chore(runtime): Code Mode is on @ai-sdk/code-mode now — delete superseded custom scaffolding, consolidate byte counting, fold the package into runtime

[Astro-Han]

Status update from the owner: Code Mode is active in-flight work, and the migration to the QuickJS approach has already landed — packages/code-mode/src/quickjs.ts is a 157-line adapter over @ai-sdk/code-mode's experimental_runCodeMode (deps: @ai-sdk/code-mode@1.0.23, ai@7.0.66). What remains in the package is custom scaffolding that predates or duplicates what the SDK now owns.

Deletable now

1. CodeModeLimits + DEFAULT_CODE_MODE_LIMITS (packages/code-mode/src/index.ts:149-172): a 1:1 rename mapping onto the SDK's executionPolicy (maxSandboxTimeMs→timeoutMs, etc.). Use the SDK's policy shape directly. The only consumer outside the package is packages/runtime/src/ai-sdk-backend.ts:3082,3114 reading maxToolOutputBytes as a constant — keep one constant.
2. The hand-rolled execution queue (index.ts:214-264, ~50 lines): global one-cell-at-a-time serialization with a queue depth of one. The SDK already governs concurrency (CODE_MODE_CONCURRENCY_LIMIT, maxInFlightBridgeRequests). Unless there is a measured constraint that QuickJS instances must be serially reused, this is duplicate governance. Confirm the SDK's concurrency semantics before removing.
3. serializedByteLength (index.ts:10-147, ~140 lines): cannot be deleted outright — packages/runtime/src/tool-runtime.ts:1372 uses it in production — but it exposes a wider duplication: the repo has three hand-written JSON byte counters (@maka/code-mode, packages/core/src/additional-permissions.ts:195, packages/core/src/sandbox-boundary.ts:755), plus the SDK's own byte-limit enforcement. One "serialized byte length" fact, four authorities. Consolidate to a single implementation in @maka/core.

Cascade

After the above, the package is ~200 lines of genuine integration glue (the callTool bridge, fatal-tool-error handling, drain-to-quiescence semantics — keep those). At that size the standalone workspace loses its reason to exist: fold the remainder into @maka/runtime and delete the package manifest, exports, tsconfig, root/desktop/CLI build wiring, stale-dist check, and release-dependency entries.

Remaining gap to ship

Nothing in production assigns toolMode = 'code_mode' yet (zero non-test 'code_mode' references in runtime-host, cli, storage, apps; verified with git grep -aI). The migrated path is unreachable until the producer (settings/protocol switch) lands — tracked as part of the in-flight work, not a deletion request.

[Astro-Han]

Closing as completed by #3225. The merged PR removed the SDK-superseded Code Mode scaffolding, consolidated serialized byte counting, preserved full-cell lifecycle admission at the Runtime owner, folded the standalone package into , and passed the required review and CI gates.\n\nThe issue’s note about the absence of a production producer explicitly placed that work outside this deletion request, so it is not a remaining acceptance item here.\n\nTriage and wording were prepared with OpenAI Codex and reviewed by the maintainer.