refactor(deadcode): localize script constants (#101892)

scripts/check-changelog-attributions.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 /**
  * Exact handles that changelog thanks entries must not credit.
  */
-export const FORBIDDEN_CHANGELOG_THANKS_HANDLES = [
+const FORBIDDEN_CHANGELOG_THANKS_HANDLES = [
   "codex",
   "openclaw",
   "steipete",
@@ -20,28 +20,28 @@ export const FORBIDDEN_CHANGELOG_THANKS_HANDLES = [
 /**
  * Handle prefixes that identify forbidden changelog thanks credits.
  */
-export const FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES = ["app/"];
+const FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES = ["app/"];
 /**
  * Handle suffixes that identify forbidden changelog thanks credits.
  */
-export const FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES = ["[bot]"];
+const FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES = ["[bot]"];
 /**
  * Handles that require an explicit human credit instead.
  */
-export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES = [
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES = new Set([
   "clawsweeper",
   "openclaw-clawsweeper",
   "clawsweeper[bot]",
   "openclaw-clawsweeper[bot]",
-];
+]);
 /**
  * Handle prefixes that require explicit human credit instead.
  */
-export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES = ["app/"];
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES = ["app/"];
 /**
  * Handle suffixes that require explicit human credit instead.
  */
-export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES = ["[bot]"];
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES = ["[bot]"];
 
 const THANKS_PATTERN = /\bThanks\b/iu;
 const THANKED_HANDLE_PATTERN = /@([-_/A-Za-z0-9]+(?:\[bot\])?)/giu;
@@ -79,7 +79,7 @@ export function requiresExplicitHumanChangelogThanks(handle) {
     return false;
   }
   return (
-    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES.includes(normalized) ||
+    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES.has(normalized) ||
     CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES.some((prefix) =>
       normalized.startsWith(prefix),
     ) ||

scripts/check-database-first-legacy-stores.mjs

@@ -6,7 +6,7 @@ import path from "node:path";
 import ts from "typescript";
 import { resolveRepoRoot, runAsScript, toLine, unwrapExpression } from "./lib/ts-guard-utils.mjs";
 
-export const databaseFirstLegacyStoreSourceRoots = ["src", "extensions", "packages"];
+const databaseFirstLegacyStoreSourceRoots = ["src", "extensions", "packages"];
 
 const legacyWriteCallees = new Set([
   "appendFile",

scripts/check-deadcode-unused-files.mjs

@@ -12,17 +12,17 @@ const KNIP_VERSION = "6.8.0";
 /**
  * Timeout for the unused-file knip child process.
  */
-export const KNIP_TIMEOUT_MS = 10 * 60 * 1000;
+const KNIP_TIMEOUT_MS = 10 * 60 * 1000;
 /**
  * Grace period before force-killing a timed-out knip child process.
  */
-export const KNIP_KILL_GRACE_MS = 5_000;
+const KNIP_KILL_GRACE_MS = 5_000;
 const KNIP_PROCESS_TREE_EXIT_POLL_MS = 25;
 const KNIP_POST_FORCE_KILL_WAIT_MS = 1_000;
 /**
  * Heartbeat interval used while knip runs without output.
  */
-export const KNIP_HEARTBEAT_MS = 60_000;
+const KNIP_HEARTBEAT_MS = 60_000;
 /**
  * Maximum buffered knip output retained for diagnostics.
  */

scripts/check-session-accessor-boundary.mjs

@@ -672,8 +672,7 @@ export function findMemoryHostSessionCorpusBoundaryViolations(content, fileName
 // migrated lists, so unmigrated files could quietly gain new legacy call
 // sites. The checked-in baseline locks each unmigrated file's current legacy
 // call-site count per concern; any drift from the baseline fails the guard.
-export const sessionAccessorDebtBaselineRelativePath =
-  "scripts/lib/session-accessor-debt-baseline.json";
+const sessionAccessorDebtBaselineRelativePath = "scripts/lib/session-accessor-debt-baseline.json";
 const debtBaselineRegenCommand = "pnpm lint:tmp:session-accessor-boundary:gen";
 
 // Keys sorted alphabetically so the generated baseline JSON stays deterministic.

scripts/e2e/lib/onboard/log-contains.mjs

@@ -2,7 +2,7 @@
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 
-export const DEFAULT_MAX_LOG_BYTES = 120_000;
+const DEFAULT_MAX_LOG_BYTES = 120_000;
 
 const normalizeScriptOutput = (value) => value.replace(/\r?\n/g, "").replace(/\r/g, "");
 const oscPattern = new RegExp(String.raw`\u001b\][^\u0007]*(?:\u0007|\u001b\\)`, "g");

scripts/e2e/parallels/phase-runner.ts

@@ -5,7 +5,7 @@ import path from "node:path";
 import { clampTimerTimeoutMs } from "@openclaw/normalization-core/number-coercion";
 import { say, warn } from "./host-command.ts";
 
