[kilo-code-bot]

Dependencies removed

• @slack/oauth@3.0.5 from apps/web/package.json (dependencies)

Evidence the dependency was unused

• A case-insensitive, extension-agnostic search of the entire apps/web tree for slack/oauth and @slack/oauth matches only the package.json declaration. No import, require, dynamic import, or type reference exists anywhere in source, tests, or configuration.
• A repository-wide search shows @slack/oauth is declared and referenced by no other workspace package. It is not a transitive dependency of anything else in the lockfile (the @slack/oauth snapshot shows it depends on @slack/web-api, never the reverse).
• The live Slack OAuth callback (apps/web/src/lib/integrations/oauth/platforms/slack-callback.ts) exchanges tokens through @slack/web-api (upsertSlackInstallation in apps/web/src/lib/integrations/slack-service.ts), not through @slack/oauth.
• @slack/web-api, @slack/types, and @slack/socket-mode remain declared and used; only the @slack/oauth package was left behind.

Dynamic, configuration, and tooling references checked

• knip (the repository's dependency-analysis tool, apps/web/knip.ts) lists @slack/oauth under "Unused dependencies" (package.json:106), in agreement with the search above. @slack/oauth is not in ignoreDependencies.
• No next.config, Jest, Babel, instrumentation, script, CSS plugin, or other configuration references the package (the exhaustive repo-wide search covers all file types under apps/web).
• The only other textual reference was a comment in pnpm-workspace.yaml explaining the @slack/web-api override; it has been updated to drop the now-removed @slack/oauth.

Package publication and peer-dependency considerations

• apps/web is "private": true and not published, so there is no published-package contract to preserve.
• @slack/oauth is declared as a plain runtime dependency (not a peer/optional dependency) and has no consumers in the tree; removal deletes it from the lockfile entirely.

Validation performed

• pnpm install completes cleanly (--no-frozen-lockfile); the lockfile diff is limited to the three @slack/oauth deletions (importer entry, packages resolution, snapshots).
• pnpm --filter web run lint → Found 0 warnings and 0 errors.
• Confirmed @slack/web-api, @slack/types, and @slack/socket-mode remain present in the lockfile after removal.

Uncertainty

• Full apps/web typecheck and next build were not run in this environment (resource-constrained; Postgres/Redis cannot be started). The change is a manifest-only edit with zero source references, so typecheck/build output is expected to be unaffected, but this was not verified end-to-end.
• knip also reports ~46 other unused-dependency candidates for apps/web; these were intentionally left alone to keep this change to the single safest removal. Several are false positives (e.g. @opentelemetry/api is a peer of @sentry/nextjs/@vercel/otel) and were not evaluated for removal.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified the removal of the unused @slack/oauth dependency is consistent and safe across the manifest, lockfile, and workspace override comment; no source references to the package remain.

Files Reviewed (3 files)

• apps/web/package.json
• pnpm-lock.yaml
• pnpm-workspace.yaml

---

_{Reviewed by deepseek-v4.1-flash · Input: 36.9K · Output: 4.1K · Cached: 271K}

_{Review guidance: REVIEW.md from base branch main}

[eshurakov]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Independently reviewed all three changed files at 060af68 against base 2084412; no major issues found. A complete pinned-source scan found no remaining @slack/oauth references, including runtime/dynamic imports and configuration. The OAuth callback delegates to @chat-adapter/slack 4.36.0, whose published runtime calls @slack/web-api directly without @slack/oauth.

Structural assertions passed: the manifest removes only this dependency, the lockfile removes exactly its importer/resolution/snapshot, no other lockfile consumer requires it, and workspace YAML semantics are unchanged. Existing reviews/discussion and CI were checked; frozen-lockfile installs, typecheck, lint, tests, and web/AI-gateway builds passed. Head/base were reconfirmed immediately before approval. No local install, build, tests, or live OAuth exercise were performed; the shared checkout was not modified.

Files Reviewed (3 files)

• apps/web/package.json
• pnpm-lock.yaml
• pnpm-workspace.yaml