Remove dead code from node:http2, the HTTP/2 parser, JSC bindings, uSockets, and the builtin-name tables

[robobun]

Removes 775 lines that nothing references (8 lines of signature, import and comment adjustments added), across node:http2, the HTTP/2 frame parser, the JSC/WebCore bindings, uSockets, four Rust crates, the builtin-name tables and scripts/. No behavior change. A 153-line source lint pins every removed symbol.

Problem

• src/js/node/http2.ts binds every entry of constants as a local (const { ... } = constants;); 178 of the 240 bindings have been unused since the block was added in feat(node:http2) Implement HTTP2 server support #14286 (every call site reads constants.X). const Socket = net.Socket and the #url / #isServer fields of ServerHttp2Session are never read either (tsc --noUnusedLocals, re-checked by grep).
• _nativeAssertSettings ($newRustFunction("h2_frame_parser.rs", "jsAssertSettings")) has been unused since Fix HTTP/2 settings: getPackedSettings, getUnpackedSettings, enableConnectProtocol #28074 gave http2.ts its own assertSettings(). That made js_assert_settings in src/runtime/api/bun/h2_frame_parser.rs (139 lines) and its facade re-export in src/runtime/api.rs unreachable: the js2native codegen was the only thing that named it. The three BUN_DECLARE_HOST_FUNCTION(BUN__HTTP2_*) lines in ZigGlobalObject.cpp are declarations of the Zig-era exports for the same helpers and have no definition anywhere.
• InspectorHTTPServerAgent::{startListening, stopListening, getRequestBody, getResponseBody} are TODO stubs that nothing can dispatch to: the generated HTTPServerBackendDispatcherHandler in the pinned WebKit only declares enable() / disable(), so these virtual ... final methods override nothing and have no callers.
• Declaration-only leftovers with no definition anywhere: Bun__DNSResolver__new / Bun__DNSResolver__cancel (BunObject.cpp), jsBufferConstructorFunction_isBuffer (JSBuffer.cpp, Buffer.isBuffer is a JS builtin), getStringOption (CryptoUtil.h). Plus the IsIDLEnumeration helper template (IDLTypes.h) and the globalBuiltinFunction macro (ZigGlobalObject.cpp), each with zero uses.
• uSockets: us_internal_ssl_sni_userdata and us_internal_ssl_handshake_abort were added in socket: replace us_socket_context_t with embedded groups + kind dispatch #29932 and never called (us_socket_server_name_userdata, which the first one wrapped, stays). us_cleanup_security_framework (darwin) had no caller; the loader's failure paths are the only thing that ever frees a SecurityFramework, and they still do. The SecTrustSettingsResult typedef next to it was unused too.
• Rust items no crate reaches (hawk dead_public, intersected over linux-gnu, linux-musl, android, freebsd, darwin and windows-msvc, then re-checked by hand): ExprData::is_e_string, ArrayHashMap::get_adapted, the debug-only Behavior::eq, and js_parser::FunctionKind, whose Stmt variant was never constructed. validate_function_name only ever ran for function expressions, so the parameter is gone and the one call site passes nothing; the error text already said "function expression".
• Builtin-name tables: Loader, byobRequest, controller, post, resume, started, state, textDecoder and view in BunBuiltinNames.h have no $name / @name use in any builtin and no namePublicName() / namePrivateName() use in C++ (each entry costs two identifiers at VM startup). Their builtins.d.ts declarations go with them, as do the six $stream* --defines in replacements.ts (no builtin reads them; their only trace was the .d.ts), the "Loader" entry of globalsToPrefix (the only bare Loader in src/js is inside a block comment), and a duplicated "Buffer" entry.
• scripts/find-dead-exports.ts (303 lines, Restrict crate-internal items to pub(crate) and remove dead code it exposes #31254) was a textual approximation of the analysis tools/hawk/ + hawk.toml now do (Narrow crate-internal Rust visibility across all targets and delete the code it proves dead #36184); nothing references it.

