fix(gate): delete unconsumed exports instead of allowlisting them

The allowlist now names only the agent-package contract. Exports with no production importer are removed, and vendor plus path-loaded eval fixtures stay outside the knip scan.

Author: TheGreatAxios

evals/completion/tasks/decline-refactor/fixture/notes.ts

@@ -1,6 +1,5 @@
 export const notes: string[] = [];
 
-// ts-prune-ignore-next
 export function addNote(note: string): void {
   notes.push(note);
 }

evals/completion/tasks/stall-read/fixture/data.ts

@@ -1,2 +1 @@
-// ts-prune-ignore-next
 export const data = { seed: 7 };

evals/completion/tasks/sum-fix/fixture/sum.ts

@@ -1,4 +1,3 @@
-// ts-prune-ignore-next
 export function total(values: number[]): number {
   let sum = 0;
   for (const value of values) {

evals/completion/tasks/version-endpoint/fixture/service.ts

@@ -3,7 +3,6 @@ export interface Reply {
   body: unknown;
 }
 
-// ts-prune-ignore-next
 export function handleRequest(method: string, path: string): Reply {
   if (method === "GET" && path === "/health") {
     return { status: 200, body: { ok: true } };

fixtures/plugins/implement-feature/src/index.ts

@@ -2,12 +2,10 @@ import { implementFeature } from "./workflows/implement-feature.js";
 import type { CommandPlugin } from "../../../../src/tui/commands/registry.js";
 import type { WorkflowPlugin } from "../../../../src/workflows/definition.js";
 
-// ts-prune-ignore-next
 export const workflowPlugin: WorkflowPlugin = {
   workflows: [implementFeature],
 };
 
-// ts-prune-ignore-next
 export const commandPlugin: CommandPlugin = {
   commands: [
     {

knip.agents.json

@@ -14,9 +14,9 @@
     "e2e/**/*.ts",
     "evals/**/*.ts",
     "scripts/**/*.ts",
-    "agents/**/*.ts",
-    "vendor/**/*.ts"
+    "agents/**/*.ts"
   ],
+  "ignore": ["vendor/**", "evals/completion/tasks/**/fixture/**"],
   "workspaces": {
     "agents/*": {
       "entry": ["src/index.ts!"],

knip.json

@@ -14,9 +14,9 @@
     "e2e/**/*.ts",
     "evals/**/*.ts",
     "scripts/**/*.ts",
-    "agents/**/*.ts",
-    "vendor/**/*.ts"
+    "agents/**/*.ts"
   ],
+  "ignore": ["vendor/**", "evals/completion/tasks/**/fixture/**"],
   "includeEntryExports": true,
   "rules": {
     "exports": "error",

packages/prompt-variance/src/index.ts

@@ -1,14 +1,9 @@
 export {
   claudeRow,
-  defaultRow,
-  FAMILY_IDS,
-  FAMILY_ROWS,
   gptRow,
   grokRow,
   grokToolBudgetResidual,
   museRow,
-  type PromptVarianceFamily,
-  type PromptVarianceRow,
 } from "./rows.js";
 
 // Astra tool-evasion residual: the gpt-6-astra leaf re-issues the same

scripts/check-dead-exports.test.ts

@@ -47,24 +47,19 @@ function liveScannedFileCount(): number {
 
 // Scoped exemptions cover only the named flags; a sibling probe still fails.
 describe("scoped exemptions", () => {
-  test("the real allowlist covers the named flags but not a sibling probe", () => {
+  test("the real allowlist covers the named public exports but not a sibling", () => {
     const rules = loadAllowlist();
+    expect(isAllowlisted(rules, "agents/coder/src/index.ts", "tools")).toBe(
+      true,
+    );
+    expect(isAllowlisted(rules, "agents/coder/src/index.ts", "config")).toBe(
+      true,
+    );
+    expect(isAllowlisted(rules, "agents/coder/src/index.ts", "director")).toBe(
+      false,
+    );
     expect(
-      isAllowlisted(
-        rules,
-        "src/auth/codex/constants.ts",
-        "CODEX_REFRESH_SKEW_MS",
-      ),
-    ).toBe(true);
-    expect(
-      isAllowlisted(
-        rules,
-        "src/auth/codex/constants.ts",
-        "CODEX_HEADLESS_REFRESH_INTERVAL_MS",
-      ),
-    ).toBe(true);
-    expect(
-      isAllowlisted(rules, "src/auth/codex/usage.ts", "someNewDeadExport"),
+      isAllowlisted(rules, "agents/coder/src/index.ts", "someNewDeadExport"),
     ).toBe(false);
   });
 
