feat(web): P1 — Vite + React Router skeleton beside Next (Phase P RFC, increment 1/6) #1143

2026-08-10T00:04:43Z

shaggy commented

2026-08-10 00:04:43 +00:00

First increment of the approved Phase P RFC (jarvis-brain:docs/scratchpads/webui-mission/PHASE-P-RFC.md, Jason-approved 2026-08-09). Additive only — Next remains the built and served app; nothing in the existing dev/build path changes.

What's in it:

index.html — Vite entry with the theme anti-flash script and font preconnects carried from app/layout.tsx.
vite.config.ts — @ alias, dev server on 3100 with a proxy (/api, /socket.io with ws: true) to the gateway on 14242, so the SPA is same-origin in dev. The config comment pins the RFC invariant: no origin is ever configured in the SPA.
src/main.tsx + src/routes.tsx — React Router route table for the v1 parity routes (/ → /chat redirect, /login, /register, /auth/provider/:provider, /chat, /projects, /projects/:id, /tasks, /settings, /admin) under GuestGuard/AuthGuard shells (src/spa/guards.tsx — session wiring lands in P2 with the reworked auth client).
vitest 2 → 3; vitest.config.ts gains the @ alias and esbuild.jsx: 'automatic' (tsconfig keeps jsx: preserve for Next). Correction (post-review): the earlier "peer pairing with vite 8" note was wrong — vitest 3.2.7 bundles its own vite 5.4.21 for the runner, while build:vite/dev:vite and @vitejs/plugin-react@6 use the app's vite 8.2.1; the two vite majors coexist by design and share no config. All 3 pre-existing spec files pass unchanged; a new route-table spec asserts the parity route set and guest/auth grouping.
New scripts dev:vite / build:vite; existing dev/build untouched (names flip at the P5 cutover).

Verified in the dev box:

pnpm test — 7/7 across 4 files (3 pre-existing + 1 new).
pnpm build:vite — green; dist/ = index.html + 42 kB CSS (Tailwind v4 through the existing postcss config, untouched) + 284 kB JS.
Dev-server smoke against the live gateway: / and /login 200; /api/auth/get-session through the proxy → null + 200 (correct unauthenticated response); Socket.IO polling handshake through the proxy → live sid.
typecheck / lint / format:check green; full pre-push gates passed.

Next: P2 (data layer + auth — relative-path api.ts, current-origin BetterAuth client, SSO runtime discovery, real login/register pages).

Independent review (2026-08-09): code review — FINDINGS (minors only), Phase-P same-origin invariant PASS; security review — APPROVE. Dispositions posted as a comment below.

First increment of the approved Phase P RFC (`jarvis-brain:docs/scratchpads/webui-mission/PHASE-P-RFC.md`, Jason-approved 2026-08-09). Additive only — Next remains the built and served app; nothing in the existing dev/build path changes. **What's in it:** - `index.html` — Vite entry with the theme anti-flash script and font preconnects carried from `app/layout.tsx`. - `vite.config.ts` — `@` alias, dev server on 3100 with a proxy (`/api`, `/socket.io` with `ws: true`) to the gateway on 14242, so the SPA is **same-origin in dev**. The config comment pins the RFC invariant: no origin is ever configured in the SPA. - `src/main.tsx` + `src/routes.tsx` — React Router route table for the v1 parity routes (`/` → `/chat` redirect, `/login`, `/register`, `/auth/provider/:provider`, `/chat`, `/projects`, `/projects/:id`, `/tasks`, `/settings`, `/admin`) under `GuestGuard`/`AuthGuard` shells (`src/spa/guards.tsx` — session wiring lands in P2 with the reworked auth client). - `vitest` 2 → 3; `vitest.config.ts` gains the `@` alias and `esbuild.jsx: 'automatic'` (tsconfig keeps `jsx: preserve` for Next). **Correction (post-review):** the earlier "peer pairing with vite 8" note was wrong — vitest 3.2.7 bundles its own vite 5.4.21 for the runner, while `build:vite`/`dev:vite` and `@vitejs/plugin-react@6` use the app's vite 8.2.1; the two vite majors coexist by design and share no config. All 3 pre-existing spec files pass unchanged; a new route-table spec asserts the parity route set and guest/auth grouping. - New scripts `dev:vite` / `build:vite`; existing `dev`/`build` untouched (names flip at the P5 cutover). **Verified in the dev box:** - `pnpm test` — 7/7 across 4 files (3 pre-existing + 1 new). - `pnpm build:vite` — green; `dist/` = index.html + 42 kB CSS (Tailwind v4 through the existing postcss config, untouched) + 284 kB JS. - Dev-server smoke against the live gateway: `/` and `/login` 200; `/api/auth/get-session` through the proxy → `null` + 200 (correct unauthenticated response); Socket.IO polling handshake through the proxy → live sid. - `typecheck` / `lint` / `format:check` green; full pre-push gates passed. Next: P2 (data layer + auth — relative-path `api.ts`, current-origin BetterAuth client, SSO runtime discovery, real login/register pages). --- _Independent review (2026-08-09): code review — FINDINGS (minors only), Phase-P same-origin invariant PASS; security review — APPROVE. Dispositions posted as a comment below._

shaggy added 1 commit 2026-08-10 00:04:44 +00:00

feat(web): P1 Vite skeleton beside Next — entry, router, guards, vitest 3

ci/woodpecker/pr/ci Pipeline was successful

Details

068d0f9b1c

First increment of the approved Phase P RFC (webui-mission). Adds a Vite + React
Router SPA scaffold coexisting with the Next app: index.html with the theme
anti-flash script, src/main.tsx entry, the v1 parity route table under Guest/Auth
guard shells, and a dev proxy (/api, /socket.io ws) to the gateway on 14242 so the
SPA is same-origin in dev. vitest bumped to v3 (vite 8 pairing); existing specs
pass unchanged. Next remains the served app until the P5 cutover.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01ESFAnh2t9HmLwng8oW95St

shaggy commented

2026-08-10 00:49:12 +00:00

CODE-REVIEW DISPOSITION (#1143) — independent reviewer (author ≠ reviewer), verdict FINDINGS (minors only); Phase-P same-origin invariant PASS (the only origin is the dev-only Vite proxy target, which is allowed; the SPA import graph carries no gateway origin).

