docs: inventory dead code and dependencies (Fixes #2233)

[acoliver]

TLDR

Documents a reproducible dead-code and dependency inventory for all 16 direct workspaces. The report identifies four high-confidence source candidates and 57 dependency-declaration candidates, classifies unsafe analyzer findings, and proposes package-focused cleanup slices. It changes no production code, tests, manifests, lockfiles, workflows, dependencies, or permanent analysis configuration.

Dive Deeper

The inventory compares ts-prune, depcheck, Knip, test-file-filtered Madge, package metadata, exact reference searches, and targeted TypeScript analysis. Findings are grouped into the six issue buckets:

1. definitely dead and safe to remove in later work
2. test-only usage
3. public or exported surfaces requiring an explicit decision
4. dynamic, registry, or config-driven usage requiring manual validation
5. dependency cleanup candidates
6. confirmed false positives

The four high-confidence source candidates are ProviderRuntimeScopeError, orUndefined, packages/mcp/src/auth/oauth-provider-dependencies.ts, and the redundant packages/settings/src/types.ts re-export file. The 57 dependency rows remain experiment proposals rather than confirmed removals.

Two independent Deepthinker reviews completed. All Blocker-Fix and In-scope-Fix findings were incorporated. Both permitted local Open Code Review attempts skipped because no files were selected and produced no comments.

The branch is based on dev/0.12.0, and the target-relative diff contains only the two issue documents. Local test, lint, typecheck, format, and build gates passed on the retargeted candidate. After the StepFun profile reported that the account had no active subscription, the user authorized the ZAI profile for the smoke gate. The ZAI smoke passed with exit 0 and returned a three-line haiku.

Reviewer Test Plan

1. Confirm project-plans/issue2233/inventory.md contains one coverage row for each of the 16 direct workspaces.
2. Confirm it contains 57 dependency rows and all six required classification buckets.
3. Review the evidence and contrary-evidence columns for the four high-confidence source candidates.
4. Review public-surface, registry, test-seam, generated-output, and optional/platform false-positive guidance before accepting any follow-up removal.
5. Confirm the diff contains only project-plans/issue2233/plan.md and project-plans/issue2233/inventory.md.

Local verification performed:

• npm run test: passed
• npm run lint: passed
• npm run typecheck: passed
• npm run format: passed; no unexpected tracked changes
• npm run build: passed
• bun scripts/start.ts --profile-load zai "write me a haiku and nothing else": passed; exit 0 with a valid three-line haiku

Testing Matrix

	🍏	🪟	🐧
npm run	✅	❓	❓
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	-	-	-
Seatbelt	-	-	-

Linked issues / bugs

Fixes #2233

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cf9a46f-cbbd-48b0-b8a7-db6da40d1485

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

OpenCodeReview — automatic reviews suspended

Automatic OCR reviews are suspended for this PR after 2 of 2 automatic reviews.

To get more reviews you can:

• Check the box below to re-enable automatic reviews (resets the counter), or

• Comment /review, /ocr, or /open-code-review to request a single review on demand.

• Re-enable automatic reviews

---

OpenCodeReview — PR #3378

• Reviewed head SHA: b8be9d4eb1e937d9502a229ef6a549b60b6fd2fd
• Merge base: c48987421f1dcdc527fce4b47e3d56d8260f67d8
• Range: full from c48987421f1dcdc527fce4b47e3d56d8260f67d8
• Range fallback: checkpoint-missing
• Scope: selected 2 file(s), +570/-0; cumulative 2 file(s), +570/-0
• Tokens: 0 total (0 input, 0 output, 0 cache)
• OCR version: open-code-review v1.8.4 (e78474478) linux/amd64 built at: 2026-08-01T03:27:37Z https://github.com/alibaba/open-code-review
• Phase: no-reviewable-files
• Exit code: 0
• Run: https://github.com/vybestack/llxprt-code/actions/runs/33095891832
• Partial review: 0 of 0 files completed (0 failed).
• Artifacts: ocr-review-output contains raw JSON, stdout, stderr, preview, phase, and exit-code diagnostics.

