refactor: simplification sweep

[buremba]

One cohesive sweep of safe, low-risk simplifications surfaced by a 15-analyst
pass: dead-code deletion, de-duplication, and collapsing needless indirection.
No behavior change intended. make build-packages + bun run typecheck pass;
bun test in packages/core (254) and packages/connector-sdk (11) green;
plugin unit tests + manifest-contracts test green.

What changed (per area)

core

• Deleted unused PlatformError / SessionError error classes (zero refs) and their tests.
• Deleted unused safeJsonStringify.

connector-sdk

• Deleted the dead legacy IFeed contract, ParentFeedDefinition, SearchResult, and the entire FeedAuth* family from types.ts (zero refs anywhere — live connectors extend ConnectorRuntime / use ConnectorAuthSchema). Pruned the matching index.ts re-exports. ~170 LOC + a dozen confusing duplicate exports gone.

openclaw-plugin

• Deleted memory-wiki-compat.ts (~960-LOC dead-by-default "spike", zero in-repo callers, undocumented) + its test, the memoryWikiCompat config branch & resolver in index.ts, the MemoryWikiCompatConfig type, the manifest wiki_* / memory_* contracts.tools entries and memoryWikiCompat config-schema block, and the manifest-sync test wiring. Net ≈ −1100 LOC. (Published-package change; recoverable from git if ever wanted.)

server — gateway

• Deleted the unwired standalone gateway CLI: gateway/cli/index.ts, plus startGateway / startGatewayServer (and now-unused httpServer var + node:http / @hono/node-server imports) in gateway/cli/gateway.ts, and loadEnvFile / displayGatewayConfig (+ dotenv import + dead DISPLAY const) in gateway/config/index.ts. Prod runs server.bundle.mjs; embedded uses createGatewayApp — none of this was reachable.
• gateway/utils/rate-limiter.ts: dropped the dead FixedWindowRateLimiter class and getClientIp (only sweepExpiredRateLimits is live); deleted its test.
• Deleted the empty TelegramResponseStrategy extends DefaultResponseStrategy {} subclass + comment; case "telegram" falls through to default.
• agent-ownership.ts: collapsed resolveSettingsLookupUserId to the two-line form now that OAUTH_PLATFORMS is permanently empty.
• Folded the one-liner createTokenVerifier into agent-ownership.ts, deleted routes/shared/token-verifier.ts, updated the 3 import sites.

server — connect

• connect/oauth-providers.ts: resolveProviderConfig now returns a ResolvedProviderConfig with optional endpoint URLs; callers null-check the URL they actually use. Deleted the https://example.invalid/... placeholder args at all three call sites.

server — misc dedup/cleanup

• Deduped the pgBigintArray copy in __tests__/setup/test-fixtures.ts (import from db/client).
• Dropped the never-set resource field from the events/emitter.ts InvalidationEvent shape.
• Collapsed the no-op DEV_FALLBACK_FROM Record<EmailCategory,string> (identical values) to a single string in email/send.ts.

no-dynamic-imports rule (repo policy)

• Converted await import(...) → static imports in sandbox/namespaces/{knowledge,entities,watchers}.ts, watchers/reaction-executor.ts, server.ts (./lobu/gateway, ./db/client, ./scheduled/jobs), and index.ts (the per-request ./scheduled/scheduler-health import in /health/scheduler).
• Hoisted the require('@lobu/core') for decrypt to a top-level static import in lobu/stores/postgres-stores.ts.

Deferred (architectural / higher-risk — needs a dedicated PR)

