feat: add browser-native playground

[anish-sahoo]

Adds SPA cog playground with node:test tests

[ask-bonk]

LGTM

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests. The Go server code is well-structured with proper security headers, CORS bypass via proxying, and loopback-only protection for UI routes. Tests cover proxy behavior, SSE framing, webhook concurrency limits, and asset integrity.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it neither depends on playground:install nor specifies tools. This breaks mise run test for developers without Node already in their PATH.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests. The Go server code is well-structured with proper security headers, CORS bypass via proxying, and loopback-only protection for UI routes. Tests cover proxy behavior, SSE framing, webhook concurrency limits, and asset integrity.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it neither depends on playground:install nor specifies tools. This breaks mise run test for developers without Node already in their PATH.

I've posted a review with a suggestion on mise.toml:322.

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests. The Go server code is well-structured with proper security headers, CORS bypass via proxying, and loopback-only protection for UI routes. Tests cover proxy behavior, SSE framing, webhook concurrency limits, and asset integrity.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The task runs node but has no depends or tools declaration, breaking mise run test for developers without Node in PATH.

Posted a suggestion on mise.toml:322.

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

Posted a suggestion on mise.toml:325.

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

I've posted a review with a suggestion on mise.toml:325.

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

I've posted a review with a suggestion on mise.toml:324.

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

One issue found:

1. test:playground task doesn't ensure Node.js is installed — The test:playground mise task runs node --test '*.test.js' but doesn't declare node as a tool dependency. Unlike fmt:playground, lint:playground, and typecheck:playground, it has no depends or tools declaration. This breaks mise run test for developers without Node already in their PATH. The CI job works around this with actions/setup-node, but local development is affected.

Posted a suggestion on mise.toml:324.

github run

[ask-bonk]

@anish-sahoo Bonk workflow was cancelled.

View workflow run · To retry, trigger Bonk again.

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM

github run

[Copilot]

Pull request overview

Adds a new cog playground command to the Go CLI that serves an embedded, browser-native SPA and a local Go proxy/webhook relay so users can interact with any running Cog HTTP API (sync/stream/async) without requiring a production frontend build.

Changes:

• Introduces cog playground (Go) with an embedded static UI, loopback-protected reverse proxy, and webhook→SSE relay.
• Adds the browser-side playground implementation (state/input/transport/components) plus a validation worker and shared TypeScript typings.
• Adds dependency-light Node tests for the playground core plus a path-gated CI job and release-time asset-graph verification.

