if (!apiKey) {
     return false;
   }
diff --git a/packages/cli/src/shared/ssh.ts b/packages/cli/src/shared/ssh.ts
index 58710dad..4c3c56c0 100644
--- a/packages/cli/src/shared/ssh.ts
+++ b/packages/cli/src/shared/ssh.ts
@@ -141,7 +141,7 @@ export function killWithTimeout(
  * Returns true if the connection succeeds within `timeoutMs`, false otherwise.
  * This is much cheaper than a full SSH handshake attempt.
  */
-export function tcpCheck(host: string, port: number, timeoutMs = 2000): Promise<boolean> {
+function tcpCheck(host: string, port: number, timeoutMs = 2000): Promise<boolean> {
   return new Promise((resolve) => {
     const socket = connect({
       host,