chore(package.json), feat(shell, chat, strategy-curator): pin pnpm version, env-configurable WS/remote URLs for Railway deploy (Build-Order Step 9)

Pin packageManager: pnpm@10.15.0 in root package.json — Railway's Railpack
builder was resolving a different pnpm version than the one that generated
pnpm-lock.yaml, causing `pnpm install --frozen-lockfile` to fail during the
first deploy attempt (reproduced only on Railway; local installs were
unaffected since node_modules was already in sync).

shell/rsbuild.config.ts: strategyCurator and chat's federation remote URLs
now read from PUBLIC_STRATEGY_CURATOR_REMOTE/PUBLIC_CHAT_REMOTE env vars
at build time (localhost defaults preserved for dev) — the other twelve
remotes stay hardcoded, since Module Federation remotes are lazy-loaded
and nothing in the humain-vc flow ever navigates to them.

shell/src/App.svelte, apps/chat/src/App.svelte,
apps/strategy-curator/src/curation.svelte.ts: each app independently
connects to workspace-service's WS endpoint (no shared workspace
singleton across federation) — all three now read PUBLIC_WS_URL instead
of a hardcoded ws://localhost:3001/ws.

Files changed:
- package.json
- shell/rsbuild.config.ts
- shell/src/App.svelte
- apps/chat/src/App.svelte
- apps/strategy-curator/src/curation.svelte.ts

Author: mpstaton

apps/chat/src/App.svelte

@@ -1,20 +1,30 @@
 <script lang="ts">
   // Chat root. Connects the workspace, mounts CharacterCastRow + ChatSurface.
   // Standalone-mode-friendly: at :3006 the chat connects directly to
-  // workspace-service at ws://localhost:3001/ws; in federation mode the
-  // shell mounts this remote and the same connection is established.
+  // workspace-service at PUBLIC_WS_URL (localhost:3001 default for dev); in
+  // federation mode the shell mounts this remote and the same connection
+  // is established independently (no shared workspace singleton).
 
   import { onMount } from 'svelte';
   import { workspace } from '@augment-it/workspace';
   import CharacterCastRow from './CharacterCastRow.svelte';
   import ChatSurface from './ChatSurface.svelte';
 
+  // No `shared` block in federation (see shell/rsbuild.config.ts's note) —
+  // this remote owns its own workspace singleton and connects independently
+  // even when mounted inside the shell, so it needs the same env-configured
+  // WS_URL the shell and strategy-curator each read (rsbuild inlines
+  // PUBLIC_-prefixed vars into import.meta.env at build time).
+  const WS_URL =
+    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+    'ws://localhost:3001/ws';
+
   let connectionStatus = $state<'connecting' | 'open' | 'closed' | 'error'>('connecting');
 
   onMount(() => {
     const TOKEN_KEY = 'augment_it_session_token';
     workspace.connect({
-      url: 'ws://localhost:3001/ws',
+      url: WS_URL,
       getToken: () => localStorage.getItem(TOKEN_KEY),
       saveToken: (t) => localStorage.setItem(TOKEN_KEY, t),
       onStatus: (s) => {

apps/strategy-curator/src/curation.svelte.ts

@@ -12,7 +12,15 @@ import { workspace, WORKSPACE_CHANGED_EVENT, type WorkspaceSummary } from '@augm
 import type { ExtractKind, Source, Strategy } from './types';
 
 const TOKEN_KEY = 'augment-it:session-token';
-const WS_URL = 'ws://localhost:3001/ws';
+// No `shared` block in federation (shell/rsbuild.config.ts) — this remote
+// owns its own workspace singleton and connects independently even when
+// mounted inside the shell, so it needs the same env-configured WS_URL the
+// shell and chat each read (rsbuild inlines PUBLIC_-prefixed vars into
+// import.meta.env at build time — applies to plain .ts modules too, not
+// just .svelte files).
+const WS_URL =
+  ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+  'ws://localhost:3001/ws';
 const ACTIVE_STRATEGY_KEY = 'augment-it:active-strategy';
 // The operator-chosen domain type this surface is currently browsing/
 // writing into ('strategy', 'thesis', or any other value they type at

package.json

@@ -2,6 +2,7 @@
   "name": "augment-it",
   "version": "3.0.1.0",
   "private": true,
+  "packageManager": "pnpm@10.15.0",
   "workspaces": [
     "apps/*",
     "packages/*",

