chore(rivekit): remove dead code

[NathanFlurry]

No description provided.

[NathanFlurry]

Stack for rivet-dev/rivet

• chore(rivekit): remove dead code #5240 touuyksk · 2026-06-12 20:07:55 👈
• main

Get stack: forklift get 5240
Push local edits: forklift submit
Merge when ready: forklift merge 5240

[railway-app]

🚅 Deployed to the rivet-pr-5240 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
kitchen-sink	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 8:18 pm
website	😴 Sleeping (View Logs)	Web	Jun 12, 2026 at 8:17 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 8:09 pm
frontend-cloud	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 8:09 pm
ladle	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 8:09 pm
mcp-hub	✅ Success (View Logs)	Web	Jun 12, 2026 at 8:08 pm

[claude]

Code Review: chore(rivekit): remove dead code

Overview

A substantial dead code cleanup removing ~6,251 lines across Rust and TypeScript. The scope includes unused structs, helper functions, deleted TS driver/instance files, WASM utility exports, and several smaller utility modules. The changes are well-scoped and each deletion is consistent.

---

Positives

• Large blast radius, surgical precision. Deleted items are consistently cleaned from mod.rs re-exports, tsconfig.json, and test fixtures all in one change.
• ActorVars removal is welcome. The deleted vars.rs used std::sync::RwLock, which violates the project guideline requiring tokio::sync locks in async context.
• Test updates are correct. tests/schedule.rs correctly migrates from the removed set_scheduled_events to update_scheduled_events.
• client/test.ts was 100% commented-out code — deleting it is the right call.

---

Issues / Concerns

1. effective_sleep_grace_period is now a passthrough (minor)

After removing ActorConfigOverrides, the method now just returns the field unchanged. The method name implies capping or transformation is happening. Either remove the method and have callsites use self.sleep_grace_period directly, or add a comment explaining why the wrapper is kept.

2. timingSafeEqual removed — verify no security-sensitive callers remain

timingSafeEqual in utils/crypto.ts was a constant-time comparison utility intended to prevent timing attacks on auth tokens. Removing it is fine if it had no callers, but it is worth confirming that any remaining token or secret comparisons in the codebase use a constant-time path (e.g., crypto.timingSafeEqual from Node's built-in node:crypto). If a surviving comparison silently regressed to ===, that is a security issue.

3. KV index [4] gap has no tombstone comment

After removing KV_PREFIX, index 4 is silently vacated. The existing inline comments already document [3] with a note. The gap at [4] should receive the same treatment to prevent future reuse that would collide with existing on-disk data:

// [4] was the user KV prefix; do not reclaim to avoid collision with existing on-disk data.

4. process-metrics.ts deletion removes JS-side process observability

The deleted file collected event-loop lag, GC, heap, CPU, and libuv handle counts and pushed them to Prometheus via NAPI. If this was wired up in production, its removal silently drops those metrics from /metrics. The PR description is empty — it is not clear whether this module was already unreachable or whether the metrics are being intentionally removed. A note clarifying intent would help reviewers.

5. ActorChildOutcome removed from public re-exports

Removed from task_types.rs and the mod.rs public surface. Fine as long as no downstream crate (pegboard-envoy, rivetkit-napi, etc.) was matching on it. Presumably confirmed by CI, but worth a spot-check.

---

Minor Style Notes

• getNodeStream removed from utils/node.ts cleanly, but the JSDoc on the adjacent getNodeUrl still says "lazily" — that qualifier is stale now.
• EnvoyConfigInput and ServerlessConfigInput type aliases are removed. If these were exported as part of any public API surface, downstream users will need z.input<typeof EnvoyConfigSchema> directly.

---

Summary

Clean, well-executed removal. The only actionable items:

1. Rename or remove the now-trivial effective_sleep_grace_period wrapper.
2. Confirm no surviving auth comparisons regressed from timingSafeEqual to ===.
3. Add a tombstone comment for vacated KV index [4].
4. Clarify whether process-metrics.ts deletion is intentional (module was never wired up) or removes active metrics.