feat(chat-ui): @fuzefront/chat-ui design-system chat frontend + shell integration

.github/workflows/ci.yml

@@ -45,6 +45,15 @@ jobs:
       - name: Build @fuzefront/identity-ui (d.ts for frontend type-check)
         run: npm run -w @fuzefront/identity-ui build
 
+      # @fuzefront/chat-ui is consumed by the host frontend (FuzeChatWidget) and
+      # has NO vite source alias, so both the frontend type-check (tsconfig →
+      # chat-ui/dist/index.d.ts) and `vite build` resolve it from dist. Build its
+      # dependency @fuzefront/chat-client first, then chat-ui.
+      - name: Build @fuzefront/chat-client + chat-ui (for frontend type-check)
+        run: |
+          npm run -w @fuzefront/chat-client build
+          npm run -w @fuzefront/chat-ui build
+
       # @fuzefront/i18n is consumed by the host (main.tsx, contexts, components).
       # frontend/tsconfig.json resolves it to dist/index.d.ts (like identity-ui),
       # so build it before the frontend type-check. vite/vitest still alias it to
@@ -151,6 +160,13 @@ jobs:
       - name: Build backend
         run: cd backend && npm run build
 
+      # chat-ui is bundled into the host frontend from its dist (no vite source
+      # alias), and depends on chat-client — build both before `vite build`.
+      - name: Build @fuzefront/chat-client + chat-ui (for frontend bundle)
+        run: |
+          npm run -w @fuzefront/chat-client build
+          npm run -w @fuzefront/chat-ui build
+
       - name: Build frontend
         run: cd frontend && npm run build
 

.gitignore

@@ -29,6 +29,9 @@ frontend/tests/_screens.spec.ts
 # Local dev CA public cert (per-machine; regenerate via deploy/local-tls/)
 deploy/local-tls/*.crt
 
+# Isolated per-worktree npm caches (parallel-agent gotcha)
+.npm-cache-*/
+
 # Build output for the @fuzefront/* npm packages (regenerated by `npm run build`)
 packages/*/dist/
 
@@ -39,6 +42,5 @@ packages/*/.npmrc
 # Stray npm pack tarballs
 *.tgz
 
-# Per-package lockfiles (generated locally; CI installs fresh). Avoids leaking
-# the Windows native-binary pins from a local install into Linux CI.
-packages/*/package-lock.json
+# Per-package lockfiles (generated locally; CI installs fresh).
+packages/*/package-lock.json

deploy/helm/fuzefront/values.yaml

@@ -286,6 +286,43 @@ chatService:
     # Directory inside the chat-service image that holds the docs to index.
     docsDir: "/app/services/chat-service/docs"
 
+chatService:
+  enabled: false
+  replicas: 1
+  # Port 3006: 3001=backend, 3002=security, 3003=apps/email, 3004=sms, 3005=provisioning
+  port: 3006
+  image:
+    repository: fuzefront/chat-service
+    tag: local
+  # LiteLLM gateway in fuzeinfra namespace (its own Argo App).
+  litellmUrl: "http://litellm.fuzeinfra.svc.cluster.local:4000"
+  # ChromaDB vector store in fuzeinfra namespace (enabled via fuzeinfra Argo values).
+  chromaUrl: "http://chromadb.fuzeinfra.svc.cluster.local:8000"
+  # FuzeFront backend for user/org lookups.
+  backendUrl: "http://fuzefront-backend:3001"
+  # Permit PDP for authorization checks. When permit.enabled=true the in-cluster PDP runs
+  # at fuzefront-permit-pdp:7000; otherwise falls back to the offline stub port.
+  permitPdpUrl: "http://fuzefront-permit-pdp:7000"
+  kafka:
+    brokers: "kafka.fuzeinfra.svc.cluster.local:9092"
+  # Embedding model resolved at the LiteLLM gateway (used by the doc indexer).
+  embeddingModel: "text-embedding-3-small"
+  # Resource requests/limits. Local/dev single replica; prod overrides upward.
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+  # chat-doc-indexer Job: indexes docs/ into ChromaDB as a post-install/upgrade
+  # hook. Idempotent (content-hash keyed). Disabled by default — flip on once
+  # LiteLLM + ChromaDB are reachable in fuzeinfra.
+  docIndexer:
+    enabled: false
+    # Directory inside the chat-service image that holds the docs to index.
+    docsDir: "/app/services/chat-service/docs"
+
 # Plan D — thin Kafka→HTTP bridge: consumes identity.user.created, calls
 # security-service POST /internal/provision. No DB, no domain logic.
 # SECURITY_SERVICE_URL is derived in the Helm template from securityService.port