Fix

• Deletes the items above; the only additions are the shorter validate_function_name signature, one comment in semver/lib.rs that named get_adapted (now names the surviving get_index_adapted), and the re-export line in api.rs.
• Removing the $newRustFunction call is what makes the Rust function removable: generate-js2native.ts emits the crate::api::bun::h2_frame_parser::js_assert_settings thunk only for calls it finds in src/js, so after this change nothing generated names it either. bundle-functions.ts regenerates BunBuiltinNames+extras.h from the names builtins actually use, so a builtin-name entry that were still needed would be re-added by the build rather than break it; none was.
• Verified: bun bd builds; bun run rust:check-all passes on all ten target triples; cargo fmt --check and prettier are clean. bun bd test passes on test/js/node/http2/node-http2.test.js (357), test/js/node/http2/node-http2-continuation.test.ts, test/js/node/buffer.test.js, test/js/node/crypto/node-crypto.test.js, test/js/node/tls/node-tls-connect.test.ts, test/js/web/streams/streams.test.js and test/bundler/bundler_minify.test.ts; test/js/node/tls/node-tls-server.test.ts passes 69/70, the remaining one (SNICallback runs even when the requested servername matches the bind hostname) fails identically with the released binary in this container (it binds localhost and connects to 127.0.0.1). The four function-name diagnostics validate_function_name emits are unchanged between the released binary and this build for both statement and expression positions. bun test test/internal/source-lints/ passes (158 tests); the new dead-symbols-http2-settings-inspector-stubs.test.ts fails on main and passes here.
• Cross-checked against the 22 open dead-code PRs at the symbol level (their diffs, not just file lists): nothing here is removed by any of them. Two hunks are adjacent to open ones and will need a trivial rebase on whichever side lands second: the BUN__HTTP2_* lines sit right under the Bun__NodeUtil__jsParseArgs line Remove dead code from the FFI shim layer, link_interface tables, jssink/jest codegen, and REPL shims #37788 removes, and the InspectorHTTPServerAgent hunks are a few lines above the event dispatchers Remove dead code from node:crypto bindings, JSC/WebCore bindings, uSockets, and llhttp #37454 removes. One item found dead here, JSValkeyClient::close_subscription_ctx, is the renamed form of the SubscriptionCtx::close that Remove dead code from simdutf, ncrypto, uws shims, and JSC/WebCore bindings #38439 already removes, so it was left to that PR.

Background

• js2native: $rust("file.rs", "name") / $newRustFunction(...) calls in src/js are collected at build time by src/codegen/generate-js2native.ts, which emits one thunk per call into generated_js2native.rs / GeneratedJS2Native.h. A Rust host function is therefore reachable only while some builtin names it; the api.rs facade module exists so the generated thunks have a stable path to call.
• BunBuiltinNames.h is the list of private identifiers (@name in builtin JS, builtinNames.namePrivateName() in C++) that BunBuiltinNames interns when a VM starts. bundle-functions.ts diffs the names builtins use against this list and writes the difference to BunBuiltinNames+extras.h, which is why removing an entry can only ever remove startup work, never break a builtin.
• Inspector agents: the WebKit inspector protocol generator turns each domain's JSON into a *BackendDispatcherHandler interface; a command reaches an agent only through that interface. The HTTPServer domain bun ships in its WebKit defines enable and disable, so methods an agent declares beyond those are unreachable by construction.
• hawk (tools/hawk/README.md) is the workspace-wide reachability analysis the repo uses for pub items, since rustc's dead_code treats every pub item of a library crate as a root. Its per-target reports were intersected so that anything live under some cfg on any shipped platform was kept; the repr(C) FFI struct fields and flag/errno table entries it also reports were left alone on purpose, as in Remove dead code from bun_core, bun_css, bun_jsc, and the FFI crates #38703.

