[RohanReddy44]

Nine commits covering how this repo is built, checked and documented. It grew past its original scope: a container build failure turned into a toolchain migration, and a review for unused code turned up a fair amount.

Toolchain: Bun → Node and npm

Bun was chosen because npm could not install this tree at all, crashing with Cannot read properties of null (reading 'edgesOut').

That was one dependency, not the tree. npm installs cleanly with vitest removed and crashes in #loadPeerSet with it present — vitest 4 declares a large optional-peer set npm's arborist cannot walk. Vitest 5 does not have the problem, so the fix was an upgrade rather than a workaround.

What forced the question was the container build failing with Cannot find package 'tsx:'. vite.config.ts passes virtualRouteConfig as a path, so the router generator loads that TypeScript file through tsx — a Node loader. The fix on Bun was to install Node beside it: two runtimes to work around one plugin. It also failed only intermittently, depending on whether the generator's cache re-ran, so the build worked on one machine and not the next.

Nothing runs a JavaScript runtime in production — the artifact is static files behind nginx — so this is a build-time choice only.

Two things npm surfaced that Bun had absorbed silently:

• @vitest/coverage-v8 was pinned to 4.0.17 against vitest@^4.1.11, a real conflict
• vitest 3 would also have installed, but carries a moderate path-traversal advisory covering 2.1.0-beta.1–4.1.10. Downgrading would have added a vulnerability

No --legacy-peer-deps anywhere: it hides exactly this kind of conflict.

CI: one workflow, chained jobs

check ──┬──→ build ──┬──→ image   (main and release tags only)
        └──→ security ┘

Split across three files they all fired at once, and the image workflow re-ran every check the first had already run. That duplication came from copying the sibling repos' layout without questioning it; DSS and knowledge-provider both carry it.

A pull request stops after build. npm run build catches build errors; the image is only built where it is published. The job-level condition replaces two per-step guards that were the only thing stopping a PR from publishing.

Two checks the siblings have no equivalent for:

• The route tree must be current, guarding against a committed copy drifting from src/routes.ts
• A bundle budget, 6 MB for dist and 2 MB per file. This client shipped an 8.66 MB SVG to every visitor for its whole life upstream. dist is 3.3 MB today

Coverage is printed, not uploaded. No threshold — the suite is small and an invented number would be trivially met or fail on the first honest commit.

Hooks

pre-commit runs lint, typecheck, knip and tests. commit-msg enforces <type>: <summary> [#<issue-no>], with the issue number optional — requiring it blocks commits with no tracker issue, and what people write then is [#0].

Three things had to be fixed before knip could gate rather than nag: it was never a declared dependency; src/routes.ts is invisible to static analysis so knip called it and @tanstack/virtual-file-routes dead; and knip does not follow CSS imports, so three Tailwind packages looked unused.

Both hooks now set -e themselves. Husky's shim runs them with sh -e, so nothing changes under git — but run directly, the script executed every check and returned only the last one's status. A failing lint could have looked like a pass.

Dead code removed

A whole-graph sweep. Unused exports 35 → 20, unused types 7 → 0; the 20 remaining are all vendored shadcn kept as a complete API, which tree-shaking drops from the bundle anyway.

• The recording half of audio-utils.ts was dead — no callers, and removing it orphaned four private helpers and an interface in turn. 374 lines → 93. Playback survives
• The per-screen query layer was empty scaffolding — export const ChatScreenQueries = {} as const with a TODO, behind two barrels and a misspelled componets/ directory. The queryClient stays; it is where the first thing needing caching plugs in
• OnRequestError was a React component returning an empty <div>, used as a MutationCache onError callback. Only the logging ever had an effect
• Telemetry left two modules and a 648 KB dependency behind — getBrowserInfo, getFingerprintId and @fingerprintjs/fingerprintjs
• ConfigProvider's React context had no consumer — everything reads getConfig() directly
• The screen-scaffold generator, 250 lines, whose default parent was a route group deleted with sign-in

Cleanup

build.yml pushed to GCP Artifact Registry on branches this fork does not have, so it never ran. The governance doc and script described a CODEOWNERS gate whose owners file and workflow are already gone. desgin/ was a misspelled directory carried since the initial commit. .gitignore now covers keys, so the untracked oan/oan.pub keypair cannot be committed by accident.

Documentation

AGENTS.md with CLAUDE.md symlinked, and CONVENTIONS.md — the same layout as the sibling repos, adapted rather than copied. The gotchas section is the part worth reading; every entry has already cost time here.

No versioning section: package.json says 0.0.0, the settings drawer hardcodes 1.0.0, and documenting either would be fiction. Formatting is recorded as not enforced rather than implied, since Prettier is installed but unconfigured.

Verified

Clean worktree at the head commit with npm ci: lint, typecheck, knip, 23 tests, coverage, build, route-tree guard, bundle budget. The image builds --no-cache on node:22-alpine and serves — routes fall back, missing files 404, config is no-store, and the app renders under a strict CSP.

Two still open

Both about future commits rather than tooling:

1. Attribution trailers. The sibling repos' conventions ban them; every commit here carries one. CONVENTIONS.md says nothing either way rather than deciding it silently
2. Merge strategy. They are rebase-only; these PRs have landed as merge commits

🤖 Generated with Claude Code