(janitor/dependencies) Remove unused @kilocode/worker-utils from services/mcp-gateway

[kilo-code-bot]

Summary

Removes one unused dependency from a single workspace package.

Dependencies removed

Package	Dependency	Type
services/mcp-gateway (cloudflare-mcp-gateway)	@kilocode/worker-utils (workspace:*)	dependency

Evidence it was unused

• @kilocode/worker-utils has zero references in services/mcp-gateway outside its own package.json. A recursive search of the package (excluding node_modules) matched only the package.json declaration.
• The Worker's source imports only these @kilocode/* workspace packages:
  • @kilocode/mcp-gateway (13 imports)
  • @kilocode/db (6 imports, via @kilocode/db/client, @kilocode/db/schema, @kilocode/db/schema-types)
  • @kilocode/encryption (2 imports)
• knip independently flags @kilocode/worker-utils as the only unused dependency in services/mcp-gateway/package.json, agreeing with the manual search.

Dynamic, configuration, and tooling references checked

• Source imports/requires/dynamic imports: none (grep over src/** for worker-utils, worker_utils, workerUtils, and the @kilocode/worker-utils module specifier).
• Type references: none (no @kilocode/worker-utils in worker-configuration.d.ts, src/sql.d.ts, or any .d.ts).
• Scripts: package.json scripts (dev, start, deploy, keys:generate, types, typecheck, lint, test) do not reference it. scripts/generate-keys.mjs does not import it.
• Configuration: wrangler.jsonc, tsconfig.json, vitest.config.ts contain no reference. No services, rules, build, or vars binding reference the package.
• Side effects / naming convention: the package is imported explicitly by module specifier elsewhere in the repo; there is no side-effect-only or convention-discovered load path for this Worker.
• Compilation/codegen: tsgo --noEmit typecheck (which resolves the workspace source exports) passes after removal, confirming no type-level consumer.

Package publication and peer-dependency considerations

• services/mcp-gateway is "private": true — not published, so no published package contract or peer/optional dependency surface is affected.
• @kilocode/worker-utils is itself a workspace-internal package ("private": true), so it is not a registry contract.
• Removing it cannot introduce accidental reliance on a transitive dependency: the package does not reference the module at all, and its other @kilocode/* deps (@kilocode/mcp-gateway, @kilocode/db, @kilocode/encryption) declare their own dependencies.

Validation performed

• pnpm install --no-frozen-lockfile --lockfile-only (full install OOM'd in the constrained sandbox; see uncertainty).
• Lockfile diff is scoped to a single removal: the @kilocode/worker-utils importer entry under cloudflare-mcp-gateway. No unrelated changes.
• pnpm --filter cloudflare-mcp-gateway run typecheck — passed (exit 0).
• pnpm --filter cloudflare-mcp-gateway run lint — 0 warnings, 0 errors.
• pnpm --filter cloudflare-mcp-gateway run test — 18 tests passed across 2 files.

Uncertainty

• A full pnpm install was not able to complete in this environment (JavaScript heap OOM during lockfile resolution with the large monorepo graph). The lockfile was instead updated with pnpm install --no-frozen-lockfile --lockfile-only, which produced a clean, minimal lockfile diff. CI will perform the full install and package checks.
• Postgres/Redis are unavailable in this sandbox; the mcp-gateway test suite is a Node-environment unit suite (no Postgres/Redis needed) and passed. No live Hyperdrive/Postgres integration was exercised.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified that @kilocode/worker-utils has zero references anywhere under services/mcp-gateway (source, tests, scripts, wrangler/tsconfig/vitest config, README), so removing the dependency and its lockfile importer entry is safe; the lockfile change is generated and scoped to the single importer.

Files Reviewed (2 files)

• services/mcp-gateway/package.json
• pnpm-lock.yaml (generated; skipped per rules)

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}