feat(2.0)!: split voice into @open-gitagent/voice, drop unused deps

[shreyas-lyzr]

A hosted dev sandbox blocks every published version of @open-gitagent/gitagent (1.5.0–1.5.2 and the predecessor gitclaw 0.5.0–1.4.1) with HTTP 403 on the tarball fetch — the supply-chain scanner between sandbox and registry refuses the bundle. Metadata for the ~710-package dep tree resolves fine; only the .tgz is refused. The trigger is inside the published contents.

Audit surfaced two pure wins regardless of the scanner, plus the user-requested directive:

1. baileys is declared in dependencies but never imported from source — dead weight pulling in ~100 transitive packages.
2. dist/voice/ui.html (~3,860 LOC of mixed HTML/JS/CSS, ~200 kB) ships in every tarball — exactly the shape supply-chain scanners flag.
3. The user wants the personal voice agent opt-in, not bundled by default.

These three point to one fix: split the package so voice is a separate optional install, drop the dead deps, and shrink the surface scanners see.

What changed in core (this PR)

• 1.5.2 → 2.0.0 (semver-major: gitagent --voice no longer works on a fresh core-only install).
• Drop deps: baileys (unused), ws (voice-only), @googleworkspace/cli (unused), @types/ws from devDeps.
• Tighten files allowlist to exclude dist/voice/ and dist/composio/.
• Move shared types/utilities out of src/voice/ so non-voice modules can still use them:
  • src/voice/adapter.ts → src/adapter.ts (pure types + DEFAULT_VOICE_INSTRUCTIONS)
  • src/voice/chat-history.ts → src/chat-history.ts (persistence; used by context.ts for recent-chat context)
• Delete src/voice/* and src/composio/* (all voice-only).
• Re-export from src/exports.ts the symbols @open-gitagent/voice needs as a peer: context helpers, skills, workflows, schedules, schedule-runner, chat history, adapter types.
• --voice in src/index.ts now await import("@open-gitagent/voice") dynamically and prints a clear install hint if missing.

install.sh + docs

• install.sh installs both packages by default (curl-bash UX unchanged). GITAGENT_SLIM=1 opts into a core-only install for sandboxed/CI environments.
• README adds a Migrating from 1.x → 2.0 section explaining the split and the two-line migration. Documentation.md install snippet updated.

Results

	1.5.2	2.0.0
Tarball packed	179.5 kB	85.7 kB (−52%)
Tarball unpacked	752 kB	343 kB (−54%)
Files	124	109
Resolved node_modules	310	211
dist/voice/* entries	many	0
dist/composio/* entries	yes	0

tsc clean. npm test — 27/27 pass.

Follow-up

The matching @open-gitagent/voice@1.0.0 package ships from a separate repo (next PR / new repo). Once it's published, npm install -g @open-gitagent/voice adds voice back. The --voice install hint in core points users straight there.

🤖 Generated with Claude Code