cleanup opportunities

Cleanup opportunities

A single page cataloguing outstanding markers, complexity hotspots, and dependency freshness notes. Only findings that actually exist are listed; a section with no findings is omitted.

TODO, FIXME, and HACK markers

There are exactly four TODO markers in source (non-test, non-generated code under packages/*/src), and all four are in packages/coding-agent kernel code, tied to a pending RLM-1 milestone:

• packages/coding-agent/src/core/tools/ipython.ts:1, TODO: reconsider whether the persistent kernel is needed once RLM-1 weights land.
• packages/coding-agent/src/core/kernel/index.ts:1, TODO: reconsider persistent kernel vs stateless python -c once RLM-1 weights land.
• packages/coding-agent/src/core/kernel/index.ts:1507, TODO: plumb AbortSignal through AgentSession.prompt so disposal can cancel long-running child loops.
• packages/coding-agent/src/core/kernel/index.ts:1522, TODO: replace this best-effort hard-exit path if Node exposes an awaitable process-exit cleanup hook.

The test suite carries additional markers that are separate from the source count: the ai test files packages/ai/test/tokens.test.ts and packages/ai/test/image-tool-result.test.ts contain several FIXME(xiaomi) comments about Xiaomi's Anthropic-compatible streaming and multimodal-fusion API behavior. These are test-only notes, not production debt.

Complexity hotspots

• packages/coding-agent/src/core/agent-session.ts, 11,210 lines (~11.2k). The largest hand-written source file; it is the central session runtime, which is why it is large, but it is the clearest target for future decomposition.
• packages/coding-agent/test/daemon-mode.test.ts, 9,910 lines (~9.9k). The largest test file; exercises daemon-mode behavior extensively.
• packages/ai/src/models.generated.ts, 20,577 lines (~20.6k). This is the largest file in the tree but it is generated, not hand-written. It is updated only through packages/ai/scripts/generate-models.ts and regenerated, so it is not a reviewable hotspot in the same sense as the hand-written files.

Dependency freshness

• The root npm workspace enforces a 7-day minimum release age for dependency resolution via .npmrc (min-release-age=7). Enforcement requires npm >= 11.10; older npm silently ignores the key, and urgent security patches override with npm install --min-release-age=0 <pkg>. Already-locked versions and npm ci are unaffected.
• The web/ pnpm workspace applies the matching policy with minimumReleaseAge: 10080 (7 days in minutes) in web/pnpm-workspace.yaml, so the web stack has the same cooldown on new resolutions.
• Highlighter versions are unified through a web/pnpm-workspace.yaml override: shiki: 4.4.2. This resolves a type conflict where streamdown's published .d.ts imports shiki while @streamdown/code pins 3.x and @pierre/diffs pins 4.x; pinning all of them to 4.4.2 keeps the highlighter types consistent.
• Package versions are kept in lockstep: all four core packages share the same version (currently 0.7.1), enforced by scripts/sync-versions.js, so there is no per-package version drift to clean up. The root and packages/coding-agent manifests carry recent caret ranges, and because min-release-age governs new resolutions, there is no stale-lockfile path to chase for ordinary updates.

Related pages

• Patterns and conventions, dependency update rules and the generated-models constraint
• Release pipeline, lockstep versioning and scripts/sync-versions.js
• Design decisions, the seam and kernel rationale