Max Weinbach5/28/2026, 7:46:23 PM

* refactor: remove dead code across harness, server, providers, and desktop

Swept the codebase with knip and removed confirmed-dead code in three
iterative passes, verifying each candidate with repo-wide ripgrep to catch
dynamic/string references that static analysis misses.

- Delete 44 unused files (35 unused shadcn UI components + 9 dead modules,
  incl. src/session/index barrel, src/runtime/openaiEventStream,
  src/plugins/skillBridge, desktop designTokens/react-ref/use-mobile/etc.)
- Remove ~150 unreferenced symbols and ~190 dead barrel re-exports
- Drop the `export` keyword from ~435 symbols used only within their own file
- Clean the stale openaiEventStream.ts reference from the package files manifest
  (package.json, biome.json, package-manifest test)

~7,300 lines removed. Intentionally kept 4 exports reached only via dynamic
import()/module load/test dynamic import.

Verified green: bun run typecheck, bun run docs:check, and
bun test --max-concurrency 1 (4147 pass, 0 fail, 4 pre-existing skips).

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: add knip dead-code guardrail

Add knip + knip.json scoped to dead-code categories (unused files, exports,
types, enum members) so `bun run knip` guards against dead-code regressions.
Dependency/unlisted/binary/duplicate checks are disabled to keep the gate
focused and false-positive-free (build-tooling deps, mobile expo imports, etc.).

Reports clean. The 4 exports reachable only via dynamic references are
annotated so static analysis can see them:
- createLegacySessionSnapshot, isTrustedSender: `@public` JSDoc tags
- ManagedSofficeRuntimeDiagnostic: converted the consumer's inline import()
  type to a static `import type` (also more readable)

Run with: bun run knip

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: remove unused desktop dependencies orphaned by dead-code sweep

Deleting the 35 unused shadcn UI components left their underlying libraries
with zero imports anywhere in the codebase. Removed 20 now-orphaned packages
from apps/desktop (verified each has no static/dynamic import via ripgrep;
confirmed surviving radix components use the `radix-ui` umbrella instead):

  @base-ui/react, @hookform/resolvers, @radix-ui/react-{checkbox,collapsible,
  dialog,select,slot,switch,tooltip}, date-fns, embla-carousel-react, input-otp,
  next-themes, react-day-picker, react-hook-form, react-resizable-panels,
  recharts, sonner, vaul, ai-elements

Kept build/packaging tooling that knip flags but is used outside TS imports:
@electron/notarize (electron-builder afterSign hook), tailwindcss (v4 CSS),
electron-rebuild (native packaging).

Verified: bun run typecheck, bun test (4147 pass, 0 fail).
Co-authored-by: Cursor <cursoragent@cursor.com>

* test: stabilize bash approval smoke

Apply Biome formatting and import cleanup from the dead-code sweep so the lint job is clean.

Stub the shell runner in the approveCommand unit test so the Windows smoke lane verifies approval ordering without depending on real shell process startup.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Parent7d8302e