chore(core): remove zero-reference deps and redirect_links domain

[YellowSnnowmann]

Summary

• Remove ~15 zero-reference root Cargo.toml crates, 4 unused tree-sitter optional decls, 4 dead npm packages, and the unwired redirect_links domain. Pure removal, no behaviour change.
• Kept two things the issue proposed removing, with justification below: the webview_accounts core domain (its premise is factually wrong) and memory_archivist.

Problem

Dead dependencies and domains cost compile time, binary size, supply-chain surface, and reader confusion for no benefit. Everything removed here has zero references in the tree, verified by grep over src/ + app/src-tauri/src/ and by cargo tree -i <crate> (grep alone is not sufficient — several of these stay in-tree transitively). Resolves #5051.

Solution

Root Cargo.toml dependencies — each classified by cargo tree -i:

• Real sheds (nothing else pulls them; gone from Cargo.lock with their exclusive transitives): postgres, prometheus, dialoguer, shellexpand, clap_complete, opentelemetry / opentelemetry_sdk / opentelemetry-otlp.
• Redundant direct declarations (crate is still required transitively via ethers-signers / tinychannels / tinyjuice / pdf-extract, so only the direct decl is dropped — no shed, just no longer an unstable direct surface): ripemd, prost, mail-parser, async-imap, unicode-segmentation, unicode-width, unicode-normalization.
• 4 tree-sitter optional decls (tree-sitter, -rust, -typescript, -python) that no feature activates — tokenjuice-treesitter forwards only to tinyjuice/tinyjuice-treesitter, and tinyjuice owns its own grammars. AST compression is unchanged.

redirect_links domain (RPC-registered but never wired into the message pipeline — the promised inbound/outbound link-rewrite integration was never hooked up): removed the module and all references — controller registration (all.rs), namespace description (all.rs), the WORKSPACE_INTERNAL_DIRS security entry (security/policy/types.rs), and the DOMAIN_ALLOWLIST entry in scripts/generate-test-inventory.mjs. The schemas.len() == controllers.len() invariant still holds (both derive from one registry()), and the stale namespace_description("redirect_links") assertion in all_tests.rs was removed with it.

npm — @rive-app/react-canvas (root; the app renders via @rive-app/react-webgl2, 6 files), and remotion / @remotion/player / @remotion/zod-types (app; zero imports). pnpm-lock.yaml pruned (0 added / 63 removed; the standalone app/pnpm-lock.yaml never contained them).

Intentional deviations from the issue

• webview_accounts core domain NOT deleted. The issue's "only references are the mod.rs declaration and a doc-comment" finding was scoped to openhuman_core and missed the cross-crate consumer: app/src-tauri/src/wechat_scanner/{mod,dom_snapshot}.rs imports openhuman_core::openhuman::webview_accounts::{WechatScanPayload, list_ingest_payload, validate_scan, ...} (defined in webview_accounts/wechat_ingest.rs). wechat_scanner is wired unconditionally (lib.rs), so deleting the module breaks the desktop build — cargo check --manifest-path app/src-tauri/Cargo.toml fails without it. Suggest striking that acceptance criterion (or narrowing it to "confirm not RPC-registered", already true).
• memory_archivist NOT inlined. Its 44 LOC are not a pure re-export — they hold a real Config → MemoryConfig adapter (engine_config). Inlining would duplicate that across its call sites (a DRY regression) for no gain.

Submission Checklist

• N/A — removal-only change; no new behaviour to test. The redirect_links removal drops its own stale test assertion; the surviving schemas == controllers invariant remains covered by all_tests.rs.
• N/A — deletion-only diff; no new executable (non-test) lines to cover. Local builds green (below).
• N/A — none of the removed items appear in docs/TEST-COVERAGE-MATRIX.md.
• N/A — no matrix feature IDs affected.
• No new external network dependencies (removes dependencies only).
• N/A — no release-cut surface touched; redirect_links was RPC-only with no UI.
• Linked issue closed via Closes #5051 below.

