Post-Rust-rewrite cleanup: removes dead, unused and redundant code left over after #389 (the Rust core rewrite), and fixes a few bugs found along the way. Net change is +3.6k / −57.8k lines across 616 files, split into three commits by area.

Bug fixes found during the audit

• Rust logs were silently dropped. 23 files emit tracing:: events, but no subscriber was ever installed. cowork-server and cowork-cli now install a stderr subscriber (RUST_LOG, default warn, ANSI only on a TTY). Electron reads the handshake from stdout only, so stderr is safe.
• Windows path-safety gap. The server's /cowork/fs/* routes used a plain File::open on Windows (no FILE_FLAG_OPEN_REPARSE_POINT), and same_file_identity always returned true. The three copies are replaced by one shared cowork-storage::safe_open with the hardened behavior.
• Unwired notifications. Rust emits cowork/todos, cowork/log, error and cowork/session/backupState, but the desktop never subscribed to them. They now reach the existing reducer branches.

Rust (refactor(rust): …)

• Removed ~35 unused crate dependencies (cargo-machete is clean) and ~50 pub items nothing referenced, along with compat-only params and aliases.
• One provider connection resolver, cowork-providers::connection (select_provider_transport / resolve_provider_connection). It replaces about six copies across harness skill_improvement and the server's turn, memory, fork and agent routes; behavior is unchanged.
• Windows sandbox setup sync: cowork-providers now calls cowork-sandbox's implementation instead of keeping its own copy.
• Small helpers deduped: now_iso, pick_boolean, host_platform, web-search options and the reasoning-effort list.
• New __sandbox-exec --print-command: prints the exact transformed launch as JSON. It shares one prepare path with real execution, and is what lets the TS sandbox go.
• Rename: cowork-server/src/turn_runner.rs → jsonrpc_turn.rs, so it's no longer confused with the harness turn runner.
• Model-stream leftovers: removed model_stream_chunk from the backpressure classification and the never-called persist_model_stream_chunks. The DB tables and migrations are kept.
• Deleted the unused prompts/memory-{generator,consolidator}.md. They describe a tool-calling loop that the Rust generator doesn't implement.

Desktop / mobile (refactor(desktop,mobile): …)

• Model-stream path removed. The Rust server never emits model_stream_chunk / model_stream_raw, so their handling and the ~2.7k-line replay stack are gone (modelStream*, openaiResponsesReplay, googleInteractionsStreamParts).
• Other legacy protocol handling removed:
  • SessionEvent types with no Rust producer;
  • legacyToolLogs;
  • legacy sidecar manifests.
• Shared helpers: chatRetry, toolFeedState, markdownPreview, activityGroups and tool-card helpers move to src/shared for both apps. Mobile's copy of markdownPreview had drifted.
• Unused dependencies removed: seven [@univerjs](/univerjs)/preset-sheets-* packages, plus mobile clsx and ws.
• Dead config and code removed:
  • COWORK_HARNESS_TERMINAL_LOGS;
  • test-only components and exports;
  • migration leftovers in build_desktop_resources.ts, including the docs bundling that never shipped.

Root TS, tooling, docs (chore: …)

• Test-only src/ modules deleted (23 files) along with their tests: idempotency ledger, tool retry, provider continuation, think tags, approval, subprocess and others. All of them have Rust equivalents.
• TS sandbox removed. Office WASM qualification now gets its sandbox launch from the Rust --print-command. Only src/platform/windowsSandboxHelper.ts and scripts/scratchRoots.ts remain.
• Pricing: pricing.ts / costTracker.ts are trimmed to what the desktop uses.
• Single protocol schema: crates/cowork-protocol/src/ws_jsonrpc_schema.json is now the only copy; the identical 1 MB docs/generated copy and its generator are gone.
• Repo housekeeping:
  • .claude/skills is now symlinks into .agents/skills;
  • removed stale hooks, .cursor state, examples/, the vestigial package.json files field, duplicate scripts and historical TS-era docs;
  • CI, docs, knip and biome config are updated to match.

Behavior changes to review

• Transcripts saved by the old TS server still replay. The 2.7k-line live model-stream replay stack is replaced by a small transcript-only decoder, store.legacyTranscript.ts. It rebuilds assistant replies, reasoning and tool rows from assistant_message / reasoning / model_stream_chunk. Raw provider frames (model_stream_raw) are ignored, because normalized chunks mirror them. legacyTranscriptId lookups are kept (review feedback).
• test/office-wasm.integration.test.ts / linuxReadView now expect the Rust seccomp re-exec launcher, and bind-mount that binary read-only into the positive read view.
• Mobile markdown preview now uses the desktop's bold-wrapper repair.

Verification

• Static checks all clean:
  • bun run typecheck (root, desktop, tooling), mobile typecheck, bun run check and bun run knip;
  • bun run docs:check and bun install --frozen-lockfile;
  • cargo fmt, cargo check --workspace --all-targets (0 warnings), cargo clippy --workspace --all-targets -D warnings;
  • cargo-machete.
• Windows cross-check: cargo check --target x86_64-pc-windows-gnu passes for storage, tools, providers, sandbox and server.
• bun run test: everything passes except 5 tests in 3 files, which fail the same way on main in the dev VM:
  • no unzip;
  • no staged sidecar binary;
  • no reaping of grandchild processes;
  • no default rustup toolchain outside the repo.
• cargo test: everything passes except tests that need bubblewrap or LibreOffice, which the dev VM lacks and CI installs.
• Not run locally: Playwright quality gates (no Electron) and the real sandboxed office qualification (no bubblewrap). Both rely on CI.