chore: make web use root workspace install

.github/workflows/ci.yml

@@ -138,16 +138,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install web host dependencies
-        run: npm --prefix web ci
-
       - name: Cache Next.js build
         uses: useblacksmith/cache@v5
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Build core
@@ -199,19 +196,16 @@ jobs:
 
       # Integration tests need core compiled artifacts:
       # - dist/loader.js and packages/pi-coding-agent/dist/** from `npm run build:core`
-      # - web/node_modules/.bin/next for tests that shell `build:web-host` at runtime
+      # - root node_modules/.bin/next for tests that shell `build:web-host` at runtime
       # Duplicating the core build here (instead of sharing artifacts via needs: build)
       # preserves wall-clock parallelism with the build job — see PR #4093.
-      - name: Install web host dependencies
-        run: npm --prefix web ci
-
       - name: Cache Next.js build
         uses: useblacksmith/cache@v5
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Build core

.github/workflows/dev-publish.yml

@@ -47,16 +47,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install web host dependencies
-        run: npm --prefix web ci
-
       - name: Cache Next.js build
         uses: actions/cache@v4
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Build core

.github/workflows/next-publish.yml

@@ -46,16 +46,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install web host dependencies
-        run: npm --prefix web ci
-
       - name: Cache Next.js build
         uses: actions/cache@v4
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Build core

.github/workflows/pipeline.yml

@@ -45,16 +45,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install web host dependencies
-        run: npm --prefix web ci
-
       - name: Cache Next.js build
         uses: useblacksmith/cache@v5
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Build core
@@ -176,9 +173,9 @@ jobs:
         uses: useblacksmith/cache@v5
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Run live LLM tests (optional)
@@ -219,7 +216,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json web/package-lock.json CHANGELOG.md native/npm/*/package.json pkg/package.json packages/pi-coding-agent/package.json
+          git add package.json package-lock.json CHANGELOG.md native/npm/*/package.json pkg/package.json packages/pi-coding-agent/package.json
           git commit -m "release: v${RELEASE_VERSION}"
           git tag "v${RELEASE_VERSION}"
           git pull --rebase origin main

.github/workflows/prod-release.yml

@@ -41,9 +41,9 @@ jobs:
         uses: actions/cache@v4
         with:
           path: web/.next/cache
-          key: nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('web/app/**', 'web/components/**', 'web/lib/**', 'web/hooks/**') }}
           restore-keys: |
-            nextjs-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
             nextjs-${{ runner.os }}-
 
       - name: Run live LLM tests (optional)
@@ -84,7 +84,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json web/package-lock.json CHANGELOG.md rust-engine/npm/*/package.json pkg/package.json packages/*/package.json
+          git add package.json package-lock.json CHANGELOG.md rust-engine/npm/*/package.json pkg/package.json packages/*/package.json
           git commit -m "release: v${RELEASE_VERSION}"
           git pull --rebase origin main
           git tag "v${RELEASE_VERSION}"

docker/Dockerfile.sf-server

@@ -27,9 +27,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY package.json package-lock.json ./
 COPY packages ./packages
 COPY scripts ./scripts
-COPY web/package.json web/package-lock.json ./web/
+COPY web/package.json ./web/
 RUN --mount=type=cache,id=sf-server-root-npm,target=/root/.npm,sharing=locked \
-    npm ci && npm --prefix web ci
+    npm ci
 
 COPY . .
 ARG SF_GIT_SHA
@@ -51,7 +51,6 @@ RUN npm prune --omit=dev --ignore-scripts --legacy-peer-deps
 RUN rm -rf \
     rust-engine/target \
     web/.next/cache \
-    web/node_modules \
     node_modules/.cache \
     node_modules/playwright \
     node_modules/playwright-core \

docs/specs/sf-self-deploy.md

@@ -22,7 +22,7 @@ Forgejo runs `.forgejo/workflows/self-deploy.yml` on `main` and manual dispatch.
 The required gates are:
 