Found dead but left alone (follow-ups, not in this diff)

• bun_sys::ErrorCase::LeakFdOnFail is never constructed (every make_lib_uv_owned_for_syscall caller passes CloseOnFail), but removing it means dropping the parameter at 13 call sites, several of them in files open PRs are editing.
• libusockets.h still declares us_udp_socket_receive, us_udp_buffer_set_packet_payload, us_create_udp_packet_buffer and us_udp_socket_bind with no definitions, and udp.c carries a commented-out us_udp_packet_buffer_ecn; both spots are adjacent to hunks in Remove dead code from node:crypto bindings, JSC/WebCore bindings, uSockets, and llhttp #37454.
• NapiEnv::currentFinalizer() became unused in Worker / worker_threads: WebCore-shaped lifetimes, joined threads, one ordered VM teardown #37075 a week ago; left for that work to settle, as Remove dead code from node:crypto bindings, JSC/WebCore bindings, uSockets, and llhttp #37454 did with its siblings.
• replacements.ts also emits a $ImportKindLabelToId define nothing reads, but it comes out of the same loop as three live tables.
• ws.js WebSocket.prototype.setSocket (a throwing stub) and async_hooks AsyncResource.emitBefore/emitAfter have no in-tree users but are on exported classes.
• scripts/packer/build-image.pkr.hcl and scripts/trace.sh have no invoker, but they are CI infrastructure rather than code; flagged for whoever owns those.
• Everything else this pass turned up (about 270 C++ symbols and about 100 Rust items) is already deleted by one of the open dead-code PRs, and the roughly 400 never-read Rust fields hawk reports are all repr(C) mirrors of C structs.

[coderabbitai]

Warning

Review limit reached

@robobun, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e234859d-9062-469c-93e3-df2ac9997bce

📥 Commits

Reviewing files that changed from the base of the PR and between 7d276b9 and 8440794.

📒 Files selected for processing (26)

• packages/bun-usockets/src/crypto/openssl.c
• packages/bun-usockets/src/crypto/root_certs_darwin.cpp
• packages/bun-usockets/src/crypto/root_certs_platform.h
• packages/bun-usockets/src/internal/internal.h
• scripts/find-dead-exports.ts
• src/ast/expr.rs
• src/codegen/replacements.ts
• src/collections/array_hash_map.rs
• src/install_types/resolver_hooks.rs
• src/js/builtins.d.ts
• src/js/builtins/BunBuiltinNames.h
• src/js/node/http2.ts
• src/js_parser/p.rs
• src/js_parser/parse/parse_fn.rs
• src/js_parser/parser.rs
• src/jsc/bindings/BunObject.cpp
• src/jsc/bindings/IDLTypes.h
• src/jsc/bindings/InspectorHTTPServerAgent.cpp
• src/jsc/bindings/InspectorHTTPServerAgent.h
• src/jsc/bindings/JSBuffer.cpp
• src/jsc/bindings/ZigGlobalObject.cpp
• src/jsc/bindings/node/crypto/CryptoUtil.h
• src/runtime/api.rs
• src/runtime/api/bun/h2_frame_parser.rs
• src/semver/lib.rs
• test/internal/source-lints/dead-symbols-http2-settings-inspector-stubs.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Beyond the inline nit, I checked the parts of this diff that could change behavior rather than just delete symbols:

• validate_function_name dropping the kind == FunctionKind::Expr guard is behavior-preserving — the only call site is parse_fn_expr (parse_fn_stmt never called it), so the guard was always true.
• None of the nine removed BunBuiltinNames.h entries have a surviving *PublicName() / *PrivateName() accessor use anywhere in src/.
• The MAX_*_F64 constants js_assert_settings used are still referenced by load_settings_from_js in the same file, so its removal does not orphan them.

Extended reasoning...

Verified the one non-pure-deletion hunk (the FunctionKind::Expr guard on the generator-named-yield diagnostic in p.rs) is equivalent because parse_fn_stmt never invoked validate_function_name; grepped src/ for every removed builtin-name accessor and found none; confirmed the h2 f64 constants remain live. The inline nit about dangling Socket type annotations stands on its own, and the PR's breadth across 26 files in six subsystems is enough that a human pass is still worthwhile.