Reviewed changes

Copilot reviewed 51 out of 56 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Markdown formatting adjustments in install sections.
docs/llms.txt	Regenerated docs including cog playground reference + formatting updates.
docs/cli.md	Adds CLI docs section for cog playground.
architecture/06-cli.md	Documents cog playground in CLI architecture overview.
.markdownlint-cli2.yaml	Adds ignore entry for playground/**.
.gitignore	Ignores Node artifacts for playground tests.
mise.toml	Adds test:playground task and includes playground assets in build:cog inputs.
.github/workflows/ci.yaml	Adds path-gated test-playground job and wiring into CI completion gate.
.github/workflows/release-build.yaml	Scopes permissions more tightly and adds a playground asset-graph verification step.
pkg/cli/root.go	Registers the new playground command.
pkg/cli/playground.go	Implements local server, loopback protection, reverse proxy, and webhook/SSE hub for the playground.
pkg/cli/playground_assets.go	Embeds pkg/cli/playground/ assets into the Go binary.
pkg/cli/playground_assets_test.go	Adds an asset reference integrity test for embedded JS/CSS.
pkg/cli/playground/index.html	Adds SPA entrypoint HTML.
pkg/cli/playground/theme-bootstrap.js	Boots theme mode (light/dark) early.
pkg/cli/playground/app.js	Implements the main app controller (connection/input/prediction orchestration).
pkg/cli/playground/app.css	Imports shared styles and adds base UI styling.
pkg/cli/playground/components/dom.js	DOM helpers (element creation, tabs, status badges, focus preservation).
pkg/cli/playground/components/json-editor.js	CodeMirror-backed JSON editor wrapper with accessibility hooks.
pkg/cli/playground/components/input-view.js	Renders schema-driven inputs including files/URLs and validation display.
pkg/cli/playground/lib/format.js	Value/duration/log formatting helpers for the UI.
pkg/cli/playground/lib/json.js	JSON type guards + parse/serialize helpers for input editing.
pkg/cli/playground/lib/input/input.js	Input helpers (empty values, data URI detection, previews, byte formatting).
pkg/cli/playground/lib/input/files.js	Browser file → data URI conversion + file read invalidation guard.
pkg/cli/playground/lib/input/openapi.js	OpenAPI schema utilities (refs, defaults, ordering, capabilities).
pkg/cli/playground/lib/input/validation.js	AJV-based schema normalization + input validation, including URI validation.
pkg/cli/playground/lib/input/validation-client.js	Validation worker client with timeouts and disposal behavior.
pkg/cli/playground/lib/state/store.js	Minimal observable store base for UI state.
pkg/cli/playground/lib/state/connection-state.js	Manages config loading, schema fetch retry, and health polling.
pkg/cli/playground/lib/state/input-state.js	Manages form/JSON input state, field busy/validity, and worker validation.
pkg/cli/playground/lib/state/runtime.js	Runtime limits + metric/log/output bounding + error message shaping.
pkg/cli/playground/lib/state/trace.js	Request trace capture/bounding and trace budget enforcement.
pkg/cli/playground/lib/state/prediction-state.js	Runs sync/stream/async predictions, consumes SSE/webhooks, traces requests, supports stop/reset.
pkg/cli/playground/lib/transport/guards.js	Runtime validators for config/health/OpenAPI/prediction envelope shapes.
pkg/cli/playground/lib/transport/http.js	HTTP helpers for bounded JSON/text parsing and structured error shaping.
pkg/cli/playground/lib/transport/sse.js	SSE parsing/streaming reader with frame size caps and cancellation handling.
pkg/cli/playground/lib/transport/api.js	Browser API client for config/schema/health/prediction submit/stream/cancel via proxy.
pkg/cli/playground/worker/validation.js	Web Worker entrypoint for schema compilation + input validation.
pkg/cli/playground/types.d.ts	Shared type definitions for UI/state/transport payloads.
pkg/cli/playground/cdn/ajv.js	CDN-backed AJV loader shim for the browser.
pkg/cli/playground/cdn/ajv.d.ts	AJV type definitions used by the browser code.
pkg/cli/playground/cdn/codemirror.js	CDN-backed CodeMirror loader shim for the browser.
pkg/cli/playground/cdn/codemirror.d.ts	CodeMirror type definitions used by the browser code.
playground-tests/api.test.js	Node tests for transport/http/api behavior.
playground-tests/connection.test.js	Node tests for connection/config/schema/health state behavior.
playground-tests/files.test.js	Node tests for file/data-uri handling and helpers.
playground-tests/input-state.test.js	Node tests for input state, JSON editing, worker validation flows.
playground-tests/openapi.test.js	Node tests for OpenAPI utilities and defaults/capabilities.
playground-tests/prediction.test.js	Node tests for prediction state mode/output and webhook race handling.
playground-tests/sse.test.js	Node tests for SSE parsing/streaming edge cases.
playground-tests/streaming-integration.test.js	End-to-end-ish Node test for streaming state consumption and abort/cancel behavior.
playground-tests/trace.test.js	Node tests for trace bounding and metrics bounding logic.
playground-tests/validation.test.js	Node tests for schema normalization, URI validation, and AJV issue shaping.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ask-bonk]

LGTM

github run

[Copilot]

Pull request overview

Copilot reviewed 51 out of 56 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/cli/playground/lib/state/runtime.js:62

• If an appended metric value is rejected for exceeding MAX_METRIC_ITEMS_TEXT, this returns metrics ?? current, which produces {} when metrics was undefined. Returning metrics avoids introducing an empty metrics object when the update is ignored.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

Two issues found:

1. path.Join discards prefix when reference starts with / — In playground_assets_test.go, path.Join("playground", "/app.js") returns /app.js because path.Join treats the second argument as absolute when it starts with /. The test then looks for /app.js instead of playground/app.js in the embedded filesystem.

2. applyMetric mutates undefined state to {} on rejection — In runtime.js, when metrics is undefined and a metric update is rejected (non-finite values or oversized), return metrics ?? current evaluates to {} (since current = metrics ?? {}). This incorrectly changes state from undefined to an empty object instead of preserving the original value.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds a new cog playground command with an embedded browser-native SPA, reverse proxy, webhook relay, and comprehensive tests.

Two issues found:

1. path.Join discards prefix when reference starts with / — In playground_assets_test.go:35, path.Join("playground", "/app.js") returns /app.js because path.Join treats the second argument as absolute when it starts with /. The test then looks for /app.js instead of playground/app.js in the embedded filesystem.

2. applyMetric mutates undefined state to {} on rejection — In runtime.js:58,61, when metrics is undefined and a metric update is rejected (non-finite values or oversized), return metrics ?? current evaluates to {} (since current = metrics ?? {}). This incorrectly changes state from undefined to an empty object instead of preserving the original value.

I've posted a review with suggestions on both files.

github run

[Copilot]

Pull request overview

Copilot reviewed 51 out of 56 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

pkg/cli/playground_assets_test.go:36

• In this test, absolute references (starting with "/") are resolved with path.Join("playground", reference). In Go, path.Join treats an absolute second argument as overriding the prefix, so this will produce an absolute path like "/app.js" and make fs.Stat fail to find embedded assets. Trim the leading slash before joining so absolute UI paths map to the embedded "playground/" subtree.