From 33abf2a4d8e644fcf0f510f28afdbab2cf2a741d Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Tue, 21 Jul 2026 01:37:53 +0200
Subject: [PATCH] fix(build): stop the host tree leaking into the image, split
 the tsc lanes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round 1 fallout, all of it verified against real builds:

- .dockerignore: `node_modules/` is anchored at the context root and has no
  implicit `**/` (unlike gitignore), so it never matched frontend/node_modules.
  `COPY frontend/ ./` was overlaying the Windows host's node_modules on top of
  what `npm ci` had installed — the image carried @esbuild/win32-x64 and 31 .cmd
  shims, and the new typecheck ran a tsc resolved from that merged tree. Build
  context transfer drops 3.05 GB -> 19 kB. Also excludes e2e/.auth (a live
  Playwright session), the report/result dirs and logs.
- build no longer type-checks the e2e project: a type error in a spec must not
  make the app unbuildable for a self-hoster. The gate still checks it via
  `npm run typecheck` (now three named lanes).
- tsconfig.json references tsconfig.node.json, so editors check vite.config.ts /
  vitest.config.ts under the same config the gate uses instead of an inferred one.
- vitest include accepts .test.tsx: an uncollected test file does not fail, it
  silently never runs.
---
 .dockerignore               | 11 ++++++++++-
 frontend/package.json       |  7 +++++--
 frontend/tsconfig.json      |  7 ++++++-
 frontend/tsconfig.node.json | 10 +++++++++-
 frontend/vitest.config.ts   |  5 ++++-
 5 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 6c63979..f9bc435 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,8 +6,17 @@
 **/*.pyc
 .venv/
 venv/
-node_modules/
+# Docker patterns are anchored at the context root with NO implicit `**/` (unlike .gitignore, where
+# this same line matches at any depth) — a bare `node_modules/` missed frontend/node_modules, so
+# `COPY frontend/ ./` overlaid the host's Windows tree on top of what `npm ci` had just installed.
+**/node_modules/
 frontend/dist/
+# Host-only test artifacts. e2e/.auth/state.json is a live Playwright session: it never reached the
+# runtime image (stage 2 copies only /fe/dist), but it has no business in the build context either.
+frontend/e2e/.auth/
+frontend/playwright-report/
+frontend/test-results/
+**/*.log
 backups/
 *.dump
 README.md
diff --git a/frontend/package.json b/frontend/package.json
index dceb1b5..5858783 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -4,8 +4,11 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.node.json && tsc --noEmit -p e2e/tsconfig.json",
-    "build": "npm run typecheck && vite build",
+    "typecheck": "npm run typecheck:app && npm run typecheck:node && npm run typecheck:e2e",
+    "typecheck:app": "tsc --noEmit -p tsconfig.json",
+    "typecheck:node": "tsc -p tsconfig.node.json",
+    "typecheck:e2e": "tsc --noEmit -p e2e/tsconfig.json",
+    "build": "npm run typecheck:app && npm run typecheck:node && vite build",
     "preview": "vite preview",
     "knip": "knip",
     "test": "vitest run",
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
index 83b5c91..c2afdb2 100644
--- a/frontend/tsconfig.json
+++ b/frontend/tsconfig.json
@@ -15,5 +15,10 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true
   },
-  "include": ["src"]
+  "include": ["src"],
+  // Editors resolve a file to the nearest tsconfig that INCLUDES it; vite.config.ts / vitest.config.ts
+  // are in neither this project's `include` nor e2e's, so without this reference the language service
+  // falls back to an inferred project (non-strict, DOM lib) and shows you different errors than
+  // `npm run typecheck` does. The reference makes the editor and the gate agree.
+  "references": [{ "path": "./tsconfig.node.json" }]
 }
diff --git a/frontend/tsconfig.node.json b/frontend/tsconfig.node.json
index 16b252c..9e7f595 100644
--- a/frontend/tsconfig.node.json
+++ b/frontend/tsconfig.node.json
@@ -4,6 +4,15 @@
   // so until now nothing type-checked these files at all (R2 / C-4.5). `npm run typecheck`
   // runs this project alongside src and e2e.
   "compilerOptions": {
+    // composite: required to be the target of tsconfig.json's `references` (which is what makes
+    // editors check these files under THIS config instead of an inferred one). A composite project
+    // may not disable emit (TS6310), so it emits declarations only, into node_modules — nothing
+    // lands in the repo and nothing reaches the bundle. Hence `tsc -p` without --noEmit below.
+    "composite": true,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "./node_modules/.tmp/tsconfig-node",
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig-node/.tsbuildinfo",
     "target": "ES2022",
     "module": "ESNext",
     "moduleResolution": "bundler",
@@ -11,7 +20,6 @@
     "types": ["node"],
     "strict": true,
     "skipLibCheck": true,
-    "noEmit": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "resolveJsonModule": true
diff --git a/frontend/vitest.config.ts b/frontend/vitest.config.ts
index 1ebbfaa..104221c 100644
--- a/frontend/vitest.config.ts
+++ b/frontend/vitest.config.ts
@@ -7,7 +7,10 @@ import { defineConfig } from "vitest/config";
 // component has to wire @vitejs/plugin-react (and a DOM environment) here itself.
 export default defineConfig({
   test: {
-    include: ["src/**/*.test.ts"],
+    // .tsx included on purpose: a test file the glob misses does not fail, it is simply never
+    // collected, and the gate still prints green. (Such a test must still wire plugin-react +
+    // a DOM environment here — see above — but at least it will run and say so.)
+    include: ["src/**/*.test.{ts,tsx}"],
     environment: "node",
   },
 });