#12154 web: portable entry-point guard for check-devbox-image-reachable (typecheck fix)

Closes https://github.com/manaflow-ai/cmux/issues/12147

Problem

web/scripts/check-devbox-image-reachable.ts (added by #12132) ends with if (import.meta.main) await main();. import.meta.main is Bun-only and not part of TypeScript's ImportMeta type, so bun run typecheck (tsgo --noEmit) fails on main:

scripts/check-devbox-image-reachable.ts(148,17): error TS2339: Property 'main' does not exist on type 'ImportMeta'.

ci.yml is path-gated for pull requests, so main's own PR checks never ran this job; every PR that touches ci.yml (which forces all CI areas) now fails web-typecheck, linux-preflight, tests, and ci-status (#12140, #12141, and the #12100 dispatch).

Fix

Replace the guard with the portable entry-point check the sibling devbox scripts already use (fileURLToPath(import.meta.url) compared with path.resolve(process.argv[1])). No Bun ambient types are added to the web typecheck config.

Verification

Run in a sparse clone of current main with this patch, using an installed web/node_modules:

$ ./node_modules/.bin/tsgo --noEmit          # clean (was: TS2339 at scripts/check-devbox-image-reachable.ts:148)
$ bun test tests/vm-image-reachability.test.ts
 4 pass / 0 fail                             # importing reachabilityKey does not run main()
$ bun scripts/check-devbox-image-reachable.ts --print-key
dd571d4dbdd25c0fa011260e3304b3441ef8e1a4957b1547476ee68973f8d7a1   # entry-point path still runs main()

A manual ci.yml dispatch on this branch runs the web-typecheck job as CI evidence.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qiy38q5XFYQU3CeccDENty

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Low Risk
Typecheck-only guard change with no logic or security impact; entry-point behavior is preserved.

Overview
Fixes web typecheck by replacing Bun-only import.meta.main at the bottom of check-devbox-image-reachable.ts with a portable entry-point guard that compares path.resolve(process.argv[1]) to fileURLToPath(import.meta.url), matching the approach used by other devbox scripts.

Adds node:path and node:url imports only to support that guard. Runtime behavior is unchanged: direct script execution still runs main(), while importing the module (e.g. reachabilityKey in tests) does not.

^{Reviewed by Cursor Bugbot for commit de39d891e0ea5dcc95f4dbf2fa955b5ba150ee6c. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes the web typecheck failure by replacing the Bun-only import.meta.main guard in web/scripts/check-devbox-image-reachable.ts with the portable entry-point check the sibling devbox scripts already use.

import.meta.main is not part of TypeScript's ImportMeta type, so bun run typecheck errored with TS2339. The new check compares fileURLToPath(import.meta.url) with path.resolve(process.argv[1]); running the script directly still calls main(), and importing reachabilityKey from tests still does not. Closes #12147.