frontend/nginx.conf

@@ -114,6 +114,24 @@ http {
             proxy_read_timeout 86400;
         }
 
+        # Chat-service: AI chat + RAG. SSE streaming, so buffering MUST be off and
+        # the read timeout long. baseUrl on the client is `${origin}/chat-api`, so
+        # /chat-api/chat/stream maps to the service's /chat/stream.
+        location /chat-api/ {
+            proxy_pass http://fuzefront-chat-service:3006/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            # SSE: disable proxy + nginx buffering so text_delta events flush live.
+            proxy_buffering off;
+            proxy_cache off;
+            proxy_set_header Connection '';
+            chunked_transfer_encoding off;
+            proxy_read_timeout 86400;
+        }
+
         # WebSocket proxy -> applications-service (owns Socket.IO).
         location /socket.io/ {
             proxy_pass http://fuzefront-applications:3003;

frontend/package.json

@@ -22,6 +22,8 @@
     "test:e2e:report": "playwright show-report"
   },
   "dependencies": {
+    "@fuzefront/chat-client": "file:../packages/chat-client",
+    "@fuzefront/chat-ui": "file:../packages/chat-ui",
     "@originjs/vite-plugin-federation": "^1.4.1",
     "axios": "^1.9.0",
     "class-variance-authority": "^0.7.1",

frontend/src/App.tsx

@@ -2,7 +2,6 @@ import React, { useEffect, useRef, useState } from 'react'
 import { Routes, Route, Navigate } from 'react-router-dom'
 import { useCurrentUser, useAppContext, MenuItem } from './lib/shared'
 import { installBridge, bridge } from './platform/bridge'
-import { ChatProvider } from './contexts/ChatContext'
 import Layout from './components/Layout'
 import LoginPage from './pages/LoginPage'
 import DashboardPage from './pages/DashboardPage'
@@ -16,7 +15,7 @@ import { getCurrentUser } from './services/api'
 import websocketService from './services/websocket'
 import { UserProfileManagement } from './components/UserProfileManagement'
 import { WorkspaceProvisioningGate } from './components/WorkspaceProvisioningGate'
-import CreateOrganizationPage from './pages/CreateOrganizationPage'
+import CreateOrganizationPage from './pages/CreateOrganizationPage'
 import AcceptInvitePage from './pages/AcceptInvitePage'
 
 // Authentication wrapper component
@@ -174,13 +173,13 @@ function App() {
   )
 }
 
-function AppContent() {
-  const { isAuthenticated, user } = useCurrentUser()
-  const currentPath = typeof window !== 'undefined' ? window.location.pathname : ''
-
-  // Public route: invitation accept page — handle before auth check
-  if (currentPath.startsWith('/invitations/')) {
-    return <AcceptInvitePage />
+function AppContent() {
+  const { isAuthenticated, user } = useCurrentUser()
+  const currentPath = typeof window !== 'undefined' ? window.location.pathname : ''
+
+  // Public route: invitation accept page — handle before auth check
+  if (currentPath.startsWith('/invitations/')) {
+    return <AcceptInvitePage />
   }
 
   console.log('AppContent - Authentication state:', {
@@ -196,7 +195,6 @@ function AppContent() {
   console.log('User authenticated, showing main app')
   return (
     <WorkspaceProvisioningGate>
-    <ChatProvider>
       <Layout>
         <Routes>
           <Route path="/" element={<Navigate to="/dashboard" replace />} />
@@ -212,7 +210,6 @@ function AppContent() {
           <Route path="*" element={<NotFoundPage />} />
         </Routes>
       </Layout>
-    </ChatProvider>
     </WorkspaceProvisioningGate>
   )
 }