chore(cli): remove Slack, Agent Studio, Air, UI and Chat

[mqasimca]

What

Removes five CLI surfaces and everything that existed only to serve them.

Surface	Package(s)
nylas slack (+ sl alias)	internal/cli/slack/, internal/adapters/slack/, internal/ports/slack.go, internal/domain/slack.go
nylas agent studio	internal/studio/ (server, handlers, embedded JS/CSS/templates)
nylas air (port 7365)	internal/air/
nylas ui (port 7363) + nylas demo ui	internal/ui/, internal/cli/demo/ui.go
nylas chat (port 7367)	internal/chat/

Also removed because nothing else used them:

• internal/webguard/ — air, ui and chat were its only consumers
• tests/ — the entire Playwright harness; every project and helper targeted a removed UI, and CI never invoked it
• Slack credential loading, prompts, tools, approvals and execution paths in Chat
• The github.com/slack-go/slack dependency
• 11 Makefile targets (test-air*, test-e2e*, test-playwright*) plus the ci-full and test-cleanup hooks into them

nylas tui and nylas demo tui are unaffected — the terminal UI stays.

Why

These are no longer intended CLI surfaces. Removing complete vertical slices avoids leaving unused credentials, dependencies, web routes, or documentation behind.

Commits

7a9106f	Remove Slack and Agent Studio
0bd0a0a	Tidy go.sum, harden removal tests, drop stale doc counts
658f2c7	Remove Air, UI and Chat web surfaces
ce60b5a	Fix DNS race that made TestCLI_WebhookLifecycle always skip

Fixes worth reviewing

These are behaviour changes rather than deletions, and are the parts most worth a careful look.

Removed commands were exiting 0. Cobra returns flag.ErrHelp for a non-runnable parent before it validates args, so nylas agent studio and nylas demo ui printed help and reported success for commands that no longer exist. Both parents now set Args: cobra.NoArgs and a RunE returning cmd.Help(), so unknown subcommands exit 1 while the bare command still prints help and exits 0.

The security scan false-positived on deletions. scripts/security-scan.sh matched staged .json paths without excluding deletions, so removing the test fixtures failed make ci with "Sensitive file staged". A deleted file cannot leak its contents; --diff-filter=d excludes deletions while still catching additions. This affected any commit deleting a JSON file, not just this one.

TestCLI_WebhookLifecycle never actually ran. It self-skipped with "cloudflared tunnel did not become externally reachable", which read like a network problem. Cloudflare publishes the quick-tunnel DNS record a few seconds after cloudflared prints the URL (measured: URL at ~6s, record live at ~10s), and there is no wildcard on *.trycloudflare.com. The test probed the instant it parsed the URL, landed in that gap, got NXDOMAIN, and the system resolver cached that negative answer for longer than the 60s retry loop ran — so every retry read the poisoned entry and the loop could never recover. Delaying only the first lookup fixes it; the probe error is also no longer discarded, since that is what made it hard to diagnose.

Measured against both resolvers:

t=7s   system: NXDOMAIN | 1.1.1.1: NXDOMAIN        (not published yet)
t=10s  system: NXDOMAIN | 1.1.1.1: 104.16.231.132  (published)
t=40s  system: NXDOMAIN | 1.1.1.1: 104.16.231.132  (still poisoned)

The test now exercises create/show/update/delete against the live API for the first time. It has presumably been silently skipping in CI for a long time, so it can now genuinely fail if webhooks break.

Removal tests could pass vacuously. The HelpOmits* tests assert only that a command is absent from stdout, which an empty stdout satisfies trivially. A requireCommandList helper now asserts the command list actually rendered first. Verified by feeding it empty output: it fails where it previously passed.

Regression coverage

Added and wired into make test-cli-regressions: TestCLI_SlackRemoved, TestCLI_SlackAliasRemoved, TestCLI_HelpOmitsSlack, TestCLI_AgentStudioRemoved, TestCLI_AgentsStudioRemoved, TestCLI_AgentHelpOmitsStudio, TestCLI_WebUIsRemoved (air/ui/chat/demo ui), TestCLI_HelpOmitsWebUIs, TestCLI_DemoHelpOmitsUI.

Testing

make ci-full on the final tree:

12,363 passed · 0 failed · 152 skipped

fmt · vet · lint · unit · race · security · govulncheck · CLI regressions · agent integration · full integration suite · resource cleanup — all green. The 152 skips are pre-existing environmental ones (Ollama unavailable, tests gated behind flags).

Notes

• go.sum is now tidied. Removing slack-go/slack from go.mod left its hashes and those of its go-test/deep test dependency behind, so make deps produced an unrelated dirty diff for the next person to run it.
• Generic Slack OTP recognition (internal/adapters/nylas/otp.go) and the Slack webhook shell examples in the docs are retained — both are independent of the removed integration.
• Documentation swept across 22 files. Two .claude files were deleted because they documented only removed subsystems: agents/frontend-agent.md (scoped to the Air and UI frontends) and shared/patterns/playwright-patterns.md. The Playwright and CSS reminders were dropped from .claude/hooks/context-injector.sh — no browser JS or CSS remains in the repo.
• Stale hardcoded file counts were removed from docs/ARCHITECTURE.md rather than re-derived. They had drifted well past this change (ports claimed 6 files against 23 actual, adapters 12 directories against 20) and the doc contradicted itself on domain.
• internal/adapters/nylas/demo has no importers and had none before this branch. Left in place as pre-existing dead code, out of scope here.
• Credentialed live integration suites beyond those in make ci-full were not run.