fix: make the TypeScript app build and run again

[devin-ai-integration]

Summary

The TS rewrite (e39e712) left the repo unbuildable and unrunnable: there was no root package.json/tsconfig, index.html loaded /src/ui/main.ts raw, and every workflow/Dockerfile still built the deleted Rust crates. On top of that, several code paths were broken. This makes npm install && npm run build && npm start work end to end.

Wouldn't compile / wouldn't run

• models.ts: as ModelsDev laCatalog — a syntax error in the middle of the file.
• instances.ts imported CreateInstanceRequest/UpdateInstanceRequest, which don't exist in src/core/types.ts (now added).
• No root build tooling: added package.json, tsconfig.json (strict, noUnusedLocals) and vite.config.ts (dev server on :8080 proxying /api + /ws to :3000).

AI proxy sent malformed requests

• generate() destructured apiKey/baseUrl/maxTokens, but GenerateRequest declares api_key/base_url/max_tokens, so every one was always undefined.
• The model id was double-prefixed: createAnthropic()("anthropic/claude-x") instead of ("claude-x").
• The UI's provider values (claude, ollama, openrouter) all threw Unknown provider; they now alias onto anthropic / openai-compatible with default base URLs.

Terminal was dead code
PtyService.createInstance never registered the session it spawned, so handleTerminalWs could never find one, and the server had no WebSocket endpoint at all. Now: creating a Terminal instance spawns the PTY, /ws/pty/:id upgrades to it, output is kept in the 64 KB ring buffer the README already advertised (replayed on reconnect), and closing a socket detaches instead of killing the shell. The dashboard's previously inert #terminal-input/#terminal-output are wired to it, with a visible fallback when no server is reachable.

UI

• Settings modal's Save discarded both fields; it now writes to state and persists to localStorage (state.loadSettings() on boot).
• Opening Settings dispatched app-state-changed, which nothing listened for — the modal never appeared.
• Chat interpolated model output and user text into innerHTML (XSS + broken on <); bubbles are now built with textContent. Added error handling, send-button locking, Enter-to-send, autoscroll.
• JSON.parse of tck.instances was unguarded, so one corrupt entry broke startup.
• Provider <select> hardcoded selected on Claude regardless of state; --acc-solid was used by ~8 rules but never defined; the theme button had no handler (now toggles a real light palette).
• Dashboard rendered a second .main inside .main.

Infra/docs

• ci.yml, pages.yml, Dockerfile, .dockerignore all referenced crates/tck-ui, cargo, and trunk; they now install Node 22, typecheck, and build with Vite. codeql.yml no longer analyzes rust.
• README quick start, config table (TCK_ADDR → PORT), module table, and PR checklist updated. The desktop-app/installer sections are Rust-era and are now explicitly marked as not buildable rather than silently wrong.

Out of scope: release.yml still builds Rust binaries (tag-triggered only), and the sidebar buttons / editor / scaffold panels remain static mockups.

Checklist

• npm run typecheck passes
• npm run build passes
• npm run typecheck in tck-ai passes (if that service changed)
• I matched the existing code style

Notes

Verified locally against npm start: /health ok, static UI served, POST /api/instances → ws://…/ws/pty/{id} runs echo hello-from-pty and returns its output, DELETE on an unknown id is 404, /api/ai/generate returns 400/500 with useful messages, /api/github/auth returns 503 when OAuth isn't configured.

Link to Devin session: https://app.devin.ai/sessions/f368764410624fa9bb948f4ceba6c048
Requested by: @Raghuramcoding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

E2E test results — runtime verification

Tested by building (npm run build) and running the server (npm start, http://localhost:3000 serving dist/), then exercising everything through the browser UI. No provider API keys configured.

✅ App shell, PTY terminal, XSS-safe chat, graceful AI error

• Landing at / renders; Launch T.C.K → #app renders titlebar + sidebar + editor + terminal + chat.
• Terminal reads "Terminal — connected"; echo hello-from-tck, pwd, ls, whoami all return real shell output over /ws/pty/:id (also after a page reload).
• Chat message <script>alert(1)</script> hello renders as literal text, no alert dialog, page stays interactive.
• With no keys, the assistant bubble shows the graceful error x-api-key header is required and Send re-enables (a second message works). The server log shows the real upstream authentication_error, confirming the proxy request shape is correct.
• No uncaught console errors during the entire session.

✅ Theme toggle (dark ⇄ light)

One click applies the light palette and flips the icon ☀→☾; a second click restores dark exactly. (Editor/terminal panes stay dark because those colours are hardcoded hexes in index.html — pre-existing.)

✅ Settings persist on Save, discard on Cancel/backdrop/X

Typed http://tck-test-host:11434 into Ollama host → Save → full page reload → value still present. localStorage['tck.settings'] = {"providers":[],"commands":[],"claude_api_key":"","ollama_host":"http://tck-test-host:11434","background":""}. Cancel, backdrop click and X all close without saving; clicking inside the modal does not close it.

⚠️→✅ Raw ANSI/OSC-633 escape codes in terminal output (fixed in f91c39e)

Commands and results were correct, but PTY bytes were appended verbatim, so bash colour codes and VS Code shell-integration sequences (]633;P;Cwd=…, [01;34m) showed as literal junk. f91c39e strips OSC/CSI/escape sequences before appending.

Not covered: a real AI completion (no provider keys available), dev-mode Vite :8080 path, GitHub OAuth routes.

Tested by Devin — session