build: make web an npm workspace, with one lockfile and both runtimes working

`web/` had a tsconfig and a vite config but no manifest, so its build tooling —
vite, panda, preact, @types/react-dom — sat in the root manifest advertising
itself as a dependency of a launcher that never loads any of it. It is now
`@swisscode/web`, private, owning its own devDeps.

Nothing about the published artifact changes: `files` decides that, not the
layout. Still 75 files, 122.8 kB packed.

ONE LOCKFILE, AND IT HAS TO BE package-lock.json. Not preference: `bun install`
does not read it and resolves fresh — I diffed the resulting trees and found 5
transitive packages disagreeing (lightningcss, postcss, picomatch,
@babel/code-frame) while every declared dependency matched. Small, but that is
how "works on my machine" starts. And the choice is forced anyway: `bun publish`
has no OIDC/provenance equivalent, so npm stays in the release path permanently.
`bun.lock` is gitignored so the drift cannot be committed.

Bun loses nothing by this. It remains a first-class runtime — `bun run test`
passes 770/770 against an npm-installed tree, `bunx swisscode` works, and
swisscode runs under bun. It is simply not the installer.

Two things this shook out, both fixed rather than worked around:

- `npm run --workspace web typecheck` BREAKS UNDER BUN. Bun rewrites `npm run`
  to `bun run` inside scripts and spells the same idea `--filter`, so the script
  failed with "Script not found web". The fix is to not need workspace machinery
  for what is one tsc invocation: `tsc --noEmit -p web/tsconfig.json` works
  identically everywhere. No package-manager-specific flags in `scripts`.
- build.js hard-coded `../node_modules/vite/bin/vite.js`. npm and bun do not
  agree on where workspace deps land, and either can nest on a version
  conflict, so it now looks in both `web/node_modules` and the root — the
  "works on my machine" this project runs two runtimes to avoid.

Verified end to end under both: npm install, npm ci, bun install, build, full
suite, and the packed artifact.

Signed-off-by: jellologic <31935831+jellologic@users.noreply.github.com>

Author: jellologic

.gitignore

@@ -8,3 +8,11 @@ web/styled-system/
 # Playwright MCP writes screenshots here during manual verification
 .playwright-mcp/
 profiles.png
+
+# Bun resolves fresh rather than reading package-lock.json, so a committed
+# bun.lock would drift from it silently — measured at 5 transitive packages.
+# package-lock.json is canonical: `npm ci` gates CI, and npm trusted publishing
+# (OIDC + provenance) keeps the npm CLI in the release path permanently.
+# Bun stays a first-class RUNTIME — `bun run`, `bunx` — just not the installer.
+bun.lock
+bun.lockb

AGENTS.md

@@ -53,6 +53,7 @@ runtime assertions and is checked by `tsc`. `npm run typecheck` runs it.
 | `src/composition/**` | Five composition roots: `launch-root` (hot path), `config-root`, `doctor-root`, `ui-root`, `web-root`. |
 | `bin/swisscode.js` | Published entry shim. Plain JS, never compiled, imports exactly `../dist/cli.js`. |
 | `test/**` | `.ts`, run from source, never compiled, never packed. |
+| `web/**` | An npm WORKSPACE (`@swisscode/web`, private). Owns the browser-only devDeps — vite, panda, preact, `@types/react-dom`. Ships as built assets inside the swisscode package, never as its own release. |
 
 ## Hard invariants
 
@@ -196,6 +197,17 @@ neutral `LaunchIntent` is missing something — propose that instead.
 
 ## Useful facts
 
+- **`package-lock.json` is the only lockfile. Install with npm.** `bun install`
+  does not read it and resolves fresh — measured drift of 5 transitive packages
+  — and `bun publish` has no OIDC/provenance, so the npm CLI is permanently in
+  the release path (`publish.yml`). `bun.lock` is gitignored.
+- **Bun is a first-class RUNTIME, not the installer.** `bun run <script>`,
+  `bunx swisscode` and running swisscode under bun all work against an
+  npm-installed tree, and CI-equivalent `bun run test` passes. Keep it that way:
+  no package-manager-specific flags in `scripts`. `npm run --workspace web x`
+  breaks under bun, which rewrites `npm run` to `bun run` inside scripts and
+  spells the same idea `--filter`. Plain invocations (`tsc -p web/tsconfig.json`)
+  work everywhere.
 - Config: `~/.config/swisscode/config.json` (honours `XDG_CONFIG_HOME`), `0600`
   in a `0700` directory, written atomically. v1 configs migrate on read.
 - Env vars swisscode reads: `SWISSCODE_CLAUDE_BIN`, `SWISSCODE_KILO_BIN`,