Impact

• Build/deps: slimmer dep tree and binary — postgres/tokio-postgres, the opentelemetry stack, prometheus, dialoguer/console-fuzzy, clap_complete, shellexpand and their exclusive transitives leave Cargo.lock (both root and app/src-tauri). No version drift (0 new package stanzas).
• RPC surface: redirect_links.* methods are gone. They were never called by the pipeline or the frontend, so no user-visible change.
• Verified locally: GGML_NATIVE=OFF cargo check (default), GGML_NATIVE=OFF cargo check --no-default-features --features tokenjuice-treesitter, cargo check --manifest-path app/src-tauri/Cargo.toml, pnpm typecheck, and node scripts/generate-test-inventory.mjs all pass.
• Binary-size before/after deferred to CI (needs two release builds).

Related

• Closes Remove zero-reference dependencies and unwired domains #5051
• Follow-up PR(s)/TODOs: #5048 (inference gate), #5049 (desktop-automation gate), #5050 (lazy tool/config construction) — sibling contributors to the #5046 embedded RAM budget.

---

AI Authored PR Metadata (required for Codex/Linear PRs)

• N/A (human-authored)

Summary by CodeRabbit

• New Features
  • Added the memory_diff namespace with controller registration and updated CLI help text.
• Removed Features
  • Removed redirect-link shortening/expansion/rewrite management operations and the redirect_links namespace from known listings/public API.
• Documentation
  • Deleted the redirect-links documentation page.
• Security
  • Updated internal workspace denylist to stop treating redirect_links as protected legacy state.
• Chores
  • Streamlined Rust and web dependencies, including simplifying optional components and adjusting tui Unicode support.
• Tests
  • Updated namespace-description tests and the test inventory domain allowlist.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d631a84d-b4d3-4fa7-84ca-5e9e97727010

📥 Commits

Reviewing files that changed from the base of the PR and between 34ea62b and 28ef1c7.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml

🚧 Files skipped from review as they are similar to previous changes (1)

• Cargo.toml

---

📝 Walkthrough

Walkthrough

Unused Rust and npm dependencies are removed, with unicode-width retained only for the tui feature. The redirect_links domain is deleted from the public surface and related registries, while memory_diff is added to the core controller registry and namespace descriptions.

Changes

Dependency and domain cleanup

Layer / File(s)	Summary
Unused dependency removal Cargo.toml, app/package.json, package.json	Unused Rust and frontend packages are removed; unicode-width is reintroduced as an optional tui dependency.
Redirect-links retirement src/openhuman/redirect_links/*, src/openhuman/mod.rs, src/core/all_tests.rs, src/openhuman/security/policy/types.rs, scripts/generate-test-inventory.mjs	The redirect-links implementation, public module, namespace test, security-policy entry, and controller audit allowlist entry are removed.

Memory diff registration

Layer / File(s)	Summary
Memory-diff registry wiring src/core/all.rs	memory_diff controllers are registered under DomainGroup::Memory, and its namespace receives a description.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• tinyhumansai/openhuman#870: Introduced the redirect_links module and controller wiring removed here.
• tinyhumansai/openhuman#4523: Also removed TokenJuice tree-sitter* dependency declarations.
• tinyhumansai/openhuman#4808: Added the domain-controller registry wiring used by the memory_diff changes.

Suggested labels: rust-core

Poem

A rabbit trims the dependency hedge,
Redirect links hop away.
Memory diffs cross the registry edge,
While unicode-width stays.
Tidy crates brighten the day!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR removes the dead deps, npm packages, tree-sitter entries, and redirect_links, but it leaves webview_accounts and memory_archivist untouched.	Remove the remaining webview_accounts and memory_archivist domains, or update the linked issue scope if they are intentionally out of scope.
Out of Scope Changes check	❓ Inconclusive	The summary includes an unrelated memory_diff registration change, but the author says it pre-existed on main, so its PR provenance is unclear.	Confirm whether the memory_diff/all.rs edit is part of this PR; if so, split it out or remove it from the diff.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, specific, and matches the main change set: dependency cleanup plus removal of the redirect_links domain.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 694290747e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[YellowSnnowmann]

Scope notes for the two pre-merge check warnings

Both are advisory (CodeRabbit's review itself approved). Documenting the decisions here.

