[Quality audit] Deduplicate backend IPC, Git, remote, and request lifecycle code

[johannesjo]

Derived from the local audit report CODE_QUALITY_FINDINGS.md created on 2026-05-30.

Scope

This issue groups backend duplication and complexity opportunities outside the MCP coordinator itself.

Findings

• Finding 4: duplicated IPC channel source of truth.
  • Evidence: electron/preload.cjs, electron/ipc/channels.ts, electron/main.ts, electron/preload-allowlist.test.ts.
  • Fix direction: generate the preload CJS channel list from IPC, or move both to a generated shared manifest with exact-set tests.
• Finding 5: remote HTTP routing is a monolithic auth-sensitive handler.
  • Evidence: repeated coordinator task guards in electron/remote/server.ts.
  • Fix direction: extract jsonReply, readBody, requireOwnedTask, and split coordinator API routes into smaller handlers or a route table.
• Finding 8: repeated IPC validation boilerplate in Git handlers.
  • Evidence: repeated baseBranch, projectRoot, worktreePath, and branchName validation in electron/ipc/register.ts.
  • Fix direction: add typed helpers such as optionalBaseBranch(args) and wrappers for common Git handler shapes.
• Finding 11: .git/info/exclude append logic is duplicated.
  • Evidence: electron/ipc/register.ts, electron/ipc/steps.ts, and electron/ipc/git.ts.
  • Fix direction: extract resolveGitInfoExcludePath(worktreePath) and appendGitInfoExcludeBlock(...).
• Finding 12: changed-file assembly repeats across Git IPC paths.
  • Evidence: several ChangedFile[] rebuild paths in electron/ipc/git.ts.
  • Fix direction: extract changedFilesFromMaps(...) and countReadableTextLines(...).
• Finding 13: spawnAgent mixes too many responsibilities.
  • Evidence: electron/ipc/pty.ts:176-501.
  • Fix direction: extract env/spec construction, PTY output handler attachment, and session cleanup.
• Finding 14: ask-code providers duplicate request lifecycle.
  • Evidence: electron/ipc/ask-code.ts and electron/ipc/ask-code-minimax.ts duplicate request maps, timers, concurrency, cancel, timeout, cleanup, and send behavior.
  • Fix direction: introduce a shared RequestRegistry<T> and decide whether concurrency is global or provider-local.
• Finding 30: IPC payload types are duplicated between main and renderer.
  • Evidence: src/ipc/types.ts, electron/ipc/git.ts, electron/ipc/coverage.ts, electron/ipc/pr-checks.ts.
  • Fix direction: move shared IPC payload types into a type-only contract module.
• Finding 39: macOS install script builds a different artifact set than release builds.
  • Evidence: install.sh omits build:remote and build:mcp although packaged files include remote and MCP artifacts.
  • Fix direction: use the full release build sequence for local mac packaging.

Acceptance checks

• npm run compile
• npm run typecheck
• relevant IPC/Git/PTY/remote tests
• local mac packaging check where available