Server: apps/server, the local Orbit host, published to npm as @orbit-code/server

[imshaikot]

Part of the Zed work (tracked in #9). Depends on #1.

Why

Zed extensions are WebAssembly and cannot host a web page, and Zed's registry requires an MCP server extension to download its server rather than bundle it. So Orbit needs a Node host that any editor without a webview can start: it serves the 3D page on localhost and speaks the protocol over a WebSocket. Published to npm, it is what the Zed extension (#4) installs and runs; JetBrains and Neovim hosts would start the same package. This is the "local server" the monorepo skill already sketches.

What

apps/server, package @orbit-code/server, tags type:app, runtime:node, publish:npm.

• Scaffold with node .claude/skills/monorepo/scripts/new-project.mjs app server --runtime node, then yarn install. Dependencies: core, agent, graph, protocol, common, @orbit-code/indexer/listFiles; @orbit-code/indexer and @orbit-code/webview as devDependencies for the builds it ships (as apps/vscode does).
• Composition (model: apps/vscode/src/extension.ts): GraphService (storage under --storage or $XDG_CACHE_HOME/orbit-code/<workspace id> using workspacePath.ts; dist/indexer.mjs beside the bundle; the workspace from --workspace or cwd; gitLsFiles/toListedFiles from listFiles), SessionService over ClaudeCliBackend, the core host controller from Core: move the controller's editor-agnostic half into @orbit-code/core #1, ChangeBatcher fed by fs.watch(root, { recursive: true }) (Node 20+), ConversationHistory.
• The editor interface: file operations over fs and git (git status / git show HEAD:./path, save against an mtime revision, rename and delete on disk followed by refresh() with the rename as the VS Code controller does), open external = open the URL in the default browser, notifications = log lines (the page is the UI).
• The page: index.html with the panel CSP (default-src 'none'; img-src data:; style-src 'nonce-…'; script-src 'nonce-…'; worker-src blob:) plus connect-src ws://127.0.0.1:<port>; a small bootstrap script (in apps/server, so the webview's constraint check does not apply) that opens the WebSocket, defines window.orbitHost (host.ts already falls back to it) and dispatches incoming messages as window message events. Served with webview.js on 127.0.0.1 only, a random port unless --port, with a per-start token in the URL so another local process can't attach.
• CLI orbit-server [--workspace <dir>] [--open] [--port N] [--storage <dir>] [--claude-path P] [--model M] [--effort E] [--permission-mode P] [--extra-arg A]…; values checked with isModelName, isEffort, isPermissionMode from agent/options.ts; bypassPermissions only from the flag, never from the page. Trust is implicit: the user started it.
• build.mjs (model: packages/indexer/build.mjs for the npm manifest, apps/vscode/build.mjs for copying indexer.mjs and webview.js): ESM bundle dist/server.mjs with bin: { "orbit-server": "server.mjs" }, files, engines.node >= 20, repository with directory, README and LICENSE into dist/. No workspace:* in the published manifest.
• project.json: build (with production), watch, typecheck, nx-release-publish (@nx/js:release-publish, packageRoot: {projectRoot}/dist). The publish:npm tag puts it in the existing npm release group: tag server-v<version>, release.yml's npm job publishes it as it does the indexer.
• Docs: CLAUDE.md Workspace table and Current limits ("VS Code is the only host"), README layout table, the monorepo skill map.

Checks

yarn typecheck && yarn boundaries && yarn build; node apps/server/dist/server.mjs --workspace . --open shows this repository and runs a turn; yarn nx run server:build -c production && yarn nx release publish --projects=server --dry-run prints the tarball; npx @arethetypeswrong/cli --pack apps/server/dist if types ship. Consider a server:e2e target that drives the page with the harness's Chrome setup later.