fix(deploy): preserve pnpm per-package node_modules in docker builds

The previous multi-stage `deps` → `builder` split copied only the root
/app/node_modules from the deps stage, but pnpm workspaces also create
per-package node_modules directories (e.g. apps/web/node_modules) that
contain the .bin symlinks for `next`, `tsup`, etc. Without those, the
builder stage failed with `sh: tsup: not found` and `sh: next: not found`.

Collapse `deps` and `builder` into a single stage so the per-package
node_modules survive intact. pnpm's content-addressable store keeps
re-installs nearly free on cache hits, and Docker layer caching still
short-circuits the install step when only source files change.

For collab and mcp runner stages, also copy the per-app node_modules
so runtime dependency resolution works.

Made-with: Cursor

docker/Dockerfile.collab

@@ -5,7 +5,10 @@ FROM node:${NODE_VERSION}-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 WORKDIR /app
 
-FROM base AS deps
+# --- Builder ---
+# Install deps + build in one stage so pnpm's per-package node_modules
+# (containing .bin symlinks like `tsup`) are intact.
+FROM base AS builder
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.json ./
 COPY apps/web/package.json ./apps/web/
 COPY apps/collab-server/package.json ./apps/collab-server/
@@ -15,18 +18,13 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/ai/package.json ./packages/ai/
 RUN pnpm install --frozen-lockfile
 
-FROM base AS builder
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=deps /app/package.json ./package.json
-COPY --from=deps /app/pnpm-lock.yaml ./pnpm-lock.yaml
-COPY --from=deps /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
-COPY turbo.json tsconfig.json ./
 COPY apps/collab-server ./apps/collab-server
 COPY packages/database ./packages/database
 
 ENV NODE_ENV=production
 RUN pnpm exec turbo build --filter=@tasks/collab-server
 
+# --- Production runner ---
 FROM node:${NODE_VERSION}-alpine AS runner
 RUN addgroup --system --gid 1001 nodejs \
   && adduser --system --uid 1001 collab --ingroup nodejs
@@ -40,6 +38,7 @@ COPY --from=builder --chown=collab:nodejs /app/node_modules ./node_modules
 COPY --from=builder --chown=collab:nodejs /app/packages/database ./packages/database
 COPY --from=builder --chown=collab:nodejs /app/apps/collab-server/dist ./apps/collab-server/dist
 COPY --from=builder --chown=collab:nodejs /app/apps/collab-server/package.json ./apps/collab-server/package.json
+COPY --from=builder --chown=collab:nodejs /app/apps/collab-server/node_modules ./apps/collab-server/node_modules
 
 USER collab
 

docker/Dockerfile.mcp

@@ -5,7 +5,10 @@ FROM node:${NODE_VERSION}-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 WORKDIR /app
 
-FROM base AS deps
+# --- Builder ---
+# Install deps + build in one stage so pnpm's per-package node_modules
+# (containing .bin symlinks like `tsup`) are intact.
+FROM base AS builder
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.json ./
 COPY apps/web/package.json ./apps/web/
 COPY apps/collab-server/package.json ./apps/collab-server/
@@ -15,12 +18,6 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/ai/package.json ./packages/ai/
 RUN pnpm install --frozen-lockfile
 
-FROM base AS builder
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=deps /app/package.json ./package.json
-COPY --from=deps /app/pnpm-lock.yaml ./pnpm-lock.yaml
-COPY --from=deps /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
-COPY turbo.json tsconfig.json ./
 COPY apps/mcp-server ./apps/mcp-server
 COPY packages/database ./packages/database
 COPY packages/shared ./packages/shared
@@ -28,6 +25,7 @@ COPY packages/shared ./packages/shared
 ENV NODE_ENV=production
 RUN pnpm exec turbo build --filter=@tasks/mcp-server
 
+# --- Production runner ---
 FROM node:${NODE_VERSION}-alpine AS runner
 ARG MCP_SERVER_PORT=3001
 ENV MCP_SERVER_PORT=${MCP_SERVER_PORT}
@@ -45,6 +43,7 @@ COPY --from=builder --chown=mcp:nodejs /app/packages/database ./packages/databas
 COPY --from=builder --chown=mcp:nodejs /app/packages/shared ./packages/shared
 COPY --from=builder --chown=mcp:nodejs /app/apps/mcp-server/dist ./apps/mcp-server/dist
 COPY --from=builder --chown=mcp:nodejs /app/apps/mcp-server/package.json ./apps/mcp-server/package.json
+COPY --from=builder --chown=mcp:nodejs /app/apps/mcp-server/node_modules ./apps/mcp-server/node_modules
 
 USER mcp
 

docker/Dockerfile.web

@@ -5,8 +5,11 @@ FROM node:${NODE_VERSION}-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 WORKDIR /app
 
-# --- Dependencies (workspace lockfile + package manifests) ---
+# --- Builder ---
-FROM base AS deps
+# Install deps + build in one stage so pnpm's per-package node_modules
+# (containing .bin symlinks like `next`, `tsup`) are intact.
+# pnpm's content-addressable store keeps re-installs fast on cache hits.
+FROM base AS builder
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.json ./
 COPY apps/web/package.json ./apps/web/
 COPY apps/collab-server/package.json ./apps/collab-server/
@@ -16,13 +19,6 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/ai/package.json ./packages/ai/
 RUN pnpm install --frozen-lockfile
 
-# --- Build ---
-FROM base AS builder
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=deps /app/package.json ./package.json
-COPY --from=deps /app/pnpm-lock.yaml ./pnpm-lock.yaml
-COPY --from=deps /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
-COPY turbo.json tsconfig.json ./
 COPY apps/web ./apps/web
 COPY packages/database ./packages/database
 COPY packages/shared ./packages/shared