-export const PHASE_LOG_TAIL_MAX_BYTES = 512 * 1024;
+const PHASE_LOG_TAIL_MAX_BYTES = 512 * 1024;
 
 function appendTextTail(current: string, chunk: string, maxBytes: number): string {
   const text = chunk.endsWith("\n") ? chunk : `${chunk}\n`;

scripts/e2e/telegram-user-crabbox-proof.ts

@@ -152,9 +152,9 @@ const DEFAULT_SKILL_DIR = "~/.codex/skills/custom/telegram-e2e-bot-to-bot";
 const DEFAULT_CONVEX_ENV_FILE = `${DEFAULT_SKILL_DIR}/convex.local.env`;
 const DEFAULT_USER_DRIVER = "scripts/e2e/telegram-user-driver.py";
 const DEFAULT_OUTPUT_ROOT = ".artifacts/qa-e2e/telegram-user-crabbox";
-export const COMMAND_STDOUT_MAX_CHARS = 1024 * 1024;
-export const COMMAND_STDERR_TAIL_CHARS = 256 * 1024;
-export const COMMAND_FAILURE_STDOUT_TAIL_CHARS = 64 * 1024;
+const COMMAND_STDOUT_MAX_CHARS = 1024 * 1024;
+const COMMAND_STDERR_TAIL_CHARS = 256 * 1024;
+const COMMAND_FAILURE_STDOUT_TAIL_CHARS = 64 * 1024;
 export const COMMAND_TIMEOUT_MS = 30 * 60 * 1000;
 export const COMMAND_TIMEOUT_KILL_GRACE_MS = 5_000;
 const COMMAND_PROCESS_TREE_EXIT_POLL_MS = 25;

scripts/format-docs.mjs

@@ -12,7 +12,7 @@ import { buildCmdExeCommandLine, resolveWindowsCmdExePath } from "./windows-cmd-
 const ROOT = path.resolve(import.meta.dirname, "..");
 const CHECK = process.argv.includes("--check");
 const DOCS_FORMAT_MAX_BUFFER_BYTES = 1024 * 1024 * 16;
-export const DOCS_FORMAT_MAX_COMMAND_LINE_BYTES = 24 * 1024;
+const DOCS_FORMAT_MAX_COMMAND_LINE_BYTES = 24 * 1024;
 const FAILURE_OUTPUT_TAIL_BYTES = 16 * 1024;
 
 function outputText(value) {

scripts/github/dependency-guard.mjs

@@ -18,10 +18,10 @@ import {
 } from "./guard-shared.mjs";
 
 /** Marker used to identify dependency guard comments. */
-export const dependencyChangeMarker = "<!-- openclaw:dependency-guard -->";
-export const dependencyGraphGuardMarker = "<!-- openclaw:dependency-graph-guard -->";
+const dependencyChangeMarker = "<!-- openclaw:dependency-guard -->";
+const dependencyGraphGuardMarker = "<!-- openclaw:dependency-graph-guard -->";
 export const dependencyChangedLabel = "dependencies-changed";
-export const allowDependenciesCommand = "/allow-dependencies-change";
+const allowDependenciesCommand = "/allow-dependencies-change";
 export {
   GITHUB_API_REQUEST_TIMEOUT_MS,
   GITHUB_ERROR_BODY_MAX_BYTES,

scripts/github/real-behavior-proof-policy.mjs

@@ -6,11 +6,11 @@ import { escapeRegExp } from "../lib/regexp.mjs";
 export const PROOF_OVERRIDE_LABEL = "proof: override";
 export const PROOF_SUFFICIENT_LABEL = "proof: sufficient";
 export const NEEDS_PR_CONTEXT_LABEL = "triage: needs-pr-context";
-export const MAINTAINER_TEAM_SLUG = "maintainer";
+const MAINTAINER_TEAM_SLUG = "maintainer";
 export const DEFAULT_GITHUB_API_TIMEOUT_MS = 30_000;
-export const GITHUB_API_RESPONSE_BODY_MAX_BYTES = 1024 * 1024;
+const GITHUB_API_RESPONSE_BODY_MAX_BYTES = 1024 * 1024;
 
-export const CLAWSWEEPER_PROOF_VERDICT_STATUS = "clawsweeper_exact_head_pass";
+const CLAWSWEEPER_PROOF_VERDICT_STATUS = "clawsweeper_exact_head_pass";
 const CLAWSWEEPER_BOT_LOGINS = new Set(["clawsweeper[bot]", "openclaw-clawsweeper[bot]"]);
 
 const privilegedAuthorAssociations = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);

scripts/github/security-sensitive-guard.mjs

@@ -19,7 +19,7 @@ import {
 
 /** Marker used to identify security-sensitive guard comments. */
 export const securitySensitiveGuardMarker = "<!-- openclaw:security-sensitive-guard -->";
-export const securitySensitiveChangedLabel = "security-sensitive-changed";
+const securitySensitiveChangedLabel = "security-sensitive-changed";
 export const allowSecuritySensitiveCommand = "/allow-security-sensitive-change";
 export {
   GITHUB_API_REQUEST_TIMEOUT_MS,

