Rebuild the app when a shared module it bundles changes

[kevin9327]

What this changes

#584 made bun run serve reuse app/dist when a hash of the build's inputs matches the one stored beside it. The inputs are app/src, bun.lock, both package.json files, app/vite.config.ts, app/index.html and the tenant package. shared/ is not among them, but the app bundles three modules from it:

• app/src/lib/channels/attachments.ts re-exports shared/attachments.ts (attachment count, size limits, accepted types)
• app/src/lib/channels/routine-firing.ts re-exports shared/routine-firing.ts
• app/src/lib/copilot/markers.ts re-exports shared/handoff-markers.ts

Those files exist so the browser and the server read one declaration. After an update that changes only a file in shared/, bun run serve prints Reusing app/dist from build cache and serves the old bundle, while the server runs the new code. The composer then applies the old attachment limits and the transcript matches the old handoff markers. Nothing says the build is stale.

The fix hashes shared/ with the same extension filter as app/src. Nothing else about the key changes.

No CHANGELOG line: the build cache came in with #584 after v0.0.12 and has no entry of its own, so no released deployment behaves differently.

Where it runs

• New state that outlives a request? None. This is a local build step.
• What happens on the second replica? Nothing changes. The container image builds the app itself and does not use serve-or-build.ts.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act. Not touched.
• New refusals and new failures each write a row. None added.
• Nothing new is trusted from the client that the server can resolve itself. Not touched.

Changelog

• No line, because no released deployment behaves differently (see above).

Proof

A new row in the existing rejects a build when %s changes table changes shared/attachments.ts after the manifest is written.

With build-cache.ts from main:

Expected: false
Received: true
(fail) production build cache > rejects a build when a shared module the app imports changes
 12 pass
 1 fail

With the fix, bun test --coverage tests/build-cache.test.ts: 13 pass, 0 fail. The added lines are covered. The only uncovered lines in build-cache.ts are 61 and 77–78, which this change does not touch.

I also ran it against the real repo, in app/:

1. bun scripts/serve-or-build.ts on main built app/dist.
2. I changed HANDED_OVER in shared/handoff-markers.ts to a probe string and ran it again. It printed Reusing app/dist from build cache, and no file in dist contained the probe.
3. With the fix it printed Building app/dist because the build cache is stale or missing, and the probe was in the bundle.
4. I reverted the marker. The next run rebuilt, and the probe was gone. The run after that printed Reusing app/dist from build cache.

Checks:

• bun run typecheck (app, server, worker): exit 0.
• bunx biome format and bunx biome lint --error-on-warnings on both files: clean.
• The whole app suite on this Windows machine: 871 pass, 44 fail with the fix, and 870 pass, 44 fail on main. The 44 failures are the same tests on both runs (serve ports and WebSockets, path handling, locale). None are in build-cache.test.ts.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[davidmckayv]

Code-verified clean; CI green on this sha.