oleksandr-blip · Oct 5, 2026 · Oct 5, 2026
@@ -146,7 +146,7 @@ jobs:
           node-version: 20
           cache: npm
           cache-dependency-path: |
-            package-lock.json
+            apps/web/package-lock.json
             apps/desktop/package-lock.json
 
       - name: Prepare Rust tools

@@ -14,7 +14,8 @@ on:
     # The native shells release through desktop-release.yml; a shell-only merge
     # changes nothing in the web image.
     paths-ignore:
-      - 'apps/**'
+      - 'apps/desktop/**'
+      - 'apps/mobile/**'
       - '.github/workflows/desktop-*.yml'
   workflow_dispatch:
     inputs:
@@ -127,9 +128,9 @@ jobs:
             args=(--platform linux/amd64,linux/arm64 --push --provenance=false --sbom=true
                   --build-arg GITHUB_ACTOR=${{ github.actor }}
                   --build-arg OPENFRAME_BUNDLE_VERSION="${RELEASE_VERSION:-main-${GITHUB_SHA::7}}"
-                  -f ./Dockerfile)
+                  -f ./apps/web/Dockerfile)
             while IFS= read -r t; do [ -n "$t" ] && args+=(--tag "$t"); done <<< "$META_TAGS"
-            docker buildx build "${args[@]}" .
+            docker buildx build "${args[@]}" ./apps/web
 
   # Same as the forks: every released image gets a GitHub release of the same
   # name, and its tag marks the commit the desktop shell builds its static export

@@ -61,15 +61,18 @@ jobs:
         with:
           node-version: 24
           cache: npm
+          cache-dependency-path: apps/web/package-lock.json
 
       - name: Install dependencies
+        working-directory: apps/web
         run: npm ci --no-audit --no-fund
 
       # No codegen step on purpose: the fast pass carries no type-aware rules, so
       # it reports the same findings with or without `src/__generated__` and
       # `src/generated` present (verified). Skipping relay-compiler and
       # generate-enums keeps this job a fraction of the image build's cost.
       - name: ESLint
+        working-directory: apps/web
         run: npm run lint:ci
 
   build_image:
@@ -128,17 +131,17 @@ jobs:
             args=(--platform linux/amd64,linux/arm64
                   --build-arg GITHUB_ACTOR=${{ github.actor }}
                   --build-arg OPENFRAME_BUNDLE_VERSION="pr-${PR_NUMBER}-${PR_SHA::7}"
-                  -f "./Dockerfile")
+                  -f "./apps/web/Dockerfile")
             while IFS= read -r t; do [ -n "$t" ] && args+=(--tag "$t"); done <<< "$META_TAGS"
-            docker buildx build "${args[@]}" "."
+            docker buildx build "${args[@]}" "./apps/web"
 
       - name: Scan image
         uses: ./.github/steps/trivy
         with:
           scan: image
           image-name: ${{ env.REPOSITORY }}
-          dockerfile: ./Dockerfile
-          context: .
+          dockerfile: ./apps/web/Dockerfile
+          context: ./apps/web
 
       - name: Push image pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} (pr-${{ github.event.pull_request.number }} tag)
         id: docker_push
@@ -156,9 +159,9 @@ jobs:
             args=(--platform linux/amd64,linux/arm64
                   --build-arg GITHUB_ACTOR=${{ github.actor }}
                   --build-arg OPENFRAME_BUNDLE_VERSION="pr-${PR_NUMBER}-${PR_SHA::7}"
-                  -f "./Dockerfile")
+                  -f "./apps/web/Dockerfile")
             while IFS= read -r t; do [ -n "$t" ] && args+=(--tag "$t"); done <<< "$META_TAGS"
-            docker buildx build "${args[@]}" --push --provenance=false --sbom=true "."
+            docker buildx build "${args[@]}" --push --provenance=false --sbom=true "./apps/web"
 
   cleanup:
     name: Cleanup

@@ -1,39 +1,11 @@
-# Frontend .gitignore — mirrors the frontend-relevant rules from the
-# openframe-oss-tenant monorepo root .gitignore, scoped to this standalone repo's root.
-
-# Dependencies
+# Repository-wide ignores. Each app under apps/ carries its own .gitignore for
+# its build output; patterns there are relative to that app.
 node_modules/
 