build.js

@@ -9,12 +9,28 @@
 // allowed to reach.
 import { execFileSync } from 'node:child_process'
 import { existsSync, rmSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
 import * as esbuild from 'esbuild'
 
 const TSC = 'node_modules/typescript/bin/tsc'
-const PANDA = '../node_modules/@pandacss/dev/bin.js'
-const VITE = '../node_modules/vite/bin/vite.js'
+
+/**
+ * Find a workspace tool, WHEREVER THE INSTALLER PUT IT.
+ *
+ * `web` is a workspace now, and npm and bun do not agree on where its
+ * dependencies land: npm usually hoists them to the root `node_modules`, bun
+ * may leave them in `web/node_modules`, and either can change its mind when a
+ * version conflict forces nesting. Hard-coding one path made the build work
+ * under one package manager and fail under the other, which is exactly the
+ * "works on my machine" this project runs two runtimes to avoid.
+ */
+function workspaceTool(relative) {
+  for (const base of ['web/node_modules', 'node_modules']) {
+    const candidate = join(base, relative)
+    if (existsSync(candidate)) return resolve(candidate)
+  }
+  return null
+}
 
 // Stale output is worse than no output: a deleted module would otherwise linger
 // in dist/ and keep resolving.
@@ -63,16 +79,18 @@ await esbuild.build({
 // rather than 404ing.
 const webRoot = 'web'
 let webBuilt = false
-if (existsSync(join(webRoot, 'node_modules', '.bin', 'vite')) || existsSync('node_modules/vite')) {
+const panda = workspaceTool('@pandacss/dev/bin.js')
+const vite = workspaceTool('vite/bin/vite.js')
+if (panda && vite) {
   // Panda is CODEGEN, and it has to run before Vite: the generated
   // styled-system/ is what the app imports, and its PostCSS plugin is what
   // fills the @layer declarations. Skipping it produces a build that succeeds
   // and a page that renders completely unstyled.
-  execFileSync(process.execPath, [PANDA, 'codegen', '--config', 'panda.config.ts'], {
+  execFileSync(process.execPath, [panda, 'codegen', '--config', 'panda.config.ts'], {
     cwd: webRoot,
     stdio: 'inherit',
   })
-  execFileSync(process.execPath, [VITE, 'build'], { cwd: webRoot, stdio: 'inherit' })
+  execFileSync(process.execPath, [vite, 'build'], { cwd: webRoot, stdio: 'inherit' })
   webBuilt = true
 } else {
   console.log('skipped dist/web (frontend toolchain not installed)')

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "swisscode",
   "version": "0.4.0",
-  "description": "Drop-in launcher for Claude Code, Kilo & OpenCode. Run multiple Claude Pro/Max accounts, check usage limits and switch accounts without /login — or point any coding CLI at Ollama (local, no key), OpenRouter, z.ai/GLM, DeepSeek & Qwen. No proxy, no daemon.",
+  "description": "Drop-in launcher for Claude Code, Kilo & OpenCode. Run multiple Claude Pro/Max accounts, check usage limits and switch accounts without /login \u2014 or point any coding CLI at Ollama (local, no key), OpenRouter, z.ai/GLM, DeepSeek & Qwen. No proxy, no daemon.",
   "type": "module",
   "bin": {
     "swisscode": "./bin/swisscode.js"
@@ -14,6 +14,9 @@
     "dist",
     "README.md"
   ],
+  "workspaces": [
+    "web"
+  ],
   "scripts": {
     "build": "node build.js",
     "dev": "node build.js && tsc -p tsconfig.build.json --watch --preserveWatchOutput",
@@ -75,15 +78,10 @@
     "react": "^19.2.0"
   },
   "devDependencies": {
-    "@pandacss/dev": "^1.11.4",
     "@types/node": "^22.20.1",
     "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^5.2.0",
     "esbuild": "^0.28.1",
     "ink-testing-library": "^4.0.0",
-    "preact": "^10.29.7",
-    "typescript": "^7.0.2",
-    "vite": "^8.1.5"
+    "typescript": "^7.0.2"
   }
 }

package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@swisscode/web",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "description": "The browser UI for swisscode. Private: it ships as built assets inside the swisscode package, never as its own release.",
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "devDependencies": {
+    "@pandacss/dev": "^1.11.4",
+    "@vitejs/plugin-react": "^5.2.0",
+    "vite": "^8.1.5",
+    "preact": "^10.29.7",
+    "@types/react-dom": "^19.2.3"
+  }
+}