feat: dependency hygiene: drop unused deps in evals

[andrei-hasna]

Objective

dependency hygiene: drop unused deps in evals [loop-infinity-300pr]

REPO: https://github.com/hasna/evals

WHAT TO CHANGE

1. UNUSED RUNTIME DEPENDENCIES. These are declared in "dependencies" but no file under src/, scripts/, bin/ or tests/ imports them — not by static import, not by require(), not by dynamic import():

• chalk

Remove each one from "dependencies" and update the lockfile. Before removing any single entry, confirm it really is unreferenced: grep the whole repo including any dashboard/, tui/ or generated code, and check whether it is loaded by name at runtime (a plugin registry, a string passed to import(), a peer of a framework, or a binary invoked from a script). A package that only appears in package.json is safe to drop; anything referenced by string is not. If a listed package turns out to be used, leave it and say so in the PR body.
Note: a @types/* package is used by the type-checker, not by imports — only drop a @types/* entry if the package it types is also gone, or if it ships its own types.

DONE LOOKS LIKE

• package.json edited for the items above and only those items. Do not bump versions of surviving dependencies, do not reformat the file, do not touch unrelated fields.
• The lockfile (bun.lock) regenerated by a real bun install, committed alongside — not hand-edited.
• The PR body lists each item, and for anything you decided NOT to change, one line saying why.

VERIFY

• bun install completes cleanly and produces no lockfile churn beyond the intended change.
• bun run build succeeds if the repo defines that script.
• bun run typecheck passes if the repo defines that script.
• bun test passes — the whole suite, because a wrongly-removed dependency usually shows up only at runtime.

EVIDENCE
Dependency list read from GitHub HEAD on 2026-07-29 via the contents API. Unused-import analysis run against the local checkout by extracting every static import, require() and dynamic import() specifier under src/, scripts/, bin/ and tests/ and subtracting them from the declared dependency set. Packages loaded purely by runtime string lookup would not be detected — hence the confirm-before-removing step above.

PROCESS: work in a branch off the default branch, one focused change, conventional commit, open a PR. Do not bundle unrelated cleanups. If the repo has a CHANGELOG, add an entry.

Verification

• policy source: base ccb79e8 (immutable commit — agent-proof)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: FAIL
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_bf0d9d97d1ec · backend codewith · task cb19e776-70c1-4488-8da3-21b31cadff39
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}