LIB-5: chore(deps): `@langchain/community` is a 22 MB production dependency that is never imported

[gfargo]

File: package.json:146

What's wrong: "@langchain/community": "^1.1.29" sits in dependencies, but a repo-wide
search for @langchain/community across src, bin, e2e, rollup.config.mjs, and
jest.config.ts returns only the package.json line itself — no static import, no
await import(), no rollup reference. Nothing else in node_modules depends on it either.

I checked the other four candidates my scan flagged and they are all legitimate, so this is
the only real one:

Package	Verdict
@commitlint/core	used — await import('@commitlint/core') at commitlintValidator.ts:106,287,311
web-tree-sitter	used — lazy loader in parsers/default/__tree_sitter__/runtime.ts
react-devtools-core	legitimate — declared peer dep of ink@7 (>=6.1.2)
p-queue	unused (see previous finding)
@langchain/community	unused

Impact: 22 MB of install weight on every npm i -g git-coco, plus its transitive
surface in every npm audit and Dependabot run, for zero functionality. It also implies a
capability coco doesn't have — a reader scanning dependencies reasonably concludes the
community provider set is available.

Suggested fix: remove both @langchain/community and p-queue from dependencies
(the latter only after the semaphore consolidation above), and add a CI check — a
depcheck/knip step, or extend bin/smokeCli.ts — so an unreferenced production
dependency fails the build.

Confidence: high

---

Extracted from a repo audit performed 2026-07 (the audit doc it came from was proposed via an unmerged docs PR).