chore(ci): run the knip dead-code gate for the repository root and every workspace

.github/workflows/ci.yml

@@ -296,13 +296,22 @@ jobs:
         if: steps.plan.outputs.code == 'true'
         run: npm run astryx:theme -- --check
 
-      - name: Knip (apps/desktop)
+      - name: Knip (root + all workspaces)
         if: steps.plan.outputs.code == 'true'
-        run: npx knip --workspace apps/desktop
-
-      - name: Knip (packages/ui)
-        if: steps.plan.outputs.code == 'true'
-        run: npx knip --workspace packages/ui
+        run: |
+          # A plain run covers the root workspace plus every configured
+          # workspace and is a strict superset of the per-workspace
+          # invocations. The coverage and root-pin-parity guards live in
+          # scripts/check-knip-workspace-coverage.mjs with their own tests.
+          #
+          # Intentional knip exceptions (kept, not oversights):
+          # - patch-package: apply-dependency-patches.mjs resolves it through
+          #   createRequire by design, so the gate cannot see that use.
+          # - cookie (website): astro's prerenderer imports { parseCookie }
+          #   from 'cookie' and vite resolves the bare specifier through the
+          #   website root, so the workspace pin decides which copy loads.
+          node scripts/check-knip-workspace-coverage.mjs
+          npx knip
 
       - name: Linux sandbox smoke
         if: steps.plan.outputs.runtime_sandbox == 'true'

CONTRIBUTING.md

@@ -72,8 +72,7 @@ npm run lint
 npm run format:check
 npm run build
 npm run typecheck
-npx knip --workspace apps/desktop
-npx knip --workspace packages/ui
+npx knip
 ```
 
 Architecture is documented in [ARCHITECTURE.md](./ARCHITECTURE.md); evaluation commands and contracts live in [`packages/eval`](./packages/eval).

CONTRIBUTING.zh-CN.md

@@ -72,8 +72,7 @@ npm run lint
 npm run format:check
 npm run build
 npm run typecheck
-npx knip --workspace apps/desktop
-npx knip --workspace packages/ui
+npx knip
 ```
 
 架构说明见 [ARCHITECTURE.zh-CN.md](./ARCHITECTURE.zh-CN.md)；Eval 的命令与 contract 见 [`packages/eval`](./packages/eval)。