-# Yalc (local core-lib linking)
-.yalc
-yalc.lock
-
-# Next.js / build output
-.next/
-dist/
-tsconfig.tsbuildinfo
-next-env.d.ts
-/artifacts/
-
-# Generated — regenerated by the build, never committed
-# Relay compiler artifacts (npm run relay)
-**/__generated__/*.ts
-# Schema-derived enums (scripts/generate-schema-enums.mjs)
-src/generated/
-
-# Env (note: matches the monorepo — .env.local stays tracked)
-.env
-
-# Logs
-*.log
-**/logs
-
 # Editors / OS
 .idea/
 *.iml
-.vscode/chrome-debug-profile
 **/.DS_Store
-**.DS_Store
 
 # Claude
 **/.claude/
@@ -5,13 +5,20 @@
 # about through its last command.
 set -eu
 
+# Git runs hooks from the repository root; the web app and every tool below
+# (eslint/prettier/tsc configs, node_modules) live in apps/web. `--relative`
+# limits each diff to that directory and prints paths relative to it, which is
+# what tsc's diagnostics carry. The native shells (apps/desktop, apps/mobile)
+# have no JS/TS gate here.
+cd apps/web
+
 # NUL-delimited, and the extension filter lives in a git pathspec rather than a
 # grep: `git diff --name-only` quotes any path containing a non-ASCII byte
 # ("src/caf\303\251.ts"), so such a file matched neither the `$`-anchored
 # extension pattern nor a real file on disk and was silently skipped by both
 # checks below. `-z` turns quoting off, and nothing line-oriented touches the list.
 staged_files() {
-  git diff --cached --name-only -z --diff-filter=ACMR \
+  git diff --cached --relative --name-only -z --diff-filter=ACMR \
     -- '*.ts' '*.tsx' '*.js' '*.jsx' '*.mjs' '*.cjs'
 }
 
@@ -28,7 +35,7 @@ fi
 # content that is not what gets committed. Materializing the index instead would
 # mean a full checkout-index tree plus a node_modules symlink for tsc to resolve
 # `@/*` — too much machinery for a pre-commit hook, so refuse the ambiguity.
-PARTIAL=$(git diff --name-only -z \
+PARTIAL=$(git diff --relative --name-only -z \
   -- '*.ts' '*.tsx' '*.js' '*.jsx' '*.mjs' '*.cjs' \
   | tr '\0' '\n' | STAGED="$STAGED" awk '
     BEGIN { n = split(ENVIRON["STAGED"], f, "\n") }

@@ -3,7 +3,7 @@
     "**/dist": true,
     "**/.next": true
   },
-  "typescript.tsdk": "node_modules/typescript/lib",
+  "typescript.tsdk": "apps/web/node_modules/typescript/lib",
   "typescript.enablePromptUseWorkspaceTsdk": true,
 
   // Format on save + ESLint autofix on save, as one action. Having only
@@ -25,6 +25,9 @@
   // live in eslint.types.mjs and are deliberately not run here: they need a
   // TypeScript program and an 8 GB heap. Run `npm run lint:types` before pushing.
   "eslint.useFlatConfig": true,
+  // The web app's eslint config and node_modules live in apps/web, not at the
+  // workspace root the editor opens.
+  "eslint.workingDirectories": [{ "directory": "apps/web", "changeProcessCWD": true }],
   "eslint.validate": ["javascript", "javascriptreact", "typescript", "typescriptreact"],
   "eslint.problems.shortenToSingleLine": true,