[19/36] Add OC-110 runtime authoring UX

docs/open-collection-gap-analysis/AGENT_PROGRESS.md

@@ -68,7 +68,7 @@ Use full branch names for stacking existing branches with `but move <child-branc
 | OC-080 | Runtime lifecycle for WebSocket and unary gRPC | Done | Codex | supervisor/add-runtime-authoring-ux-task (ho); implementation commit `ea7383b`; completion/ledger commit `251408f`; supervisor cleanup commit `878063b`; supervisor review ledger is the top `ho` commit | Satisfied by `test/webSocketSupport.test.ts`, `test/grpcSupport.test.ts`, `test/sendRequestTool.test.ts`, and `test/responseProvider.test.ts`: WebSocket and unary gRPC before/after runtime lifecycle order, before-script header/metadata/body mutation, after-response scripts/tests/assertions/actions, runtime variable mutation, sandbox-denial security diagnostics, failure-path response preservation, cancellation/cleanup, response provider rendering, Copilot tool output, and schema-valid local demo WebSocket/gRPC runtime fixtures. | `npx vitest run test/webSocketSupport.test.ts test/grpcSupport.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts` passed 4 files/50 tests; `npm run compile` passed; `node scripts/validate-collection.js examples/demo-api` passed 44/44 files; live local WebSocket/gRPC runtime smoke passed with `LIVE_WS_RUNTIME_SMOKE ok` and `LIVE_GRPC_RUNTIME_SMOKE ok`; `npm test` passed 22 files/428 tests; `npm run build` passed; VSIX packaged and installed as `missio.missio@0.7.7`. | 2026-06-15 01:42 NZT | Supervisor review found no blocking OC-080 issues; GitButler `zz` is clean and the extension is installed from the reviewed stack. |
 | OC-090 | gRPC streaming | Done | Codex | feature/oc-090-grpc-streaming (am), stacked on applied OC-030 unary/protobuf work; implementation commits `84cf254` and `c462d51` | Implemented method-type-aware unary, server-streaming, client-streaming, and bidirectional-streaming gRPC execution with schema-native ordered message sequences, proto method-type validation, cancellation cleanup, partial stream error retention, response stream summaries, local demo streaming proto/server/routes, and regression tests for unary dispatch, validation, round-trip safety, failure paths, and cleanup. | `npm run compile` passed; `npx vitest run test/grpcSupport.test.ts test/schemaRoundTrip.test.ts test/validationService.test.ts test/responseProvider.test.ts test/sendRequestTool.test.ts` passed 5 files/33 tests; `node scripts\validate-collection.js examples\demo-api` passed 42/42 files; `npm test` passed 21 files/405 tests; `npm run build` passed. Live hidden `node examples/demo-api/grpc-server.js` smoke verified server/client/bidi/error streams. | 2026-06-15 00:21 NZT | OC-090 complete in the verified worktree. Preserve remaining unassigned parallel/change-routing IDs called out in the OC-090 log; do not commit them to unrelated branches. |
 | OC-100 | Request type UX | Done | Codex | feature/oc-100-request-type-ux (g0 after restack), stacked on supervisor/add-request-type-ux-task; implementation commit `5cb05a3` | Satisfied by `test/requestTypeUx.test.ts`: schema-valid HTTP/GraphQL/WebSocket/gRPC starter templates, actual `missio.newRequest` protocol picker/write/open flow, YAML and editor-model round-trip safety, no stale protocol roots, gRPC same-protocol editor guard, and read-only protocol chip shell. Shared regressions cover HTTP/GraphQL/WebSocket/gRPC editor, validation, command/tool, and protocol behavior. Switcher/conversion helpers are intentionally out of scope because the benchmarked tools emphasize protocol choice at creation and Postman locks saved request protocols. | `npx vitest run test/requestTypeUx.test.ts test/schemaRoundTrip.test.ts test/openCollectionFoundation.test.ts test/validationService.test.ts` passed 4 files/25 tests; targeted protocol suite passed 8 files/68 tests; `npm run compile` passed; `npm test` passed 21 files/405 tests; `node scripts/validate-collection.js examples/demo-api` passed 42/42 files; `npm run build` passed. | 2026-06-15 00:15 NZT | OC-100 complete; no saved-request switcher was added by product decision and benchmark alignment. Remaining unassigned changes are parallel OC-050/OC-090 work, not OC-100. |
-| OC-110 | Runtime authoring UX | Unclaimed | - | - | - | - | - | Start after OC-070 settles request editor surface churn; coordinate with OC-080 if non-HTTP runtime response shapes affect authoring examples. |
+| OC-110 | Runtime authoring UX | Done | Codex | feature/oc-110-runtime-authoring-ux (g0), stacked on supervisor/add-runtime-authoring-ux-task; implementation commit `fe0ad14`; supervisor follow-up commit `1e6db05`; supervisor acceptance recorded | Satisfied by `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, `test/validationService.test.ts`, and shared schema/protocol regressions: visual editor can author supported runtime scripts/tests/assertions/actions, no longer offers non-executing `hooks` scripts or unsupported persisted scopes for new rows, preserves schema-valid existing `hooks`/persisted-scope YAML with diagnostics, and runtime actions diagnose unsupported scopes instead of silently writing runtime variables. | `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed. | 2026-06-15 09:51 NZT | Supervisor review accepted OC-110 rework; no remaining blocking findings. |
 