• packages/core/src/logger.ts — drop the dead USE_WINSTON_LOGGER branch + SentryTransport + the winston dep. (Need to confirm no prod env relies on JSON log output.)
• packages/core/src/api-types.ts — delete the dead parallel API contract (~225 LOC), keeping at most ModelOption/PrefillSkill/AgentInfo. (Touches module-system.ts / token-service.ts re-declarations.)
• packages/core/src/modules.ts — delete registerAvailableModules (await import(packageName), never invoked with args). Touches agent-worker + server boot.
• packages/agent-worker/src/openclaw/worker.ts — extract runAISession (~600-line god method) into named phases. Large, hottest path, package's vitest suite not in CI.
• packages/agent-worker/src/openclaw/processor.ts + gateway/gateway-integration.ts — collapse the triple stream-delta dedup into the processor. User-visible streaming.
• packages/agent-worker/src/gateway/sse-client.ts ↔ worker.ts — break the import cycle (pendingConfigNotifications → own module) and kill the remaining await imports.
• packages/cli/src/{eval/client.ts, commands/chat.ts} — unify the two parallel Agent-API/SSE clients into internal/agent-api.ts.
• packages/cli/src/commands/memory/_lib/openclaw-auth.ts — collapse the memory-org/url wrappers + drop the lobu memory org subcommand (CLI-surface change).
• packages/cli/src/commands/_lib/apply/desired-state.ts — promote the hand-maintained packages/server mirrors (settings builder, slug/cron patterns, connector auth-schema) into @lobu/core / @lobu/connector-sdk. Cross-package, risky.
• packages/connectors/* — default the no-op execute() on ConnectorRuntime (or a shared helper) and delete the ~19 copies + the connector-schema fragment builders / review-scraper unification / whatsapp.ts+github.ts splits. Touches the catalog scanner / connector contract.
• packages/connector-worker/src/executor/runtime.ts + child-runner.ts — replace the __*-key IPC smuggling with a first-class mode field; also the SDK↔worker FeedSyncResult / ContentItem unification. Hot path, both ends change together.
• packages/server/src/gateway/orchestration/{base-deployment-manager,impl/embedded-deployment}.ts — collapse BaseDeploymentManager into the only concrete EmbeddedDeploymentManager (embedded-only doctrine). Large mechanical diff on the worker-spawn path.
• packages/server/src/gateway/connections/chat-instance-manager.ts — extract the platform file-handler factories into connections/platform-file-handlers.ts (~340 LOC).
• packages/server/src/gateway/connections/interaction-bridge.ts — ExpiringClaimMap<T> to dedup the 3 TTL-claim maps.
• packages/server/src/gateway/routes/internal/device-auth.ts (846 LOC) — split secret-store CRUD + OAuth-endpoint resolution + device-auth flow out of the routes file. Wide blast radius (proxy, resume-after-oauth).
• packages/server/src/gateway/routes/public/agent.ts — split the ~300-line sendMessageRoute handler (multipart parse / platform route / direct enqueue). Hot send path.
• packages/server/src/gateway/proxy/http-proxy.ts — pass grant/policy stores + egress judge explicitly instead of via setProxyX() module-level mutable singletons. Security-critical.
• packages/server/src/gateway/services/core-services.ts (1041 LOC) — group the 50+ optional fields into cohesive sub-containers. Touches everything reading coreServices.*.
• packages/server/src/db/client.ts — delete simpleQuery() / DbQuery.simple? (no-op identity) — ~34 mechanical edits across tools/resolve_path.ts + workspace/multi-tenant.ts; deferred to avoid an error-prone regex pass in this sweep. Same for createDbClientFromEnv(env) → getDb() (27 call sites).
• packages/server/src/db/embedded-schema-patches.ts — teach the embedded path to run the dbmate migrations so this duplicate-of-every-migration file can go away. Touches every embedded user's DB on next boot.
• packages/server/src/watchers/{automation,run-completion}.ts — unify the duplicated watcher run-state mutation helpers into watchers/run-state.ts.
• packages/server/src/notifications/{triggers,service}.ts — collapse the 4 "notify admins" clones behind a notifyOrgAdmins helper; fix deliverToBotConnections per-user fan-out (channel posts N× per N admins).
• packages/server/src/auth/jwt-ish — utils/jwt.ts rewrite on node:crypto (drop the crypto.subtle + btoa/atob dance); oauth/utils.ts collapse the 7 generate* token wrappers to generateSecureToken + the 3 prefixed ones; consolidate the 3 "resolve public base URL" helpers (auth/base-url.ts, utils/public-origin.ts, utils/url-builder.ts).
• packages/server/src/lobu/{gateway,stores/postgres-stores}.ts — type the any module-level singletons in gateway.ts (cascades into route handlers); fold resolveDefaultOrgId into the multi-tenant TtlCache; extract the 5×-copied upsertChannelBinding; dedup the org-scoped/id-only query forking in postgres-stores.ts; confirm-and-delete the enc:v1: legacy decrypt path.
• packages/server/src/{server,start-local,index}.ts — extract a shared bootHttpServer() consumed by both entrypoints (kills the drifted ~120-line copy-paste); move the /api/:orgSlug/* block out of index.ts into an orgApiRoutes sub-router.
• packages/server/src/__tests__ — relocate fixtures/fake-llm-server.test.ts out of fixtures/; convert the 8 bun:test __tests__ files to vitest; wire the ~38 vitest integration files into CI.
• packages/landing/* — dedup the Cloudflare functions/ PagesFunction type + collapse the twin mcp entrypoints; split HeroProductCard.tsx (2948 LOC); replace gen-platform-configs.ts's regex-scrape of packages/server Zod source with an exported artifact.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!