chore(lint): enforce web ↔ server import boundary (ban-web-server-imports)

[vibegui]

Summary

Adds an oxlint plugin, ban-web-server-imports, that enforces the web ↔ server boundary inside apps/mesh — the cheap, enforceable version of "separate the frontend and API" (see the analysis in #4468, WI-12).

Why not a full package split? The frontend and API are already separate at build (build:client→dist/client vs build:server), image (nginx -web container vs Bun -api container, independent tags — deploy/helm/studio/templates/deployment.yaml), and runtime (SPA calling the API over HTTP via @decocms/mesh-sdk, 207 files). The only shared thing is the source tree, and the coupling there is almost entirely import type (erased at build — end-to-end type safety is a feature we want to keep). A full apps/web split would break ~240 type imports for little runtime gain. The real risk is the handful of value imports that reach into server-only trees.

What the rule does. Files under apps/mesh/src/web/ may not make a value import (or re-export, or dynamic import) from a @/<server-tree>/… specifier (storage, core, api, tools, auth, ai-providers, services, mcp-clients, event-bus, harnesses, sandbox, …). It allows: import type / import { type X } (erased), frontend-safe trees (@/mcp-apps, @/web, @/lib, @/shared), and workspace packages (@decocms/mesh-sdk). This makes the bundle/secret boundary real and gives frontend-vibecoding agents a hard fence.

Landed as warn (not error) because there are 21 pre-existing violations across 20 files — all genuine leaks where a Zod schema / constant / pure helper lives on the server side and gets value-imported by the UI:

Server tree	Violations	Example
@/tools/*/schema, registry/shared, registry-metadata	10	connection-sidebar.tsx → @/tools/connection/schema
@/ai-providers (model lists, tiers)	3	agent-models.tsx → CLAUDE_CODE_MODELS
@/core (constants, org-archived)	3	utils/constants.ts → @/core/constants
@/api/routes/decopilot/mesh-storage-uri	3	parseMeshStorageKey
@/file-storage, @/commerce-discovery	2	pure helpers

The fix for each is to move the shared value into @/web / @/lib / @/shared / @decocms/mesh-sdk, or import it type-only. Once the list is drained, flip the rule to error. (Confirmed the rule correctly ignores the 18 legit @/mcp-apps value imports — that tree is frontend code.)

Testing

• bun test plugins/ban-web-server-imports.test.ts → 9 pass (bans value import / tools-schema / dynamic import / value re-export; allows import type, inline type specifiers, frontend-safe trees, relative + workspace imports, non-web files).
• bun run fmt clean.

Companion

Sibling to plugins/ban-cross-tree-imports.js (packages ↛ apps/mesh) and plugins/ban-e2e-app-imports.js (e2e black-box wall). Part of the audit in #4468.

🤖 Generated with Claude Code

---

Summary by cubic

Adds an oxlint plugin ban-web-server-imports to enforce the web ↔ server import boundary in apps/mesh, blocking value imports from server-only trees into the web bundle. Lands as warn to surface 21 violations while we move shared values; supports WI-12.

• New Features

  • Enforces an allowlist of frontend-safe trees (@/web, @/mcp-apps, @/lib, @/shared); bans value imports, re-exports, and dynamic imports from other apps/mesh/src/<tree> paths.
  • Resolves both @/ and relative ../ climbs; skips web test files; allows import type and workspace packages like @decocms/mesh-sdk.
  • Loads the plugin in .oxlintrc.json; adds 12 tests.

• Migration

  • For violations, move shared constants/schemas/helpers to @/web, @/lib, @/shared, or @decocms/mesh-sdk, or switch to import type.
  • Flip the rule to error after cleanup.

^{Written for commit 2096040. Summary will update on new commits.}