Phase 5 client split: extract @openpalm/client SPA + ui-kit

.github/release-package-groups.json

@@ -6,6 +6,7 @@
       "packages/lib/package.json",
       "packages/cli/package.json",
       "packages/ui/package.json",
+      "packages/client/package.json",
       "packages/electron/package.json",
       "packages/electron/admin-tools/package.json"
     ],

.github/workflows/ci.yml

@@ -107,10 +107,23 @@ jobs:
       - name: Type check admin UI
         run: cd packages/ui && bun run check
 
+      - name: Type check UI kit
+        run: cd packages/ui-kit && bun run check
+
+      - name: Type check client app
+        run: cd packages/client && bun run check
+
       - name: Type check CLI
         run: cd packages/cli && bun run typecheck
 
-      - name: Test (sdk + guardian + portals)
+      # Client-bundle purity gate (plan §8.5/§8.10): packages/client/tests/
+      # purity.test.ts greps the BUILT bundle for '@openpalm/lib' and
+      # '/api/host' and deliberately FAILS when build/ is absent — so the
+      # client must be built before `bun run test` runs packages/client.
+      - name: Build client app (input to the client purity gate)
+        run: bun run client:build
+
+      - name: Test (sdk + guardian + portals + client purity gate)
         run: bun run test
 
       - name: Validate Docker Compose manifests

.github/workflows/release.yml

@@ -6,8 +6,8 @@ name: Release
 # its own slice. A partial unit will silently leave the other units behind (e.g.
 # `platform` does NOT touch the portal image or the discord/slack npm adapters).
 # For a complete, coordinated release of the whole platform, use `all`.
-#   platform  — @openpalm/lib + openpalm (CLI) + @openpalm/ui (npm) + admin-tools +
-#               CLI native binaries + optional Electron + git tag + GitHub release
+#   platform  — @openpalm/lib + openpalm (CLI) + @openpalm/ui + @openpalm/client (npm) +
+#               admin-tools + CLI native binaries + optional Electron + git tag + GitHub release
 #               (add include_images=true to also rebuild guardian + assistant images).
 #               PARTIAL: no portal image, no portal npm, no voice.
 #   portals   — @openpalm/discord-portal + @openpalm/slack-portal npm packages
@@ -26,7 +26,7 @@ name: Release
 #               Always pass version explicitly (the version the existing npm packages are at). PARTIAL.
 #   all       — COMPLETE coordinated release. Publishes EVERY unit at one version,
 #               flag-free (no include_images / include_electron needed):
-#                 npm: @openpalm/{lib,ui,guardian,skeleton} + openpalm (CLI)
+#                 npm: @openpalm/{lib,ui,client,guardian,skeleton} + openpalm (CLI)
 #                      + @openpalm/{discord,slack}-portal
 #                 images: openpalm/{assistant,guardian,portal}  (+ :latest when stable)
 #                 electron installers (mac/linux/win) + CLI native binaries
@@ -172,8 +172,8 @@ jobs:
             // platform release can never compute a next version at or below an
             // already-published skeleton/guardian, which npm rejects.
             const npmPackages = {
-              platform: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/skeleton', '@openpalm/guardian'],
-              all: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/skeleton', '@openpalm/guardian'],
+              platform: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/client', '@openpalm/skeleton', '@openpalm/guardian'],
+              all: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/client', '@openpalm/skeleton', '@openpalm/guardian'],
               guardian: ['@openpalm/guardian', '@openpalm/skeleton'],
             };
             const packages = npmPackages[unit] || [];
@@ -253,8 +253,13 @@ jobs:
         if: inputs.unit == 'platform' || inputs.unit == 'all'
         run: |
           bun install --frozen-lockfile
+          # The client purity gate greps the BUILT bundle (packages/client/tests/
+          # purity.test.ts fails when build/ is absent), so build before bun run test.
+          bun run client:build
           bun run test
           bun run ui:check
+          bun run ui-kit:check
+          bun run client:check
           bun run --cwd packages/ui test:browsers
           bun run ui:test:unit
           bun run electron:test
@@ -304,7 +309,8 @@ jobs:
               platform)
                 for f in package.json packages/lib/package.json packages/skeleton/package.json \
                           packages/guardian/package.json packages/cli/package.json \
-                          packages/ui/package.json packages/electron/package.json \
+                          packages/ui/package.json packages/client/package.json \
+                          packages/electron/package.json \
                           packages/electron/admin-tools/package.json; do
                   node scripts/set-version.mjs "$f" "$V"
                 done
@@ -314,7 +320,8 @@ jobs:
               all)
                 for f in package.json packages/lib/package.json packages/skeleton/package.json \
                           packages/guardian/package.json packages/cli/package.json \
-                          packages/ui/package.json packages/electron/package.json \
+                          packages/ui/package.json packages/client/package.json \
+                          packages/electron/package.json \
                           packages/electron/admin-tools/package.json; do
                   node scripts/set-version.mjs "$f" "$V"
                 done
@@ -382,7 +389,7 @@ jobs:
   # ── npm layer ─────────────────────────────────────────────────────────────────
   # skeleton + guardian: published for unit=guardian (thin-host needs both at runtime)
   #                      and unit=platform + unit=all (full coordinated release)
-  # lib + cli + ui:      platform + all only (guardian npm pkg has no lib dep)
+  # lib + cli + ui + client: platform + all only (guardian npm pkg has no lib dep)
   # NOTE: guardian and skeleton are published independently of lib to avoid
   # blocking the platform regression guard. lib is platform-managed.
   npm-skeleton:
@@ -463,6 +470,28 @@ jobs:
       exact-version: true
       dry-run: ${{ inputs.dry_run }}
 