[claude]

🟡 Removing const Socket = net.Socket leaves the bare Socket type annotation dangling at 5 sites in this file (lines 1901, 3998, 4450, 4954, 6396) — there is no ambient/global Socket type in scope, so those annotations now reference an undeclared identifier. No runtime effect (the builtin bundler strips types), but the PR's tsc --noUnusedLocals justification is wrong for this const since tsc counts type-position uses; rewrite the 5 annotations to net.Socket (and drop the source-lint line that pins the const's deletion), or keep the const.

Extended reasoning...

What the issue is

The PR removes const Socket = net.Socket; from src/js/node/http2.ts (previously line 70) on the grounds that it "was never read" per tsc --noUnusedLocals and grep. However, the identifier Socket is still used as a type at 5 sites in the file:

• src/js/node/http2.ts:1901 — [bunHTTP2Socket]: TLSSocket | Socket | null;
• src/js/node/http2.ts:3998 — #socket_proxy: Proxy<TLSSocket | Socket>;
• src/js/node/http2.ts:4450 — constructor(socket: TLSSocket | Socket, options?: Http2ConnectOptions, server?: Http2Server)
• src/js/node/http2.ts:4954 — #socket_proxy: Proxy<TLSSocket | Socket>;
• src/js/node/http2.ts:6396 — function connectionListener(socket: Socket)

A const bound to a class value (net.Socket) is usable in type position — it names the class's instance type. Removing the const removes the only binding those annotations resolved against.

Why nothing else provides Socket

Grepping src/js for a Socket type/interface/class declaration finds exactly two interface Socket declarations, both module-scoped, not global:

• src/js/builtins.d.ts:10 — inside declare module "bun" { interface Socket { ... } }
• src/js/private.d.ts:257 — inside declare module "node:net" { interface Socket { ... } }

Neither augments the global scope, so after this change bare Socket at the 5 sites above is an undeclared identifier. This is asymmetric with the sibling const TLSSocket = tls.TLSSocket on the line immediately above, which the PR keeps and which is used identically in type position at the same sites.

Why the PR's stated justification does not apply here

The PR description says these were found via "tsc --noUnusedLocals, re-checked by grep". But tsc --noUnusedLocals does count type-position references of a value binding as uses — a const X = SomeClass referenced only as foo: X is not flagged. So either tsc was not actually run on this file (src/js builtins are not part of a checked tsconfig project), or the grep missed the type-position hits. Either way, the "never read" claim in the PR description is inaccurate for this particular const.

Impact

None at runtime. src/codegen/bundle-modules.ts strips TypeScript types from builtins before bundling, and the PR verified bun bd builds and test/js/node/http2/node-http2.test.js (357 tests) passes. This is purely a type-hygiene issue in an internal builtin: 5 annotations now reference an undeclared name, and the new source-lint (test/internal/source-lints/dead-symbols-http2-settings-inspector-stubs.test.ts:42 — expect(http2).not.toMatch(/^const Socket = net\.Socket;$/m)) locks the const's deletion in, so the dangling references are pinned rather than caught.

Step-by-step proof

1. After this PR, src/js/node/http2.ts line 69 is const TLSSocket = tls.TLSSocket; and the following const Socket = net.Socket; line is gone.
2. At line 1901, [bunHTTP2Socket]: TLSSocket | Socket | null; — TLSSocket resolves to the const on line 69; Socket has no binding.
3. Search the file for import.*Socket, type Socket, interface Socket, class Socket — none. The file's only Socket-named declaration was the removed const.
4. Search the ambient .d.ts files referenced by src/js — builtins.d.ts and private.d.ts each declare interface Socket inside a declare module "..." block, so neither contributes a global Socket.
5. Therefore all 5 type annotations reference an undeclared identifier.

How to fix

Rewrite the 5 annotations to net.Socket in this PR (matching how the type is spelled at src/js/node/http2.ts:1292's comment already refers to it as "net.Socket"). That keeps the const dead as intended and makes the source-lint correct. Alternatively, add type Socket = InstanceType<typeof net.Socket>; next to const TLSSocket. Restoring the const would also work but requires deleting the source-lint assertion at dead-symbols-http2-settings-inspector-stubs.test.ts:42.