scripts/lib/npm-publish-plan.mjs

@@ -6,7 +6,7 @@ const BETA_VERSION_REGEX =
   /^(?<year>\d{4})\.(?<month>[1-9]\d?)\.(?<patch>[1-9]\d*)-beta\.(?<beta>[1-9]\d*)$/;
 const CORRECTION_VERSION_REGEX =
   /^(?<year>\d{4})\.(?<month>[1-9]\d?)\.(?<patch>[1-9]\d*)-(?<correction>[1-9]\d*)$/;
-export const JUNE_2026_PATCH_FLOOR = 5;
+const JUNE_2026_PATCH_FLOOR = 5;
 
 /**
  * @typedef {object} ParsedReleaseVersion

scripts/lib/plain-gh.mjs

@@ -2,7 +2,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-export const PLAIN_GH_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
+const PLAIN_GH_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
 export const PLAIN_GH_SYSTEM_CANDIDATES = [
   // Prefer package-manager opt paths: bin/gh may intentionally be an Octopool shim.
   "/opt/homebrew/opt/gh/bin/gh",

scripts/lib/source-file-scan-cache.mjs

@@ -3,7 +3,7 @@ import { promises as fs } from "node:fs";
 import path from "node:path";
 
 const DEFAULT_SOURCE_FILE_READ_CONCURRENCY = 32;
-export const DEFAULT_SOURCE_FILE_MAX_BYTES = 2 * 1024 * 1024;
+const DEFAULT_SOURCE_FILE_MAX_BYTES = 2 * 1024 * 1024;
 const scanCache = new Map();
 
 function normalizeRepoPath(repoRoot, filePath) {

scripts/measure-rpc-rtt.mjs

@@ -19,7 +19,7 @@ const SINGLE_VALUE_FLAGS = new Set(["--iterations", "--methods", "--output-dir",
 /** Maximum time to wait for a spawned gateway to become reachable. */
 export const READY_TIMEOUT_MS = 120_000;
 /** Per-probe timeout used while polling gateway readiness endpoints. */
-export const READY_PROBE_TIMEOUT_MS = 1_000;
+const READY_PROBE_TIMEOUT_MS = 1_000;
 const READY_PROBE_RESPONSE_BODY_MAX_BYTES = 64 * 1024;
 const GATEWAY_FORCE_KILL_GRACE_MS = 250;
 const PARENT_TERMINATION_SIGNALS = ["SIGHUP", "SIGINT", "SIGTERM"];

scripts/plugin-sdk-surface-report.mjs

@@ -90,7 +90,7 @@ function readPluginSdkEntrypointBudgetEnv(name, fallback, env = process.env) {
   return Object.freeze({ ...fallback, ...overrides });
 }
 
-export const defaultPublicDeprecatedExportsByEntrypointBudget = Object.freeze({
+const defaultPublicDeprecatedExportsByEntrypointBudget = Object.freeze({
   core: 2,
   health: 1,
   lmstudio: 1,

scripts/pre-commit/pnpm-audit-prod.mjs

@@ -11,9 +11,9 @@ const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const BULK_ADVISORY_PATH = "/-/npm/v1/security/advisories/bulk";
 const MIN_SEVERITY = "high";
 /** Maximum advisory error body characters retained in messages. */
-export const BULK_ADVISORY_ERROR_BODY_MAX_CHARS = 4096;
-export const BULK_ADVISORY_RESPONSE_BODY_MAX_BYTES = 8 * 1024 * 1024;
-export const BULK_ADVISORY_REQUEST_TIMEOUT_MS = 60_000;
+const BULK_ADVISORY_ERROR_BODY_MAX_CHARS = 4096;
+const BULK_ADVISORY_RESPONSE_BODY_MAX_BYTES = 8 * 1024 * 1024;
+const BULK_ADVISORY_REQUEST_TIMEOUT_MS = 60_000;
 const MAX_TIMER_TIMEOUT_MS = 2_147_000_000;
 const SEVERITY_RANK = {
   info: 0,

scripts/transitive-manifest-risk-report.mjs

@@ -25,7 +25,7 @@ const EXOTIC_SPEC_PATTERN = /^(?:git\+|github:|gitlab:|bitbucket:|https?:)/iu;
 const RECENTLY_PUBLISHED_VERSION_TYPE = "recently-published-version";
 const NPM_PACKUMENT_ACCEPT_HEADER = "application/json";
 /** Maximum npm packument response size accepted by the risk scanner. */
-export const NPM_PACKUMENT_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
+const NPM_PACKUMENT_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
 const NPM_PACKUMENT_FETCH_TIMEOUT_MS = 60_000;
 
 function isAllowedPinnedSpec(spec) {