1. Add Go playground server and handlers

[anish-sahoo]

• go playground server, request proxy, webhook/event relay, and unit tests
• command registration and the final app are split into later prs
• cog-playground stack: 1. Add Go playground server and handlers #3109, 2. Add playground frontend scaffold and early CI #3108, 3. Add core playground types and utilities #3114, 4. Add shared playground UI and JSON editor #3110/5. Add Cog playground API client #3106, 6. Add playground connection feature #3105/7. Add playground input controls and validation #3111/8. Add playground prediction controls and output #3107, 9. Wire up Cog playground and documentation #3113, 10. Compose playground app and add browser e2e #3112

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds the internal playground command, static server, reverse proxy, webhook relay, and lifecycle handling with comprehensive tests. Overall the code is well-structured and secure.

Issue found:

1. Protocol-relative redirects are not stripped in the proxy (medium severity). The ModifyResponse hook strips absolute redirects to prevent pivoting the browser to unintended hosts, but protocol-relative redirects (e.g. //169.254.169.254/...) bypass the check because url.Parse sets IsAbs() to false when the scheme is empty. These should also be stripped.

A suggestion comment with the fix and an updated test is posted below.

[ask-bonk]

Posted a review on PR #3109. Found one actionable issue: protocol-relative redirects (e.g. //169.254.169.254/...) bypass the absolute-redirect check in the proxy because url.Parse returns IsAbs() == false when the scheme is empty. Suggested adding || parsed.Host != "" to the condition and provided an updated table-driven test covering both absolute and protocol-relative cases.

github run

[markphelps]

what bonk said

[ask-bonk]

LGTM

github run