feat(server): migrate control plane to Nitro v3 with ViteHub

[RedStar071]

Replaces the control plane's plain node:http listener (merged in #25) with a Nitro v3 host composed as a Vite app with ViteHub, following the Nitro v3 quick start. The oRPC surface, access policy, and dashboard aggregate are unchanged; only the transport host moved.

apps/server/src/http.ts is gone. Nitro's filesystem routing now serves both surfaces from apps/server/server/: routes/rpc/[...].ts mounts the oRPC fetch adapter (switched from @orpc/server/node to @orpc/server/fetch) and keeps the fail-closed auth wiring from src/auth.ts, and api/dashboard.get.ts serves the aggregate view. The host is registered in vite.config.ts with ViteHub before Nitro:

exportdefaultdefineConfig({plugins: [vitehub({preset: 'node',// Local single-node default. Cloudflare KV, Deno KV, or Upstash drop in as drivers.kv: {driver: 'fs-lite',base: '.data/agent-zero'},}),nitro(),],// 3000 belongs to the Nuxt dashboard; keep the validated PORT contract for dev.server: {port: portFromEnvironment()},});

Persistence now goes through the ViteHub KV Runtime Helper: server/utils/store.ts adapts vite-hub/kv to the existing KeyValueStorage contract, so PersistentTaskStore, redaction, and the scheduler are untouched and KV drivers swap in via config alone. FileKeyValueStorage remains exported for embedded callers and its tests.

Also adds the ViteHub Agent Skill via npx skills add https://vitehub.dev, relocated to .skills/vitehub with the repo's .agents/skills symlink convention (check:repo passes), and updates the orpc-server skill, README, and docs/architecture.md for the new layout. tsdown and tsx are dropped from apps/server (vite build emits .output/, started with node .output/server/index.mjs); the lockfile was regenerated with the pinned aube 1.38.0.

Safety-wise the transport still only validates, authenticates, delegates, and serialises: no runner, no checkout, and 500s keep redacting error messages through redactSecrets. Sandbox disk limits prevented a local aube install, so typecheck/test/build validation rides on CI; check:repo and oxfmt --check pass locally.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Confidence Score: 5/5

No blocking failure remains.

The production build and runtime startup path were exercised successfully, including a read-only dashboard request. There are no accepted P0 or P1 findings.

_{Reviews (2): Last reviewed commit: "fix(server): register KV through the vit..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-hub@​0.0.3
	@​types/​debug@​4.1.13
	nitro@​3.0.260610-beta
	@​vercel/​queue@​0.4.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @microsoft/microsoft-graph-client is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/vite-hub@0.0.3 → npm/@microsoft/microsoft-graph-client@3.0.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@microsoft/microsoft-graph-client@3.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm drizzle-orm is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/vite-hub@0.0.3 → npm/drizzle-orm@0.45.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/drizzle-orm@0.45.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm hash-wasm is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/vite-hub@0.0.3 → npm/hash-wasm@4.12.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hash-wasm@4.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rimraf is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/vite-hub@0.0.3 → npm/rimraf@5.0.10 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report