 - `npm ci`
-- `npm --prefix web ci`
+- `npm ci`
 - `npm run build:core`
 - `npm run build:web-host`
 - `npm run typecheck:extensions`

knip.json

@@ -18,7 +18,7 @@
 		"web/.next/**",
 		"web/out/**"
 	],
-	"ignoreBinaries": ["knip"],
+	"ignoreBinaries": ["knip", "next", "eslint"],
 	"ignoreDependencies": [
 		"@anthropic-ai/sdk",
 		"@anthropic-ai/vertex-sdk",
@@ -35,6 +35,7 @@
 		"@types/mime-types",
 		"@types/picomatch",
 		"@types/react",
+		"@types/react-dom",
 		"ajv-formats",
 		"autoprefixer",
 		"chalk",
@@ -56,6 +57,7 @@
 		"proper-lockfile",
 		"proxy-agent",
 		"react",
+		"react-dom",
 		"remark-parse",
 		"tailwindcss",
 		"tw-animate-css",

package.json

@@ -13,7 +13,8 @@
 	},
 	"type": "module",
 	"workspaces": [
-		"packages/*"
+		"packages/*",
+		"web"
 	],
 	"bin": {
 		"sf": "dist/loader.js",
@@ -160,7 +161,6 @@
 		"playwright": "^1.60.0",
 		"proper-lockfile": "^4.1.2",
 		"proxy-agent": "^8.0.1",
-		"react": "^19.2.6",
 		"remark-parse": "^11.0.0",
 		"sharp": "^0.34.5",
 		"shell-quote": "^1.8.3",
@@ -177,11 +177,9 @@
 		"@types/express": "^4.17.25",
 		"@types/node": "^25.8.0",
 		"@types/picomatch": "^4.0.3",
-		"@types/react": "^19.2.14",
 		"@types/shell-quote": "^1.7.5",
 		"@typescript/native-preview": "^7.0.0-dev.20260517.1",
 		"@vitest/coverage-v8": "^4.1.6",
-		"esbuild": "^0.28.0",
 		"jiti": "^2.7.0",
 		"jscpd": "^4.2.2",
 		"typescript": "^6.0.3",

scripts/build-web-host.mjs

@@ -9,7 +9,7 @@
  */
 import { spawnSync } from "node:child_process";
 
-run("npm", ["--prefix", "web", "run", "build"], {
+run("npm", ["--workspace", "sf-web", "run", "build"], {
 	env: buildEnv(),
 });
 run("npm", ["run", "stage:web-host"]);

scripts/build-web-if-stale.cjs

@@ -82,7 +82,7 @@ function sentinelMtime() {
 }
 
 function hasWebBuildDependencies() {
-	return existsSync(join(webRoot, "node_modules", ".bin", "next"));
+	return existsSync(join(root, "node_modules", ".bin", "next"));
 }
 
 function ensureWebBuildDependencies() {
@@ -91,9 +91,9 @@ function ensureWebBuildDependencies() {
 	}
 
 	console.log(
-		"[forge] Web build dependencies are missing or incomplete — running npm --prefix web ci...",
+		"[forge] Web build dependencies are missing or incomplete — running npm ci...",
 	);
-	execSync("npm --prefix web ci", { cwd: root, stdio: "inherit" });
+	execSync("npm ci", { cwd: root, stdio: "inherit" });
 }
 
 const sourceMtime = Math.max(newestMtime(webRoot), newestMtime(srcRoot));

scripts/bump-version.mjs

@@ -77,13 +77,3 @@ execSync("npm install --package-lock-only --ignore-scripts", {
 	stdio: "inherit",
 });
 console.log(`[bump-version] package-lock.json regenerated at ${newVersion}`);
-
-// 6. Regenerate web/package-lock.json if the web app is present.
-const webDir = resolve(root, "web");
-if (existsSync(webDir)) {
-	execSync("npm install --package-lock-only --ignore-scripts", {
-		cwd: webDir,
-		stdio: "inherit",
-	});
-	console.log(`[bump-version] web/package-lock.json regenerated`);
-}

scripts/generate-release-manifest.mjs

@@ -74,7 +74,6 @@ const manifest = {
 	},
 	gates: [
 		"npm ci",
-		"npm --prefix web ci",
 		"npm run build:core",
 		"npm run build:web-host",
 		"npm run typecheck:extensions",

scripts/stage-web-standalone.cjs

@@ -54,7 +54,7 @@ function overlayNodePty(targetRoot) {
 
 if (!existsSync(standaloneAppRoot)) {
 	console.error(
-		"[forge] Web standalone build not found at web/.next/standalone/web. Run `npm --prefix web run build` first.",
+		"[forge] Web standalone build not found at web/.next/standalone/web. Run `npm --workspace sf-web run build` first.",
 	);
 	process.exit(1);
 }

web/package.json

@@ -14,6 +14,7 @@
 		"lint": "eslint ."
 	},
 	"dependencies": {
+		"@codemirror/view": "^6.43.0",
 		"@hookform/resolvers": "^5.2.2",
 		"@lezer/highlight": "^1.2.3",
 		"@mariozechner/jiti": "^2.6.2",