Ponytail-audit: ~4.8k lines / 5 deps removable (one finding is ~3.9k of it)

[harshitsinghbhandari]

A repo-wide ponytail-audit hunting only for over-engineering and complexity (correctness/security/perf were explicitly out of scope). Run across ~87k LOC with 8 parallel scoped passes. Findings ranked biggest cut first.

TL;DR: ~4,800 lines and 5 deps are removable, but ~3,900 of those lines are one finding: the 23 agent adapters are near-identical copy-paste. Everything else is rounding error by comparison.

Tier 1 — The big cut: agent-adapter duplication (~3,900 lines)

The 23 adapters in backend/internal/adapters/agent/* reimplement the same logic per-adapter.

• yagni: 6 hooks.go files (claudecode, qwen, codex, droid, agy, goose) reimplement the same settings-JSON hook engine (readXSettings/writeXSettings/groupXHooksByEvent/isXManagedHook/parseXHookType/addXHook/matchersEqual + matcher/spec structs). Hoist one generic hookjson helper; adapters keep only their hook list + paths. ~1,500 lines.
• shrink: 23 copies of ResolveXBinary (identical PATH lookup + windows .cmd/.exe block + /usr/local/bin,/opt/homebrew/bin candidates) → one hookutil.ResolveBinary(ctx, name, extra...). ~1,100 lines.
• shrink: 16 byte-identical normalizePermissionMode + ~17 near-identical appendPermissionFlags → package-level normalizePermissionMode + ClaudeStylePermissionFlags(cmd, mode). ~300 lines.
• shrink: 23 copies of binaryMu sync.Mutex/resolvedBinary + per-adapter cache method → one embeddable binaryCache.Get(ctx, resolveFn). ~250 lines.
• shrink: ~10 DeriveActivityState funcs are the same string-switch → activitydispatch.DeriveStandardEvent. ~250 lines.
• shrink: ~22 no-op GetConfigSpec + 23 identical GetPromptDeliveryStrategy → embeddable defaultAgent base. ~200 lines.
• shrink: ~15 identical SessionInfo-from-metadata methods → one hookutil.SessionInfoFromMetadata. ~200 lines.
• shrink: 23 identical fileExists (os.Stat+!IsDir) → one hookutil.FileExists. ~90 lines.
• stdlib: qwen atomicWriteFile + claudecode temp+rename duplicate existing hookutil.AtomicWriteFile. ~50 lines.

Tier 2 — Dead legacy paths (~410 lines)

• delete: legacy Observe lump in scm/github/provider.go:98-656 (Observe, restPull, fetchGraphQL, parsePRURL, +9 more) — no non-test caller; live path is observer_provider.go. ~155 lines.
• delete: whole file internal/ports/pr_observations.go:1-55 (PRObserver, PRObservation, ErrSCMPRNotFound) — zero users; live path is SCMObservation.
• delete: frontend/.../ui/sidebar.tsx — 8 never-imported shadcn parts (SidebarRail, SidebarInset, SidebarMenuBadge…). ~120 lines.
• delete: landing/components/LandingDifferentiators.tsx — zero importers. ~58 lines.
• delete: app/docs/404/page.tsx — unreachable; Next routes to existing not-found.tsx.

Tier 3 — Speculative single-impl abstractions (yagni)

• yagni: adapters/registry.go:1-83 top-level Registry — no production registrant; agent/reviewer registries are separate. Delete.
• yagni: reviewer package = registry+resolver+interface over exactly one product (claudecode). Collapse to direct claudecode.New() or a 3-line map.
• yagni: service/pr ActionManager interface + ActionService stub — interface seam over a stub that fabricates success. Collapse or delete until the SCM merge path exists.
• yagni: scm/github/auth.go FallbackTokenSource+tokenInvalidator fan-out — prod wires a single source.
• yagni: httpd/controllers/dto.go:44-94 ProjectOrDegraded custom marshaler — the comment admits the real guard is upstream; omitempty + nil-check does it.
• yagni: ports.AgentMessenger / runtimeMessageSender single-method ports over the one concrete *zellij.Runtime.

Tier 4 — Frontend dead exports/variants (~230 lines)

• delete: types/workspace.ts exports referenced only by their own tests (mergedPRCount, primaryPR, workerStatusPulses, sessionNeedsAttention, workerStatusLabel, attentionZoneLabel/Order) + their tests. ~50 lines.
• delete: unused WorkspaceSummary fields (type/diff/accentColor), displayStatus, ChangedFile.
• delete: WorkbenchTab state in ui-store.ts (comment says selection moved to URL).
• delete: unused Badge variants (neutral/accent/success/warning/error) + Button secondary/icon-sm.

Tier 5 — Deps removable (frontend)

• native: 4 deps @radix-ui/react-{dialog,slot,tabs,tooltip} → already-present umbrella radix-ui re-exports all four. -4 deps.
• yagni: bare playwright alongside @playwright/test (borderline). -1 dep.

Tier 6 — Small stdlib/shrink one-liners

• stdlib: cli/doctor.go:509-554 hand-rolled compareDottedVersion → golang.org/x/mod/semver.Compare (already in module graph).
• shrink: cli confirm prompts (confirm/confirmProjectRemoval/confirmSessionCleanup) → one promptLine helper.
• shrink: cli/client.go patchJSON/putJSON/deleteJSON one-line wrappers → inline http.Method*.
• stdlib: httpd/logger.go loggerOrDefault → cmp.Or(log, slog.Default()).
• shrink: service/project/service.go:431 isGitRepo tail is dead → return strings.EqualFold(top, path).
• delete: unused gen query DeletePRReviewThreads, cdc.SubscriberCount(), terminal/attachment.isExited(), RemovedStorageDir field.
• Plus ~12 more one-line wrapper inlines across cli, session_manager, daemon, lifecycle, zellij.

Net

net: ~-4,800 lines, -5 deps possible.

The single highest-leverage move by far is a shared hookutil/defaultAgent base for the 23 agent adapters (~80% of the total). I'd scope that as its own focused PR (introduce hookutil + defaultAgent, migrate adapters in batches) rather than folding it into other cleanup.

Explicitly NOT flagged (genuinely lean)

The apispec code-first generator + drift test, the SCM observer diff/persistence machinery, the CDC poller, terminal attach loop, gen/ sqlc output, src/api/schema.ts (generated), the src/shared/* testability splits, and the //go:build platform forks. These earn their keep.