build: prune unused langchain packages, bound the langchain family

[lfnovo]

Summary

Audit of the eight langchain-* provider packages in pyproject.toml. The suspicion was that most are unused because AI calls go through esperanto — the audit shows the opposite for six of them: esperanto's to_langchain() imports the provider packages dynamically at runtime and declares them only as optional extras, so this app must pin them directly. Two packages, however, have zero importers anywhere and are removed.

Audit table

Package	Direct imports	Dynamic import via esperanto to_langchain()	Verdict
langchain-openai	0	yes — openai, deepseek, xai, openrouter, openai-compatible, azure, perplexity	keep, bound <2
langchain-anthropic	0	yes — anthropic	keep, bound <2
langchain-ollama	0	yes — ollama	keep, bound <2
langchain-google-genai	0	yes — google, vertex	keep, bound <5
langchain-groq	0	yes — groq	keep, bound <2
langchain-mistralai	0	yes — mistral	keep, bound <2
langchain-deepseek	0	no — esperanto's DeepSeek provider subclasses OpenAI-compatible and uses ChatOpenAI	removed
langchain-community	0	no — no importer in the codebase, esperanto, content-core, podcast-creator, surreal-commands or ai-prompter	removed

A comment block in pyproject.toml now records this, so the next dependency audit doesn't re-litigate it.

Transitive findings

• uv tree --invert confirms every provider package is required only by open-notebook itself (langchain-openai was also pulled by langchain-deepseek, itself removed). None of esperanto / podcast-creator / surreal-commands / ai-prompter / content-core require any of them.
• Two packages are directly imported but were never declared — they rode in transitively and are now explicit:
  • langchain-text-splitters (open_notebook/utils/chunking.py) — previously satisfied only via langchain-community → langchain-classic; removing community actually broke the import until it was declared. This was a latent bug.
  • langchain-core (imported in 10+ files) — previously satisfied via langchain/langgraph.
• Removing the two packages drops 9 distributions from the lockfile: langchain-community, langchain-deepseek, langchain-classic, dataclasses-json, greenlet, sqlalchemy, marshmallow, typing-inspect, plus langchain-text-splitters re-added as a direct dep.

Upper bounds added (langchain/langgraph family only)

langchain <2, langchain-core <2, langchain-text-splitters <2, langgraph <2, langgraph-checkpoint-sqlite <4, and <2 on the five 1.x provider packages / <5 on langchain-google-genai (4.x). No other dependencies touched.

Verification

• uv lock + uv sync clean (lockfile committed with the pyproject change)
• uv run pytest tests/ — 403 passed
• ruff check . — all checks passed
• Smoke: uv run python -c "import commands; import api.main" OK (this is what caught the langchain_text_splitters gap)

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{You’re at about 99% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{Re-trigger cubic}