+  # Client app (@openpalm/client): exact-pin delivered like @openpalm/ui — the
+  # assistant container installs @openpalm/client@<platform version> at startup
+  # (ui-runtime-modes-plan.md §1 exact-pin table, Phase 5 item 5). needs-build
+  # compiles the adapter-static bundle; @openpalm/ui-kit is inlined from the
+  # workspace at build time (raw-source, NEVER published). Unlike npm-ui there
+  # is no npm-lib ordering dependency: the client never bundles @openpalm/lib
+  # (§8.10 purity rule, enforced by packages/client/tests/purity.test.ts in CI).
+  npm-client:
+    name: npm @openpalm/client
+    needs: [compute-version, bump]
+    if: always() && needs.bump.result == 'success' && (inputs.unit == 'platform' || inputs.unit == 'all')
+    uses: ./.github/workflows/publish-npm-package.yml
+    secrets: inherit
+    with:
+      package-dir: packages/client
+      package-name: '@openpalm/client'
+      needs-build: true
+      version: ${{ needs.compute-version.outputs.new_version }}
+      ref: ${{ github.ref_name }}
+      exact-version: true
+      dry-run: ${{ inputs.dry_run }}
+
   # Portal adapters: the portal image bun-installs these from npm at runtime
   # (data/portal/tools/package.json + bun update), so a published patch reaches
   # running portals without an image rebuild. Published as `src` only (no build).
@@ -508,6 +537,11 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
+      - name: Stamp local guardian/skeleton sources for dry-run image build
+        if: ${{ inputs.dry_run }}
+        run: |
+          node scripts/set-version.mjs packages/guardian/package.json "${{ needs.compute-version.outputs.new_version }}"
+          node scripts/set-version.mjs packages/skeleton/package.json "${{ needs.compute-version.outputs.new_version }}"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - name: Login to Docker Hub
@@ -563,6 +597,11 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
+      - name: Stamp local guardian/skeleton sources for dry-run image build
+        if: ${{ inputs.dry_run }}
+        run: |
+          node scripts/set-version.mjs packages/guardian/package.json "${{ needs.compute-version.outputs.new_version }}"
+          node scripts/set-version.mjs packages/skeleton/package.json "${{ needs.compute-version.outputs.new_version }}"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - name: Login to Docker Hub
@@ -593,6 +632,8 @@ jobs:
           file: containers/guardian/Dockerfile
           build-args: |
             GUARDIAN_VERSION=${{ needs.compute-version.outputs.new_version }}
+            GUARDIAN_USE_LOCAL_SOURCE=${{ inputs.dry_run && 'true' || 'false' }}
+            SKELETON_USE_LOCAL_SOURCE=${{ inputs.dry_run && 'true' || 'false' }}
           platforms: ${{ inputs.dry_run && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
           push: ${{ !inputs.dry_run }}
           # Provenance/SBOM attestations add extra manifests + blobs that make
@@ -781,6 +822,7 @@ jobs:
       - npm-guardian
       - npm-cli
       - npm-ui
+      - npm-client
       - npm-discord-portal
       - npm-slack-portal
       - docker-portal

.gitignore

@@ -8,6 +8,7 @@ CLAUDE.md
 packages/ui/.svelte-kit/
 packages/ui/build/
 packages/ui/dist/
+packages/client/build/
 packages/ui/undefined/
 packages/ui/.env
 packages/ui/.env.local

CHANGELOG.md

@@ -9,6 +9,20 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- **New `@openpalm/client` npm package** — the unprivileged chat/connections
+  static app extracted from the admin UI (host/client split, #555). It joins the
+  platform release exactly like `@openpalm/ui`: published by `platform`/`all`
+  releases, always exact-pinned to the platform version. The assistant container
+  installs it at startup as a co-process next to OpenCode (#510), pinned via
+  **`OP_CLIENT_VERSION`** in `stack.env` (empty = the image's `PLATFORM_VERSION`;
+  never `latest` — the same contract as `OP_UI_VERSION` for the host UI), and
+  serves it on **`OP_CLIENT_PORT`** (default host bind `127.0.0.1:3810`, behind
+  the existing `OP_CLIENT_BIND_ADDRESS`/`OP_BIND_ADDRESS` loopback policy).
+  `docker restart` with a new `OP_CLIENT_VERSION` picks up the new client. CI now
+  enforces a client-bundle purity gate: the built artifact must contain no
+  `@openpalm/lib` and no host control-plane (`/api/host`) code. The shared
+  `@openpalm/ui-kit` workspace package is inlined at build time and is never
+  published.
 - The guardian thin-host entrypoint can now install and boot a configurable
   guardian composition package via `OP_GUARDIAN_PACKAGE` (default
   `@openpalm/guardian`) with an overridable boot entry `OP_GUARDIAN_ENTRY`