fix(desktop): stabilize frontend dependency upgrade

[hiqiancheng]

Summary

• Pin Vite back to 8.0.13 and esbuild to 0.28.1 to avoid the dev/runtime init_runtime_dom_esm_bundler crash seen after the frontend dependency bump.
• Surface ask_user_question in Settings as an empty-config built-in tool, with localized summaries.
• Add coverage that the ask-user built-in tool is visible in Settings and exposed to the model as builtin__ask_user_question when enabled.

Related issue or RFC

• Related to chore(deps): bump the frontend-dependencies group across 1 directory with 57 updates #466

AI assistance disclosure

• Tool(s) used: OpenAI Codex
• Scope of assistance: dependency-upgrade stabilization, runtime/tool exposure investigation, tests, PR preparation
• Human review or rewrite performed: manual smoke testing by maintainer; final PR remains Draft for maintainer review
• Architecture or boundary impact: no new architecture; touches dependency versions, Settings built-in tool visibility, and built-in tool exposure tests

Testing evidence

Commands run locally:

• pnpm.cmd --filter @touchai/desktop type:check
• pnpm.cmd --filter @touchai/desktop test:unit -- tests/SettingsView/built-in-tools-i18n.test.ts
• pnpm.cmd --filter @touchai/desktop test:unit -- tests/services/BuiltInToolService/service-i18n.test.ts
• pnpm.cmd --filter @touchai/desktop lint:check (passes with existing warnings)
• tauri dev smoke test with AskUserQuestion tool call

Not run locally:

• pnpm test:pr (draft PR uses targeted local checks plus CI evidence)
• pnpm test:e2e (Windows E2E smoke is running in CI)

TDD: yes for the Settings visibility regression; the test failed before the visibility fix and passed after.

pnpm.cmd --filter @touchai/desktop type:check
pnpm.cmd --filter @touchai/desktop test:unit -- tests/SettingsView/built-in-tools-i18n.test.ts
pnpm.cmd --filter @touchai/desktop test:unit -- tests/services/BuiltInToolService/service-i18n.test.ts
pnpm.cmd --filter @touchai/desktop lint:check

Risk notes

• AgentService, runtime, MCP, or schema impact: no runtime contract change; adds coverage confirming ask_user_question is exposed as builtin__ask_user_question when enabled.
• database baseline or migration impact: none.
• release or packaging impact: Vite is pinned back to 8.0.13 to avoid the observed dev/runtime crash from 8.0.16; review before marking ready.

Screenshots or recordings

No screenshot attached. Local tauri dev smoke verified AskUserQuestion tool invocation and completion.

Checklist

• The PR title follows Conventional Commits and is valid for squash merge.
• This PR is either ready for review or explicitly marked as a Draft PR.
• I did not use [WIP] or similar title prefixes.
• If AI materially assisted this PR, I disclosed the tools and scope and I personally reviewed every affected change.
• I can explain the why, what, and how of this change without relying on an AI tool.
• If this touches AgentService, runtime, MCP, or schema boundaries, there is an accepted RFC.
• If this changes architecture or adds a new cross-boundary abstraction, there is an accepted RFC.
• I ran pnpm test:pr for this code PR, or this is a docs-only change.
• If I changed Rust behavior or tests, I reviewed pnpm test:coverage:rust or relied on CI coverage evidence.
• If I changed desktop startup/window/search/popup/settings/E2E paths, I ran pnpm test:e2e locally or documented why CI is the first valid proof.
• I added tests or explained why tests are not appropriate.
• I updated docs when behavior changed.

[coderabbitai]

Warning

Review limit reached

@hiqiancheng, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 34 minutes and 19 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 804f4588-b35a-4cf1-a9d6-e4f022cf20d9

📥 Commits

Reviewing files that changed from the base of the PR and between fd8a7cc and 01b2aab.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• apps/desktop/package.json
• apps/desktop/src/i18n/messages.ts
• apps/desktop/src/views/SettingsView/components/BuiltInTools/types.ts
• apps/desktop/tests/SettingsView/built-in-tools-i18n.test.ts
• apps/desktop/tests/services/BuiltInToolService/service-i18n.test.ts
• apps/site/package.json
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch review/pr-466-frontend-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}