knip.json

@@ -3,6 +3,62 @@
   "ignoreExportsUsedInFile": true,
   "tags": ["-knipignore"],
   "workspaces": {
+    ".": {
+      "entry": [
+        "scripts/audit-alignment.mjs",
+        "scripts/computer-use/direct-runtime-ledger.mjs",
+        "scripts/computer-use/e2e-fixture.mjs",
+        "scripts/computer-use/prepare.mjs",
+        "scripts/computer-use/process-restart-harness.mjs",
+        "scripts/computer-use/process-restart-launcher.mjs",
+        "scripts/computer-use/provider-matrix.mjs",
+        "scripts/computer-use/real-ax-harness.mjs",
+        "scripts/computer-use/real-ax-launcher.mjs",
+        "scripts/computer-use/real-model-fixture.mjs",
+        "scripts/computer-use/real-model.mjs",
+        "scripts/generate-cu-status-icons.mjs",
+        "scripts/issue-pr-lifecycle.mjs",
+        "scripts/perf/*.js",
+        "scripts/perf/*.mjs",
+        "scripts/pip-interaction-smoke.mjs",
+        "scripts/pr-effort.mjs",
+        "scripts/prepare-deepseek-harness-toolchain.mjs"
+      ],
+      "project": ["scripts/**/*.{mjs,js,cjs}"],
+      "ignoreBinaries": ["gpg", "swift"],
+      "ignoreDependencies": ["patch-package"]
+    },
+    "packages/runtime": {
+      "entry": ["src/filesystem-worker/worker-entry.ts"],
+      "project": ["src/**/*.ts", "scripts/*.mjs"]
+    },
+    "packages/runtime-host": {
+      "ignoreBinaries": ["mkfifo", "taskkill.exe"],
+      "entry": [
+        "src/__tests__/fixtures/stderr-after-launcher-exit.ts",
+        "src/__tests__/fixtures/windows-local-ipc-trust-host.ts"
+      ],
+      "project": ["src/**/*.ts", "scripts/*.mjs"],
+      "ignoreIssues": {
+        "src/protocol/artifact.ts": ["duplicates"],
+        "src/protocol/session-transcript.ts": ["duplicates"],
+        "src/protocol/usage-pricing.ts": ["duplicates"]
+      }
+    },
+    "packages/storage": {
+      "ignoreBinaries": ["mkfifo"],
+      "entry": [
+        "src/__tests__/fixtures/session-bundle-hydration-binding-crash.ts",
+        "src/__tests__/fixtures/session-bundle-hydration-owner-write-failure.ts",
+        "src/__tests__/fixtures/session-bundle-inspect-child.ts",
+        "src/__tests__/fixtures/session-bundle-inspect-source-mutator.ts",
+        "src/__tests__/fixtures/session-bundle-pack-destination-replacer.ts",
+        "src/__tests__/fixtures/session-bundle-pack-link-replacer.ts",
+        "src/__tests__/fixtures/session-bundle-pack-linked-temp-remover.ts",
+        "src/__tests__/fixtures/session-bundle-pack-temp-replacer.ts"
+      ],
+      "project": ["src/**/*.ts"]
+    },
     "apps/desktop": {
       "entry": [
         "src/main/main.ts",
@@ -27,8 +83,29 @@
     },
     "packages/ui": {
       "entry": ["src/**/*.test.ts", "src/**/*.test.tsx", "stories/**/*.@(ts|tsx)"],
-      "project": ["src/**/*.{ts,tsx}", "stories/**/*.{ts,tsx}"],
+      "project": ["src/**/*.{ts,tsx}", "stories/**/*.{ts,tsx}", "scripts/*.mjs"],
       "ignoreDependencies": ["@storybook/react-vite", "storybook"]
+    },
+    "packages/core": {
+      "project": ["src/**/*.ts"]
+    },
+    "packages/mcp": {
+      "project": ["src/**/*.ts"]
+    },
+    "packages/computer-use": {
+      "project": ["src/**/*.ts"]
+    },
+    "packages/cli": {
+      "project": ["src/**/*.ts", "scripts/*.mjs"]
+    },
+    "packages/eval": {
+      "entry": ["harbor/deepseek-harness-toolchain/patch-subprocess-local.mjs"],
+      "project": ["src/**/*.ts", "harbor/**/*.mjs"],
+      "ignoreBinaries": ["taskkill.exe"]
+    },
+    "website": {
+      "ignoreDependencies": ["cookie"],
+      "project": ["src/**/*.{ts,astro,mjs}", "scripts/*.mjs", "test/*.mjs"]
     }
   }
 }

package.json

@@ -121,7 +121,15 @@
     "knip": "^6.33.0",
     "patch-package": "8.0.1",
     "typescript": "^7.0.2",
-    "yaml": "2.9.0"
+    "yaml": "2.9.0",
+    "electron": "43.4.1",
+    "electron-builder": "26.15.3",
+    "electron-updater": "^6.8.9",
+    "@playwright/test": "^1.62.1",
+    "@babel/parser": "7.29.7",
+    "ws": "^8.21.3",
+    "app-builder-lib": "26.15.3",
+    "builder-util": "26.15.3"
   },
   "allowScripts": {
     "esbuild@0.27.7": true,

packages/cli/src/activation-command.ts

@@ -42,7 +42,6 @@ const ACTIVATION_STIMULUS_TYPES = new Set(['message', 'schedule', 'system']);
 
 export type MakaActivationStatus = 'completed' | 'blocked' | 'retryable_failure' | 'fatal_failure';
 
-export type MakaActivationBlockedReason = 'permission_denied' | 'permission_required';
 export type MakaActivationRequiredAction = 'grant_permission' | 'retry_activation';
 
 export interface MakaActivationOptions {

packages/cli/src/runtime-host-service-manager.ts

@@ -1237,10 +1237,6 @@ async function normalizeStateRoot(requestedRoot: string): Promise<string> {
   }
 }
 
-export async function resolveRuntimeHostManagedStateRoot(requestedRoot: string): Promise<string> {
-  return normalizeStateRoot(requestedRoot);
-}
-
 async function normalizeProjectDirectoryRoots(
   roots: readonly { readonly label: string; readonly path: string }[],
 ): Promise<readonly { readonly label: string; readonly path: string }[]> {

packages/cli/src/workspace-root.ts

@@ -24,8 +24,4 @@ export {
   resolveMakaClientDataRoot,
   resolveMakaDataRoots,
   resolveMakaWorkspaceRoot,
-  type DeriveMakaDataRootsInput,
-  type MakaDataRoots,
-  type ResolveMakaClientDataRootInput,
-  type ResolveMakaWorkspaceRootInput,
 } from '@maka/storage/workspace-root';

packages/core/src/computer-use.ts

@@ -159,7 +159,6 @@ export interface ComputerUseBoundAction extends ComputerUseFrameIdentity {
 
 export const CU_ACTION_TYPES = ['screenshot', 'type', 'key', 'wait'] as const;
 
