feat(cli): add setup and dev commands for cross-platform frontend…

[digger-yu]

… workflow

Summary

feat(cli): add setup and dev commands for cross-platform frontend…

Why

Add ``vibe-trading setup`` and ``vibe-trading dev`` to fix the
cross-platform frontend build / dev workflow.

The Windows npx tsc footgun (npm pulls the abandoned ``tsc@2.0.4``
package from the registry) is solved by always invoking tsc via
``npm exec --package=typescript tsc -b`` on Windows. POSIX uses the
standard ``npm run build`` since npm prepends ``./node_modules/.bin``
to PATH for local scripts.

``dev`` launches the backend from ``AGENT_DIR`` (so ``python -m
cli._legacy serve`` resolves the in-repo ``cli`` package) and the
Vite dev server with the port from ``vite.config.ts`` (5899, not the
5173 we used to hardcode). Both children receive SIGINT/SIGTERM and
are force-killed after a 5 s grace period.

On Windows, ``subprocess.Popen`` does not consult ``PATHEXT``, so the
npm path is taken from ``shutil.which`` (which returns the ``.cmd``
form) and used directly — without this, ``Popen(["npm", ...])``
raises ``FileNotFoundError`` even when ``which`` succeeds.

argparse subparsers are registered in ``_legacy.py``; typer
commands ``setup`` / ``dev`` are registered in ``main.py``'s
``_build_typer_app()``. ``init`` behavior is unchanged.

Tests: ``agent/tests/test_cli_setup_dev.py`` covers platform-aware
build commands, the node/npm-missing path, the dev 5899-vs-5173
regression, and the AGENT_DIR-cwd regression. The existing
``cmd_live_authorize`` flow (OAuth handshake) is untouched.

Files changed:

• agent/cli/_legacy.py: cmd_setup(), cmd_dev(), _which(), _run_step()
• agent/cli/main.py: typer wrapper commands
• agent/tests/test_cli_setup_dev.py

Changes

    modified:   agent/cli/_legacy.py
    modified:   agent/cli/main.py
    add         agent/tests/test_cli_setup_dev.py

Test Plan

• Existing tests pass (pytest --ignore=agent/tests/e2e_backtest --tb=short -q)
• New tests added (if applicable)
• Tested manually (describe below)

Checklist

• No changes to protected areas (src/agent/, src/session/, src/providers/) without prior discussion
• No hardcoded values (API keys, file paths, magic numbers)
• Code follows CONTRIBUTING.md guidelines
• Documentation updated (if user-facing change)

[warren618]

Thanks @digger-yu — the cross-platform setup/dev workflow is genuinely useful, and the Windows npx tsc footgun (npm pulling that abandoned 10-year-old tsc package instead of the local binary) is a real one worth fixing. Before this can land, though, the diff has a few issues:

1. 🔴 Blocker — the branch is reverting a critical fix. The diff deletes the Robinhood OAuth handling in cmd_live_authorize — _authorize_timeout_seconds(), the tool_timeout raise, and max_list_tools_attempts=1. Those landed in a530ced (#281) to fix #259, and the max_list_tools_attempts=1 part specifically prevents a transient retry from spawning a second OAuth callback server and orphaning the user's sign-in. Your branch is based before #281, so the diff against current main removes it. Please rebase onto latest main so the PR only adds the new commands and leaves cmd_live_authorize untouched.

2. 🔴 dev backend won't start. cmd_dev launches the backend with cwd=AGENT_DIR.parent (repo root) running python -m cli._legacy serve — but the cli package lives under agent/ (AGENT_DIR), so from the repo root that's a ModuleNotFoundError. Run it from AGENT_DIR (or invoke the installed vibe-trading serve entry point).

3. 🟡 dev prints the wrong frontend URL. It hardcodes http://localhost:5173, but frontend/vite.config.ts sets port: 5899, so the printed link won't open. Read the port from the vite config / env, or at least use 5899.

4. 🟡 No tests for cmd_setup / cmd_dev. A couple covering the Node/npm-missing paths and the platform-aware build-command selection would be good given this is a new user-facing entry point.

Fix 1–3 (1 is the must) and I'll re-review. Thanks for tackling the cross-platform gap! 🙏

[digger-yu]

@warren618 Re-requesting review on the current diff.

[warren618]

Thanks for the update and for re-requesting review.

We’ve seen the current diff and will re-review as soon as we can, especially around the rebase against the Robinhood OAuth fixes, the backend startup path, frontend port output, and tests for the new CLI commands.

[warren618]

Merged in b26667c. Thanks @digger-yu for the cross-platform setup / dev workflow and for reworking the branch after review.

This gives users a much cleaner path for local frontend/backend startup without the Windows npx tsc trap.