Dependencies: remove unused extension packages by vincentkoc · Pull Request #38317 · openclaw/openclaw

vincentkoc · 2026-03-06T20:23:19Z

Summary

Problem: Knip reported @urbit/http-api as unused in the Tlon extension manifest.
Why it matters: removing only the genuinely unused package keeps the dead-code cleanup moving without disturbing the extension's bundled runtime dependencies.
What changed: removed @urbit/http-api from extensions/tlon/package.json and cleaned the matching lockfile entries.
What did NOT change (scope boundary): kept acpx bundled in ACPX, kept @tloncorp/tlon-skill bundled in Tlon, and preserved the git-based @tloncorp/api lock resolution.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related Dependencies: remove unused core and UI packages #38316
Related Dead code: remove unused helper modules #38318

User-visible / Behavior Changes

None.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (No)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: pnpm / Node 22 workspace
Model/provider: N/A
Integration/channel (if any): Tlon
Relevant config (redacted): none

Steps

Run pnpm deadcode:knip on main after the Knip config lands.
Observe @urbit/http-api in the Tlon extension dependency findings.
Remove only that package and rerun Knip.

Expected

@urbit/http-api disappears from the unused dependency findings while bundled runtime dependencies remain untouched.

Actual

On this branch, @urbit/http-api is no longer reported; acpx and @tloncorp/tlon-skill are intentionally retained.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: searched for @urbit/http-api imports and reran pnpm deadcode:knip after the narrow cleanup.
Edge cases checked: restored ACPX/Tlon bundled dependencies and removed the accidental codeload tarball resolution from the lockfile.
What you did not verify: full Tlon integration tests.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert the Tlon manifest cleanup commit.
Files/config to restore: extensions/tlon/package.json, pnpm-lock.yaml.
Known bad symptoms reviewers should watch for: missing Tlon module resolution during install.

Risks and Mitigations

Risk: @urbit/http-api could be used by an unsearched generated/runtime path.
- Mitigation: repo-wide search found no imports, and the branch intentionally keeps the runtime-critical ACPX and Tlon bundled dependencies unchanged.

greptile-apps · 2026-03-06T21:56:10Z

Greptile Summary

This PR removes three unused npm dependencies — acpx from the ACPX extension and @tloncorp/tlon-skill + @urbit/http-api from the Tlon extension — and refreshes the lockfile accordingly. A full-repo grep confirms none of the removed packages are imported anywhere in the extension source files (all acpx-prefixed imports in the ACPX extension resolve through the internal openclaw/plugin-sdk/acpx path, not the npm package), so the removals are safe and the scope is well-contained.

extensions/acpx/package.json: [email protected] correctly removed; leaves an empty dependencies: {} which is harmless.
extensions/tlon/package.json: @tloncorp/[email protected] and @urbit/http-api@^3.0.0 correctly removed along with all their transitive dependencies.
pnpm-lock.yaml: Correctly updated to reflect the dependency removals.

All three unused dependency removals have been verified as safe with no imports in the codebase, and the lockfile changes correctly reflect the updated manifest dependencies.

Confidence Score: 5/5

Safe to merge. All removed dependencies have zero imports in the codebase and lockfile is correctly updated.
Score 5/5. This is a straightforward, low-risk chore: three unused packages are confirmed to have zero code imports anywhere in the repository, their removal from extension manifests is verified correct, and the lockfile reflects the changes accurately. No functional behavior changes, no runtime impact, no security considerations. Author has verified core functionality (Knip dependency reports) pass as expected. This is a clean, well-scoped cleanup that improves the repo's dead-code report accuracy.
No files require special attention.

_{Last reviewed commit: f389ea7}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f389ea7966

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

extensions/tlon/package.json

* Dependencies: drop unused extension packages * Dependencies: drop unused tlon http-api package * Dependencies: keep bundled acpx package

* Dependencies: drop unused extension packages * Dependencies: drop unused tlon http-api package * Dependencies: keep bundled acpx package (cherry picked from commit 75981b0)

Dependencies: drop unused extension packages

e533e2d

vincentkoc self-assigned this Mar 6, 2026

openclaw-barnacle bot added channel: tlon Channel integration: tlon extensions: acpx size: XS maintainer Maintainer-authored PR labels Mar 6, 2026

vincentkoc mentioned this pull request Mar 6, 2026

Dead code: remove unused helper modules #38318

Merged

18 tasks

vincentkoc marked this pull request as ready for review March 6, 2026 21:52

Merge branch 'main' into vincentkoc-code/deadcode-unused-deps-extensions

f389ea7

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

extensions/tlon/package.json Show resolved Hide resolved

vincentkoc added 2 commits March 6, 2026 19:13

Dependencies: drop unused tlon http-api package

8de2309

Dependencies: keep bundled acpx package

272becf

openclaw-barnacle bot removed the extensions: acpx label Mar 7, 2026

vincentkoc mentioned this pull request Mar 7, 2026

Dependencies: remove unused core and UI packages #38316

Merged

18 tasks

Merge branch 'main' into vincentkoc-code/deadcode-unused-deps-extensions

4faa48f

vincentkoc merged commit 75981b0 into main Mar 7, 2026
27 of 28 checks passed

vincentkoc deleted the vincentkoc-code/deadcode-unused-deps-extensions branch March 7, 2026 00:55

github-actions bot mentioned this pull request Mar 7, 2026

📡 Upstream Digest — 2026-03-07 01:15 UTC curtismercier/openclaw-mods#196

Open

alexyyyander mentioned this pull request Mar 7, 2026

fix/gateway token mismatch 38617 #38676

Closed

alexey-pelykh mentioned this pull request Mar 10, 2026

Cherry-pick: dep cleanup, Nostr guards, Mattermost sentinel, app fixes remoteclaw/remoteclaw#848

Closed

alexey-pelykh mentioned this pull request Mar 20, 2026

Cherry-pick issue #848: dep-cleanup-nostr-guards-mattermost-apps remoteclaw/remoteclaw#1731

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Dependencies: remove unused extension packages#38317

Dependencies: remove unused extension packages#38317
vincentkoc merged 5 commits intomainfrom
vincentkoc-code/deadcode-unused-deps-extensions

vincentkoc commented Mar 6, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

vincentkoc commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

greptile-apps bot commented Mar 6, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vincentkoc commented Mar 6, 2026 •

edited

Loading