shell/rsbuild.config.ts

@@ -7,6 +7,18 @@ import { pluginModuleFederation } from '@module-federation/rsbuild-plugin';
 // reactive singleton instance — that's the load-bearing trick that makes
 // Window microfrontends + Chat panel all subscribe to one workspace state
 // (Per-App-Workspace-Conventions blueprint).
+//
+// strategyCurator and chat are the only two remotes the humain-vc deploy
+// (Build-Order Step 9) actually mounts — their URLs are env-configurable so
+// a production build can point at real hosted remoteEntry.js files instead
+// of localhost. The other twelve stay hardcoded: they belong to flows this
+// deploy doesn't use, Module Federation remotes are lazy-loaded, and
+// leaving them pointed at localhost is the same "no isolation, they error
+// if poked" rule the build order already established, just now true for
+// federation URLs too — nobody on this instance ever navigates to them.
+const STRATEGY_CURATOR_REMOTE = process.env.PUBLIC_STRATEGY_CURATOR_REMOTE ?? 'http://localhost:3017/remoteEntry.js';
+const CHAT_REMOTE = process.env.PUBLIC_CHAT_REMOTE ?? 'http://localhost:3006/remoteEntry.js';
+
 export default defineConfig({
   plugins: [
     pluginSvelte(),
@@ -17,15 +29,15 @@ export default defineConfig({
         promptTemplateManager: 'promptTemplateManager@http://localhost:3003/remoteEntry.js',
         requestReviewer: 'requestReviewer@http://localhost:3004/remoteEntry.js',
         responseReviewer: 'responseReviewer@http://localhost:3005/remoteEntry.js',
-        chat: 'chat@http://localhost:3006/remoteEntry.js',
+        chat: `chat@${CHAT_REMOTE}`,
         enhancedRecordsList: 'enhancedRecordsList@http://localhost:3007/remoteEntry.js',
         packRunner: 'packRunner@http://localhost:3009/remoteEntry.js',
         recordsSurface: 'recordsSurface@http://localhost:3011/remoteEntry.js',
         sortFilterLens: 'sortFilterLens@http://localhost:3013/remoteEntry.js',
         personEnrichment: 'personEnrichment@http://localhost:3015/remoteEntry.js',
         recordDbResolver: 'recordDbResolver@http://localhost:3008/remoteEntry.js',
         personDbResolver: 'personDbResolver@http://localhost:3010/remoteEntry.js',
-        strategyCurator: 'strategyCurator@http://localhost:3017/remoteEntry.js',
+        strategyCurator: `strategyCurator@${STRATEGY_CURATOR_REMOTE}`,
         affiliationRatingResolver: 'affiliationRatingResolver@http://localhost:3012/remoteEntry.js',
       },
       // No `shared` block — sharing Svelte 5's reactive runtime and a

shell/src/App.svelte

@@ -27,6 +27,19 @@
   import { layout, type LayoutMode } from './layout.svelte';
   import { activeFlow, FLOWS } from './flows.svelte';
 
+  // workspace-service's WS endpoint — every app that connects to it directly
+  // (this shell, plus the strategy-curator and chat remotes independently)
+  // reads the same PUBLIC_WS_URL, defaulting to localhost for dev. Rsbuild
+  // inlines PUBLIC_-prefixed env vars into import.meta.env at build time
+  // (same convention DidiBadge.svelte's PUBLIC_ID_BASE already uses).
+  // Deriving the plain-HTTP base from it (ws→http, wss→https) rather than a
+  // second env var — Step 7's /config check needs the same origin, not the
+  // WS scheme.
+  const WS_URL =
+    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+    'ws://localhost:3001/ws';
+  const WS_HTTP_BASE = WS_URL.replace(/^ws/, 'http').replace(/\/ws$/, '');
+
   // Chat rail visibility — persistent left-side companion to the focused
   // Window. Toggleable from the header; persisted to localStorage so a
   // user's preference survives reloads. Per the four-roles model in
@@ -267,14 +280,13 @@
   // second call is a no-op.
   onMount(() => {
     const TOKEN_KEY = 'augment_it_session_token';
-    const WS_HTTP_BASE = 'http://localhost:3001';
     // Fire BEFORE/alongside connect(), not after — an anonymous WS upgrade
     // against a DIDI_AUTH=required instance is rejected (4401) before any
     // session frame ships, so this plain GET is the only way an
     // unauthenticated visitor's shell learns the wall should render.
     void workspace.fetchDidiAuthMode(WS_HTTP_BASE);
     workspace.connect({
-      url: 'ws://localhost:3001/ws',
+      url: WS_URL,
       getToken: () => localStorage.getItem(TOKEN_KEY),
       saveToken: (t) => localStorage.setItem(TOKEN_KEY, t),
       onStatus: () => {