1. "Out of Scope Changes: memory_diff registration" — false positive. The memory_diff controller registration and namespace description in src/core/all.rs come from #3446 (1a01426e), which is already on main. This PR does not add them. After merging main (just pushed as b1e359bd9), the net memory_diff diff in all.rs is empty.

2. "Linked Issues: memory_archivist and webview_accounts left untouched"

• webview_accounts (core) is intentionally kept. The issue assumed its only references were the pub mod decl plus a doc-comment, but the core module is consumed cross-crate by the Tauri shell scanners — e.g. app/src-tauri/src/wechat_scanner/dom_snapshot.rs imports openhuman_core::openhuman::webview_accounts::{WechatScanPayload, list_ingest_payload, …}, and slack_scanner calls webview_accounts::forward_synthetic_notification. It is not dead; removing it breaks the Tauri build. Recording this under the issue's own "…or is documented with the reason it must stay" clause.
• memory_archivist inline deferred to a follow-up. Inlining the 44-LOC shim at its three call sites is an independent refactor with no dependency on the dead-dep / redirect_links removal. Keeping it separate keeps this PR removal-only and easy to review.

Delivered here: dead Rust crates, dead tree-sitter optional decls, dead npm packages (@rive-app/react-canvas, remotion, @remotion/player, @remotion/zod-types), and the redirect_links domain removal — with the legacy redirect_links dir retained on the workspace denylist per the security review (a1ac6106).

[CodeGhost21]

Review — clean, well-justified removal-only PR ✅

I independently verified the "zero reference" claims against the PR head (pull/5052/head) rather than trusting the description — they hold up.

Verification performed (PR head)

• redirect_links removal is complete — no leftover references anywhere except the intentional WORKSPACE_INTERNAL_DIRS denylist entry, which is correctly retained with a clear comment (protects a legacy redirect_links/links.db from agent read/write after an upgrade). Good security instinct.
• Dropped crates have zero first-party use — grepped every removed crate (unicode_normalization, unicode_segmentation, ripemd, mail_parser, async_imap, prost, postgres, shellexpand, prometheus, dialoguer, clap_complete, opentelemetry, tree_sitter) across src/, tests/, src/bin/, benches/ → 0 uses. Since Rust use requires a direct dependency (transitive availability doesn't enter the extern prelude), this is the check that actually gates the build, and it's clean.
• unicode-width gating is correct — its only consumer is src/openhuman/tui/render.rs:14,177,194 (UnicodeWidthStr), which lives behind the tui feature. tui is in the default feature set, so the default cargo check genuinely exercised this path. No non-tui code needs it.
• tree-sitter drop is safe — tokenjuice-treesitter = ["tinyjuice/tinyjuice-treesitter"] forwards only to the submodule (which owns its own grammars); nothing referenced dep:tree-sitter.
• npm — remotion* and @rive-app/react-canvas have zero imports in app/src.
• Invariant preserved — schemas.len() == controllers.len() still holds (both derive from one registry); the removed namespace_description("redirect_links") test assertion is the only test touched.

Minor notes (non-blocking)

1. PR-body framing mismatch (docs only): the body lists unicode-width under "Redundant direct declarations (only the direct decl is dropped)." That's inaccurate — it wasn't dropped, it was retained and converted to optional + tui-gated because tui/render.rs is its sole direct consumer. The code change is correct (and strictly better); only the description is misleading. CodeRabbit's "adjusting tui Unicode support" is the accurate characterization. Worth a one-line correction so future archaeologists aren't confused.
2. The old unicode-normalization Cargo.toml comment claimed use by memory_conversations::tokenize, but there are 0 direct uses on the PR head — that comment was already stale, so dropping it is fine.

Risk assessment

Very low. Pure deletion, no behavior change; redirect_links.* RPC methods were never wired into the message pipeline or the frontend, so their removal is invisible to users. The two intentional deviations from the linked issue — keeping the webview_accounts core domain (real cross-crate consumer in wechat_scanner) and not inlining memory_archivist (holds a real config adapter) — are correctly reasoned.

Nice, disciplined cleanup — looks safe to merge.