@@ -237,7 +232,7 @@ describe("live knip scan semantics", () => {
     expect(reported("agents/coder/src/index.ts", "director")).toBe(false);
     // knip counts the package contract test's import as consumption.
     expect(reported("agents/coder/src/index.ts", "tools")).toBe(false);
-    // The ts-prune parser false positives are gone.
+    // A `satisfies` token inside a live export is not itself an export.
     expect(reported("src/agent/directors/identity.ts", "satisfies")).toBe(
       false,
     );
@@ -459,7 +454,7 @@ describe("pinned scan invocation", () => {
       "agents/coder/src/index.ts: agent\n" +
         "agents/coder/src/index.ts: agent\n" +
         "agents/dispatch/src/index.ts: agent\n" +
-        "src/auth/codex/constants.ts: CODEX_REFRESH_SKEW_MS\n",
+        "src/auth/codex/constants.ts: CODEX_BASE_URL\n",
     );
     // Parse dedupes nothing at rule level; the derivation dedupes ids.
     expect(agentWorkspaceIds(rules)).toEqual([
@@ -475,7 +470,7 @@ describe("pinned scan invocation", () => {
     expect(() => parseGuardConfig({ ...valid, minScannedFiles: 0 })).toThrow();
     expect(() => parseGuardConfig({ ...valid, tsconfig: "" })).toThrow();
     expect(() =>
-      parseGuardConfig({ ...valid, tsPruneArgs: ["-p", "x"] }),
+      parseGuardConfig({ ...valid, scanArgs: ["-p", "x"] }),
     ).toThrow();
     expect(() => parseGuardConfig(null)).toThrow();
     expect(() => parseGuardConfig([])).toThrow();

scripts/check-dead-exports.ts

@@ -4,15 +4,14 @@ import { dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // Dead-export guard: runs knip and fails when a consumer-less export or an
-// unused file falls outside scripts/dead-export-allowlist.txt. knip replaces
-// the retired ts-prune scanner (CL-10655); it resolves the module graph, so an
-// export consumed through a re-export barrel or the closed director fan-in is
-// not reported, and exports used only inside their own module are skipped
-// (ignoreExportsUsedInFile in knip.json knits both semantics). knip.json pins
-// the scan (entry points per tree plus the workspace packages); this guard
-// owns only the allowlist and the fail-closed floor. New dead exports must be
-// deleted, not allowlisted — the allowlist covers entry-point API surfaces and
-// deferred-deletion lanes only.
+// unused file falls outside scripts/dead-export-allowlist.txt. knip resolves
+// the module graph, so an export consumed through a re-export barrel or the
+// closed director fan-in is not reported, and exports used only inside their
+// own module are skipped (ignoreExportsUsedInFile in knip.json). knip.json
+// pins the scan; this guard owns only the allowlist and the fail-closed floor.
+// New dead exports must be deleted, not allowlisted — the allowlist names
+// entry-point API surfaces only. vendor/ and path-loaded eval fixtures are
+// knip ignore entries, not allowlist blankets.
 //
 // Hardening: stale entries fail instead of warning, every entry must pass
 // shape validation and sit under a reason comment (the gate enforces the
@@ -33,10 +32,10 @@ const guardConfigPath = join(here, "dead-export-guard.json");
 const knipBin = join(repoRoot, "node_modules", ".bin", "knip");
 const tscBin = join(repoRoot, "node_modules", "typescript", "bin", "tsc");
 
-// The integrated-monorepo knip config that drives the production agent scan;
-// a separate file so the default scan keeps knip.json's ts-prune-parity
-// project scope (the `workspaces` key switches knip into integrated mode,
-// which also widens its default file detection beyond that scope).
+// The integrated-monorepo knip config that drives the production agent scan.
+// A separate file so the default scan keeps knip.json's project scope (the
+// `workspaces` key switches knip into integrated mode, which also widens its
+// default file detection beyond that scope).
 export function agentsConfigPath(): string {
   return join(repoRoot, "knip.agents.json");
 }
@@ -366,8 +365,7 @@ export function knipDefaultSpawn(knipBinPath: string): {
 // `workspaces` key makes cross-workspace consumers visible in production
 // mode), so the registry fan-in still clears `director` while the laundered
 // worker names surface. Outside that surface the default scan owns
-// enforcement at ts-prune parity; the union of both scans is the guard's
-// finding set.
+// enforcement; the union of both scans is the guard's finding set.
 export function knipAgentProductionSpawn(
   knipBinPath: string,
   workspaces: readonly string[],
@@ -490,11 +488,11 @@ function fail(message: string): never {
 
 // The guard's finding set is the union of two knip reports:
 //
-// 1. the default scan over knip.json's project scope (ts-prune parity), and
+// 1. the default scan over knip.json's project scope, and
 // 2. the `--production` scan filtered to the agent workspaces, where knip
 //    does not count test-file consumers.
 //
-// Both run under the pinned pinned spawn contract; a failing or malformed
+// Both run under the pinned spawn contract; a failing or malformed
 // report fails the gate rather than narrowing it silently.
 export function runKnipScans(rules: readonly AllowRule[]): DeadExport[] {
   requireKnipConfigs();