 ## Dependency Map
 
@@ -339,7 +339,45 @@ Record cross-cutting decisions here so parallel agents do not rediscover them.
 
 ### OC-110 Runtime Authoring UX
 
-No updates yet.
+- 2026-06-15 09:15 NZT - Codex: Claimed OC-110 and recorded the coverage plan before implementation.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (m0); `but status -fv` showed clean `zz` and the OC-110 task page available on `supervisor/add-runtime-authoring-ux-task`.
+  Coverage: planned automated request editor/model/webview tests for add/edit/disable/reorder/remove runtime scripts, tests, assertions, and `set-variable` actions; schema round-trip and validation regressions for runtime preservation, disabled entries, unknown schema-valid fields, and protocol-neutral HTTP/GraphQL/WebSocket/gRPC saves; demo/docs verification guidance; compile, targeted protocol/editor suites, demo collection validation, full suite, and build.
+  Changed: `docs/open-collection-gap-analysis/AGENT_PROGRESS.md`.
+  Verified: `but status -fv`, OC-110 task page, and current progress ledger reviewed; implementation tests not run yet.
+  Next: audit request editor serializer/webview, runtime schema/types, runtime fixtures, and existing tests before adding OC-110 coverage and implementation.
+
+- 2026-06-15 09:28 NZT - Codex: Completed OC-110 runtime authoring UX with schema-valid visual editing for scripts, tests, assertions, and set-variable actions across HTTP, GraphQL, WebSocket, and gRPC requests.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0), stacked on `supervisor/add-runtime-authoring-ux-task`; implementation commit `fe0ad14` (`Add OC-110 runtime authoring UX`). `but status -fv` after the implementation commit shows only this ledger file as unassigned. A temporary README guidance hunk was removed from this slice because README is owned by the separate OC-070 stack; user-verifiable guidance remains in the committed demo request descriptions.
+  Coverage: implemented `test/runtimeAuthoringUx.test.ts` for editor model/UI shell create/edit/disable/reorder/remove behavior, runtime YAML preservation, disabled entries, structured description preservation, no stale protocol roots, and gRPC-safe runtime edits; expanded runtime execution coverage for disabled scripts; expanded validation coverage for disabled scripts across protocol requests; re-ran shared schema, request type, WebSocket, and gRPC regressions.
+  Changed: `src/models/schemaRoundTrip.ts`, `src/models/types.ts`, `src/panels/requestPanel.ts`, `src/webview/requestPanel.ts`, `src/webview/requestPanel.css`, `src/services/runtimeExecutionService.ts`, `schema/missio-extensions.json`, `schema/opencollectionschema.json`, runtime/demo request guidance files under `examples/demo-api`, `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, `test/validationService.test.ts`, and this ledger.
+  Verified: focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/66 tests; `npm run compile` passed; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/434 tests; `npm run build` passed.
+  Next: commit this ledger update to `feature/oc-110-runtime-authoring-ux`; OC-110 is ready for review from `fe0ad14` plus the ledger commit.
+
+- 2026-06-15 09:36 NZT - Codex Supervisor: Reviewed OC-110, built, packaged, and installed the extension.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0) remains stacked on `supervisor/add-runtime-authoring-ux-task`; `but status -fv` was clean after package/install. Build-regenerated `schema/opencollectionschema.json` produced no content diff and was discarded as line-ending churn before packaging.
+  Findings: `src/webview/requestPanel.ts` exposes `hooks` in the runtime script editor although `RuntimeExecutionService` only invokes `before-request`, `after-response`, and `tests` scripts. The same editor exposes `folder`, `collection`, and `environment` action scopes although the current runtime stores every non-`request` mutation in runtime variables while reporting the selected scope. These need either runtime support or guarded UX/diagnostics before final OC-110 acceptance.
+  Verified: `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/66 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/434 tests; `npm run build` passed; `npx @vscode/vsce package --out $env:TEMP\missio-0.7.7-oc110-supervisor.vsix` passed; `code.cmd --install-extension $env:TEMP\missio-0.7.7-oc110-supervisor.vsix --force` installed `missio.missio@0.7.7`.
+  Next: Address the two UX/runtime findings, then re-run the same verification suite and update this ledger.
+
+- 2026-06-15 09:41 NZT - Codex: Claimed the OC-110 supervisor follow-up for non-executing hook scripts and unsupported persisted action scopes.
+  GitButler: continuing on `feature/oc-110-runtime-authoring-ux` (g0); `but status -fv` showed clean `zz` before this ledger update.
+  Coverage: add OC-110 UI/source and round-trip regressions proving new rows cannot choose `hooks` or folder/collection/environment scopes, existing schema-valid unsupported rows are preserved with editor diagnostics, and runtime `set-variable` actions diagnose unsupported scopes instead of silently writing runtime variables.
+  Changed: `docs/open-collection-gap-analysis/AGENT_PROGRESS.md`.
+  Verified: planning/status only; implementation tests not run yet.
+  Next: patch the request runtime editor, runtime action diagnostics, and focused tests, then re-run the OC-110 verification matrix.
+
+- 2026-06-15 09:45 NZT - Codex: Addressed both OC-110 supervisor findings.
+  GitButler: implementation/test follow-up committed to `feature/oc-110-runtime-authoring-ux` as `1e6db05` (`Address OC-110 runtime authoring review`); `but status -fv` after that commit showed only this ledger file as unassigned.
+  Coverage: removed `hooks` from new runtime script choices while preserving existing schema-valid hook rows with a disabled diagnostic option and visible warning; limited new `set-variable` action scopes to `runtime` and `request` while preserving existing folder/collection/environment YAML with diagnostics; runtime now returns a failed action diagnostic for unsupported persisted scopes instead of silently mutating runtime variables.
+  Changed: `src/webview/requestPanel.ts`, `src/webview/requestPanel.css`, `src/services/runtimeExecutionService.ts`, `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, and this ledger.
+  Verified: `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts` passed 2 files/15 tests; `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed.
+  Next: commit this ledger update to `feature/oc-110-runtime-authoring-ux`; OC-110 is ready for final supervisor acceptance.
+
+- 2026-06-15 09:51 NZT - Codex Supervisor: Reviewed OC-110 follow-up commit `1e6db05` and found no remaining blocking issues.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0) remains stacked on `supervisor/add-runtime-authoring-ux-task`; `but status -fv` showed clean `zz` after build verification.
+  Findings: none. The previous findings are addressed: new runtime script rows no longer offer `hooks`, new set-variable rows no longer offer folder/collection/environment scopes, existing schema-valid unsupported rows are preserved with visual diagnostics, and runtime execution reports unsupported persisted scopes instead of silently writing runtime variables.
+  Verified: `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed.
+  Next: OC-110 is accepted; no follow-up rework required from this review.
 
