chore(mobile): drop dead nitro-markdown tgz override and @expo/metro-runtime

[juliusmarminge]

What Changed

• Removed the vendored apps/mobile/deps/react-native-nitro-markdown-0.5.0.tgz, the package-local overrides block in apps/mobile/package.json, and its entry in the release-smoke workspace file list.
• Removed @expo/metro-runtime from apps/mobile dependencies.
• Net manifest effect: the generated mobile third-party license list goes from 763 to 762 entries (@expo/metro-runtime), matching what the bundle actually contains.

Everything else from the mobile dependency audit (items #4/#5) was audited and deliberately kept; the false premises are documented below.

Why

The nitro-markdown tgz is dead weight (audit #4 — valid). pnpm only honors overrides from the workspace root, so the per-workspace overrides block never applied. The lockfile proves it: react-native-nitro-markdown has resolved to 0.5.8 from the registry since the initial mobile commit, while the tgz is pinned at 0.5.0. The 180 KB tgz and its ineffective override have misled readers into thinking the app bundles a patched copy. The react-native-nitro-markdown: ^0.5.0 dependency itself is used (ThreadFeed, FileMarkdownPreview, the markdown module) and stays on the registry version.

@expo/metro-runtime is unused (audit #5 — valid for this package). No app code imports it. @expo/metro-config's pre-module injection only applies "if the module is installed and imported somewhere in the bundle already" (its own comment), the fallback resolution keeps it reachable via expo's optional-peer subtree regardless of this declaration, and @expo/cli has no hard resolve of it on the native path. A production expo export -p android bundles successfully without the declaration and contains zero @expo/metro-runtime modules — in the bundle both with and without it, so the removal is behavior-neutral.

expo-auth-session is genuinely in the native bundle (audit #5 premise false). App code never imports it, but @clerk/expo's root entry (the app imports ClerkProvider/useAuth from it) statically requires ./hooks → useOAuth/useSSO → ssoDependencies.js, which contains a static require("expo-auth-session"). I verified by removing the declaration, reinstalling, and exporting a production native bundle: Metro still resolves the package through @clerk/expo's pnpm peer link and the exported bundle contains expo-auth-session/build/*.js. Removing the declaration therefore changes nothing about what ships — it only makes the license scanner (which walks declared/production dependency edges, not peers) omit a package that is actually in the bundle. Keeping the declaration is the accurate state.

react-dom is genuinely in the native bundle (audit #5 premise false). Only three test files import react-dom, but @clerk/expo → @clerk/react statically imports react-dom and react-dom/client at runtime (@clerk/react@6.16.1/dist/index.mjs), and the exported production Android bundle contains react-dom/cjs/react-dom.development.js and react-dom/cjs/react-dom-client.development.js (independent of where it is declared, since peer satisfaction keeps it resolvable). Moving it to devDependencies would have made the generated license list omit a shipped package. It stays in dependencies, where the manifest it produces is truthful.

@types/react / @types/react-dom are already devDependencies in apps/mobile — nothing to move. @types/* entries that appear in the generated license manifest are transitive through production packages; filtering type-only packages from the generator is a separate concern (filed as #13153, not done here).

expo-asset stays (audit premise false). It is listed as a config plugin in app.config.ts, is a direct dependency of expo and expo-audio, and is a peer of the t3-markdown-text module; it is also genuinely bundled.

Verification

• vp i → lockfile diff is the importer removal only; no version drift. react-native-nitro-markdown still resolves 0.5.8 from the registry.
• Production native bundle with the final state: APP_VARIANT=production npx expo export -p android --dev false exits 0; the 34 MB bundle contains no @expo/metro-runtime modules and still contains expo-auth-session/build/* and react-dom/cjs/* — matching the license manifest exactly.
• Strict mobile license manifest (generateThirdPartyLicenseManifest, allowMissingGeneratedNotices: false) generates cleanly: 762 entries (main: 763), with @expo/metro-runtime the only removal; react-dom, expo-auth-session, expo-asset still present.
• vp run --filter @t3tools/mobile typecheck and --filter @t3tools/scripts typecheck pass.
• Mobile vitest suites covering the react-dom-consuming tests (preferences, QuestionAnswerHistory, use-selected-thread-requests, useHighlightedCode) pass.
• expo config --type public resolves fully — plugin list unchanged, no resolution errors.
• knip --workspace apps/mobile --include dependencies — clean.
• No remaining references to apps/mobile/deps anywhere in the repo.

No UI changes, so no screenshots apply.

_{Worked on by callstack/Apex (pi harness), with correctness review by Claude Opus against the audit.}

[macroscopeapp]

Approvability

Verdict: Approved at afe6569

Macroscope's review found this PR approvable — This is a deletion-only mobile dependency cleanup that removes an unused runtime declaration, an ineffective markdown archive override, and a release-test fixture reference. Existing markdown usage and the remaining dependency graph are unchanged, with no product-default or static-analysis behavior changes.

Notes:

• All code in this push has already been reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−14 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.1 KiB	+12 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−26 B (−0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.2 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	−3 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	0 B (0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−3 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: d7819c1 · PR result: afe6569 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: bcc1c0d7-7a7f-4915-a99c-615e1105fc22

📥 Commits

Reviewing files that changed from the base of the PR and between d7819c1 and 701c023.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• apps/mobile/deps/react-native-nitro-markdown-0.5.0.tgz
• apps/mobile/package.json
• scripts/release-smoke.ts

💤 Files with no reviewable changes (1)

• scripts/release-smoke.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The mobile package manifest moves react-dom to devDependencies and removes the local react-native-nitro-markdown override. The release smoke fixture no longer copies the local archive into its temporary workspace.

Changes

Mobile dependency cleanup

Layer / File(s)	Summary
Update mobile dependencies and smoke fixture apps/mobile/package.json, scripts/release-smoke.ts	The manifest moves react-dom to devDependencies and removes the local markdown archive override. The release smoke fixture stops copying that archive into its temporary workspace.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 701c0

The mobile app retains its Markdown dependency and the smoke fixture no longer relies on the deleted archive. No material production or release-smoke failure is established, so the change appears ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the removal of the unused Nitro Markdown tarball override, which is a main change. Its claim about removing @expo/metro-runtime conflicts with the PR objectives, which say…
Description check	✅ Passed	The description includes detailed What Changed and Why sections, verification results, and explains why screenshots do not apply. However, it conflicts with the change summary and objectives: it says …

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate afe6569