-export const COMPUTER_USE_ACTION_TYPES = CU_ACTION_TYPES;
 export type CuActionType = (typeof CU_ACTION_TYPES)[number];
 
 /**

packages/runtime-host/protocol-compatible-changes/project-catalog-path-limit-unexport.json

@@ -0,0 +1,5 @@
+{
+  "epoch": 123,
+  "files": ["packages/runtime-host/src/protocol/project-catalog.ts"],
+  "reason": "Unexports two path-limit constants that are referenced only inside project-catalog.ts itself; no wire codec, frame, or error-code shape changes and no consumer imports either name"
+}

packages/runtime-host/src/peer-mesh/limits.ts

@@ -21,7 +21,6 @@ export const PEER_MESH_MAX_MEMBERS = 64;
 export const PEER_MESH_MAX_MESHES = 16;
 export const PEER_MESH_MAX_PENDING_INVITATIONS = 32;
 export const PEER_MESH_MAX_INVITATION_RECORDS = PEER_MESH_MAX_PENDING_INVITATIONS * 3;
-export const PEER_MESH_MAX_ROUTE_HINTS = 16;
 export const PEER_MESH_MAX_TRANSIT_RELAY_ADDRESSES = 256;
 export const PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY = 4;
 export const PEER_MESH_MEMBER_ADVERTISEMENT_MAX_BYTES = 2 * 1024;

packages/runtime-host/src/peer-mesh/model.ts

@@ -39,10 +39,8 @@ export {
   PEER_MESH_MAX_MEMBERS,
   PEER_MESH_MAX_MESHES,
   PEER_MESH_MAX_PENDING_INVITATIONS,
-  PEER_MESH_MAX_ROUTE_HINTS,
   PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY,
   PEER_MESH_MAX_TRANSIT_RELAY_ADDRESSES,
-  PEER_MESH_MEMBER_ADVERTISEMENT_MAX_BYTES,
 } from './limits.js';
 
 export interface PeerMeshRosterV1 {

packages/runtime-host/src/protocol/project-catalog.ts

@@ -34,14 +34,14 @@ export const PROJECT_CATALOG_PAGE_MAX_ITEMS = 64;
 export const PROJECT_CATALOG_PAGE_MAX_BYTES = 48 * 1024;
 export const PROJECT_CATALOG_CURSOR_MAX_BYTES = 128;
 export const PROJECT_CATALOG_NAME_MAX_BYTES = 16 * 1024;
-export const PROJECT_CATALOG_PATH_MAX_BYTES = 4 * 1024;
+const PROJECT_CATALOG_PATH_MAX_BYTES = 4 * 1024;
 export const PROJECT_DIRECTORY_PAGE_MAX_ITEMS = 128;
 export const PROJECT_DIRECTORY_PAGE_MAX_BYTES = 32 * 1024;
 export const PROJECT_DIRECTORY_MAX_ENTRIES = 4_096;
 export const PROJECT_DIRECTORY_MAX_ROOTS = 8;
 export const PROJECT_DIRECTORY_MAX_SEGMENTS = 64;
 export const PROJECT_DIRECTORY_ROOT_LABEL_MAX_BYTES = 128;
-export const PROJECT_DIRECTORY_ROOT_PATH_MAX_BYTES = PROJECT_CATALOG_PATH_MAX_BYTES;
+const PROJECT_DIRECTORY_ROOT_PATH_MAX_BYTES = PROJECT_CATALOG_PATH_MAX_BYTES;
 export const PROJECT_DIRECTORY_SEGMENT_MAX_BYTES = 255;
 
 const PROJECT_DIRECTORY_ROOT_TEXT_ENCODER = new TextEncoder();

packages/runtime-host/src/server/agent-graph-coordinator.ts

@@ -211,12 +211,6 @@ export function projectAgentGraphClientSnapshot(
   return projectSnapshot(snapshot);
 }
 