#	Finding	Disposition
1	[minor] PR-body claim "vitest 2→3 (peer pairing with vite 8)" is factually wrong — vitest 3.2.7 bundles vite 5.4.21	FIXED — PR body corrected post-review to state the two vite majors coexist by design.
2	[minor] pre-existing `src/lib/{api,auth-client,socket}.ts` `localhost:14242` fallbacks remain	DEFERRED to P2 — the P2 brief removes all three (relative-path api, origin-free auth client, `io('/chat')`); P2 review confirms. Not reachable from the SPA entry in P1.
3	[minor] `index.html` duplicates theme/font markup from `layout.tsx`	ACCEPTED (rationale) — intentional until the P5 cutover deletes the Next path; drift risk tracked in the RFC §6 cutover step.
4	[minor] `routes.spec.tsx` couples to positional route-group order	DEFERRED to P2 — P2 edits `routes.tsx`; grouping selection will be made structural (by which group contains `/login`).
5	[minor] lockfile churn (lightningcss 1.31.1→1.33.0) in other workspaces	ACCEPTED (rationale) — benign transitive re-resolve from the shared pnpm graph; no behavior change.

No blockers. Merge-eligible on this lens.

**CODE-REVIEW DISPOSITION (#1143)** — independent reviewer (author ≠ reviewer), verdict **FINDINGS (minors only)**; Phase-P same-origin invariant **PASS** (the only origin is the dev-only Vite proxy target, which is allowed; the SPA import graph carries no gateway origin). | # | Finding | Disposition | |---|---------|-------------| | 1 | [minor] PR-body claim "vitest 2→3 (peer pairing with vite 8)" is factually wrong — vitest 3.2.7 bundles vite 5.4.21 | **FIXED** — PR body corrected post-review to state the two vite majors coexist by design. | | 2 | [minor] pre-existing `src/lib/{api,auth-client,socket}.ts` `localhost:14242` fallbacks remain | **DEFERRED to P2** — the P2 brief removes all three (relative-path api, origin-free auth client, `io('/chat')`); P2 review confirms. Not reachable from the SPA entry in P1. | | 3 | [minor] `index.html` duplicates theme/font markup from `layout.tsx` | **ACCEPTED (rationale)** — intentional until the P5 cutover deletes the Next path; drift risk tracked in the RFC §6 cutover step. | | 4 | [minor] `routes.spec.tsx` couples to positional route-group order | **DEFERRED to P2** — P2 edits `routes.tsx`; grouping selection will be made structural (by which group contains `/login`). | | 5 | [minor] lockfile churn (lightningcss 1.31.1→1.33.0) in other workspaces | **ACCEPTED (rationale)** — benign transitive re-resolve from the shared pnpm graph; no behavior change. | No blockers. Merge-eligible on this lens.

shaggy commented

2026-08-10 00:49:13 +00:00

SECURITY-REVIEW DISPOSITION (#1143) — independent reviewer (author ≠ reviewer), verdict APPROVE.

New deps ([email protected], [email protected], [email protected], @vitejs/[email protected]) are legitimate first-party names — no typosquats. All 53 added lockfile resolutions come from registry.npmjs.org with sha512 integrity; none carry a postinstall/preinstall script or a custom registry/git tarball.
Same-origin dev proxy introduces no CORS relaxation, no cross-origin cookie handling, no Access-Control-*; no production origin is hardcoded (matches the RFC invariant).
Guards are intentional no-op <Outlet/> shells — auth is deferred, not weakened; the SPA is not yet the served app.
The index.html pre-paint script reads only localStorage['mosaic-theme'] and writes a sanitized 'light'|'dark' data-theme — no innerHTML/eval, no injection surface.

No blockers. Merge-eligible on this lens.

**SECURITY-REVIEW DISPOSITION (#1143)** — independent reviewer (author ≠ reviewer), verdict **APPROVE**. - New deps (`[email protected]`, `[email protected]`, `[email protected]`, `@vitejs/[email protected]`) are legitimate first-party names — no typosquats. All 53 added lockfile resolutions come from `registry.npmjs.org` with `sha512` integrity; none carry a `postinstall`/`preinstall` script or a custom registry/git tarball. - Same-origin dev proxy introduces no CORS relaxation, no cross-origin cookie handling, no `Access-Control-*`; no production origin is hardcoded (matches the RFC invariant). - Guards are intentional no-op `<Outlet/>` shells — auth is deferred, not weakened; the SPA is not yet the served app. - The `index.html` pre-paint script reads only `localStorage['mosaic-theme']` and writes a sanitized `'light'|'dark'` `data-theme` — no `innerHTML`/eval, no injection surface. No blockers. Merge-eligible on this lens.

shaggy merged commit c3496334a5 into next

2026-08-10 00:51:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1143