[github-actions]

Walkthrough

Before this PR, issue #2233 lacked structured planning artifacts, so the work to inventory dead code and dependencies across workspaces was not formally documented or organized. After this PR, the repository includes dedicated planning documents under project-plans/issue2233/, with inventory.md capturing the current state of dead code and dependencies and plan.md outlining the remediation approach. This gives contributors a clear, shared reference for tracking and cleaning up unused code and stale dependencies.

Release Notes

Documentation

• Added planning artifacts for issue Inventory dead code and dead dependency candidates for 0.12.0 #2233 to inventory dead code and dependencies across workspaces.
• Introduced project-plans/issue2233/inventory.md to document the current state of unused code and stale dependencies.
• Introduced project-plans/issue2233/plan.md to outline the approach and next steps for dependency and dead-code cleanup.

Changes

Layer	File(s)	Summary
docs	project-plans/issue2233/inventory.md, project-plans/issue2233/plan.md	Adds planning artifacts for issue #2233 that inventory dead code and dependencies across workspaces.

Magnitude

🎯 1 (S)
570 additions, 0 deletions, 2 changed files across 0 packages, 1 acceptance criterion

Related

• Inventory dead code and dead dependency candidates for 0.12.0 #2233: directly linked parent issue that PR docs: inventory dead code and dependencies (Fixes #2233) #3378 fixes, covering the same dead-code and dead-dependency inventory scope for 0.12.0
• Migrate packages/core off @google/genai (ContentGenerator, turn.ts, utils; code_assist stays) #2348: explicitly referenced in the PR inventory as the downstream migration issue that re-declares live paths and deletes dead throw-only paths from ProviderContentGenerator
• Remove the vestigial gemini-cli Declarative Agent Framework (AgentExecutor/SubagentInvocation) #3152: explicitly referenced in project plans as tracking dead-code removal in the executor/system-prompt area reviewed by the same inventory
• Evaluate the policy subsystem against upstream gemini-cli for 0.12.0 #3025: mentioned in repo plans as the 0.12.0 policy-system evaluation that is part of the same release scope as the dead-code inventory

Pre-merge Checks

Check	Status	Note
Title	✅	Clear and descriptive: identifies the change as a dead-code/dependency inventory docs update and references the fixed issue.
Description	✅	All required template sections are present: TLDR, Dive Deeper, Reviewer Test Plan, Testing Matrix, and Linked issues / bugs.
Linked Issues	✅	The two committed documents align with the issue's requested inventory/triage report, cover all 16 workspaces per the PR description, classify findings into the required six buckets, propose cleanup slices, and preserve scope by changing no production code or manifests.
Out of Scope	—	The parent-issue update requirement ('updated with links to the inventory and recommended cleanup order') is not evidenced in the repo diff; if that update was intended as a code or issue-body change, it appears missing. Testing matrix shows only macOS verified; Windows/Linux are unverified (marked ), though this is a docs-only change.

---

Walkthrough generated by LLxprt PR Review. Planner issue: #2256

[acoliver]

Review triage

• Reject: CodeRabbit skipped both project-plans/** files because of the repository path filter. This produced no review finding. Changing .coderabbit.yaml would be a permanent quality-tool configuration change outside this documentation-only issue.
• Reject: PR OpenCodeReview completed with no-reviewable-files and produced no finding. A second PR OCR run would use the same path selection and is not justified.
• Reject: The automated walkthrough said its review workspace could not find the two files. Both files are present at PR head 20729ce925b387ac3149f3321d1b7becc3f8ec53, and CI validated the documentation-only diff. No repository change is needed for that review-environment limitation.
• Defer: The StepFun smoke reached the configured endpoint and received HTTP 400, you have no active step plan subscription. This external account state cannot be fixed within the accepted documentation-only scope.

No PR review produced a Blocker-Fix or In-scope-Fix finding. Both independent local Deepthinker reviews were completed before publication, and every Blocker-Fix and In-scope-Fix finding from those reviews is resolved in the inventory.

[acoliver]

Review triage correction

The previous StepFun Defer item is closed. StepFun was blocked by external subscription state, so the user authorized the ZAI profile for this smoke gate. The final retargeted candidate passed:

bun scripts/start.ts --profile-load zai "write me a haiku and nothing else"

The command exited 0 and returned a valid three-line haiku. No smoke-test blocker remains. The PR still changes only the two issue documents relative to dev/0.12.0.