-export function projectAgentGraphOperatorInspection(
-  inspection: RuntimeAgentGraphOperatorInspection,
-): AgentGraphOperatorInspection {
-  return projectInspection(inspection);
-}
-
 function projectSnapshot(snapshot: RuntimeAgentGraphClientSnapshot): AgentGraphClientSnapshot {
   const operators = snapshot.operators.slice(0, AGENT_GRAPH_MAX_OPERATORS).map(projectOperator);
   const visibleOperatorIds = new Set(operators.map((operator) => operator.operatorId));

packages/runtime-host/src/server/client-capability-coordinator.ts

@@ -45,7 +45,6 @@ import {
 import {
   ClientCapabilityInvocationBroker,
   ClientCapabilityInvocationError,
-  type ClientCapabilityInvocationFailure,
 } from './client-capability-invocation-broker.js';
 import type {
   ClientCapabilityOperationHandlerMap,
@@ -78,7 +77,6 @@ const DESKTOP_BROWSER_TOOLS = new Set([
 const DESKTOP_SETTINGS_TOOLS = new Set(['MakaClientSettingsGet', 'MakaClientSettingsUpdate']);
 
 export { ClientCapabilityInvocationError };
-export type { ClientCapabilityInvocationFailure };
 
 export interface ClientCapabilitySnapshot {
   readonly registrationIds: readonly string[];

packages/runtime-host/src/server/host-kernel.ts

@@ -182,8 +182,6 @@ interface RuntimeHostKernelCommonOptions {
   };
 }
 
-export type RuntimeHostLifecycleMode = 'ephemeral' | 'service';
-
 export type RuntimeHostKernelOptions = RuntimeHostKernelCommonOptions &
   (
     | {

packages/runtime/src/__tests__/provider-contract-matrix.ts

@@ -62,8 +62,6 @@ export const PROVIDER_CONTRACT_DIMENSIONS = [
 
 export type ProviderContractDimension = (typeof PROVIDER_CONTRACT_DIMENSIONS)[number];
 
-export type ProviderContractCellState = 'generated' | 'override' | 'not-applicable';
-
 /** The four request wires a generated cell can be executed against. */
 export type ProviderContractWire =
   | 'openai-chat'

packages/runtime/src/agent-run-inspect.ts

@@ -162,27 +162,6 @@ export async function inspectAgentRunReadModel(
   };
 }
 
-export async function inspectSessionRunReadModels(
-  runStore: AgentRunInspectReader,
-  runtimeEventStore: RuntimeEventInspectReader,
-  sessionId: string,
-  options: Pick<InspectAgentRunOptions, 'isFatalReadError'> = {},
-): Promise<AgentRunInspectModel[]> {
-  const invocations = await runtimeEventStore.listSessionInvocations(sessionId);
-  const models: AgentRunInspectModel[] = [];
-  for (const invocation of invocations) {
-    models.push(
-      await inspectAgentRunReadModel(runStore, runtimeEventStore, {
-        sessionId,
-        runId: invocation.runId,
-        invocation,
-        ...(options.isFatalReadError ? { isFatalReadError: options.isFatalReadError } : {}),
-      }),
-    );
-  }
-  return models;
-}
-
 // A run is not its invocation: a continuation is a new run on the invocation it
 // resumes. This reader is addressed by run, so it looks the invocation up by the
 // id it was actually given.

packages/runtime/src/compaction-boundary.ts

@@ -39,46 +39,6 @@ export interface CompactionCoverage {
   providerMessageSourceIds?: readonly string[];
 }
 
-export interface CompactionArchiveRef {
-  kind: 'toolResult' | 'runtimeEventSource' | 'compactSource';
-  sessionId?: string;
-  turnId?: string;
-  runtimeEventId?: string;
-  toolCallId?: string;
-  toolName?: string;
-  artifactId: string;
-  bodySha256: string;
-  originalEstimatedTokens?: number;
-  originalBytes?: number;
-}
-
-export interface CompactionBoundary {
-  kind: CompactionBoundaryKind;
-  stage: CompactionStage;
-  schemaVersion: number;
-  boundaryId: string;
-  predecessorBoundaryId?: string;
-  cumulativeCoverageDigest?: string;
-  sessionId: string;
-  createdAt?: number;
-  highWaterName?: string;
-  highWaterSeq?: number;
-  coverage: CompactionCoverage;
-  preservedAnchor?: {
-    headProviderMessageSourceIds?: readonly string[];
-    headRuntimeEventIds?: readonly string[];
-    tailRuntimeEventIds?: readonly string[];
-    tailProviderMessageSourceIds?: readonly string[];
-    tailTurnIds?: readonly string[];
-  };
-  archiveRefs?: readonly CompactionArchiveRef[];
-  sourceHashes?: readonly string[];
-  renderedText?: string;
-  estimatedTokens?: number;
-  validationStatus?: 'valid' | 'invalid' | 'notValidated';
-  validationReason?: string;
-}
-
 export interface CompactionDecision {
   stage: CompactionStage;
   sourceKind: CompactionSourceKind;