 ### OC-090 gRPC Streaming
 

examples/demo-api/GraphQL/graphql-health.yml

@@ -2,7 +2,7 @@ info:
   name: GraphQL Health
   type: graphql
   seq: 1
-  description: Run node examples/demo-api/server.js first, then send this health query to the local GraphQL fixture.
+  description: Run node examples/demo-api/server.js first, optionally edit assertions in the request Runtime tab, then send this health query.
 graphql:
   method: POST
   url: "{{baseUrl}}/graphql"

examples/demo-api/Runtime/folder.yml

@@ -1,7 +1,7 @@
 info:
   name: Runtime
   type: folder
-  description: Run `node examples/demo-api/server.js` before sending these runtime demo requests.
+  description: Run `node examples/demo-api/server.js`, then open a request's Runtime tab to edit scripts, tests, assertions, and set-variable actions before sending.
 request:
   headers:
     - name: X-Demo-Folder

examples/demo-api/Runtime/intentional-failure.yml

@@ -2,7 +2,7 @@ info:
   name: Runtime Intentional Failure
   type: http
   seq: 3
-  description: Run `node examples/demo-api/server.js`, then send this request to see failing assertions and tests surfaced in the Runtime tab and tool output.
+  description: Run `node examples/demo-api/server.js`, adjust the request Runtime tab, then send to see failing assertions and tests in the response Runtime tab and tool output.
 http:
   method: GET
   url: "{{baseUrl}}/runtime/assert-fail"

examples/demo-api/Runtime/lifecycle-token.yml

@@ -2,7 +2,7 @@ info:
   name: Runtime Lifecycle Token
   type: http
   seq: 1
-  description: Run `node examples/demo-api/server.js`, then send this request to see passing scripts, tests, assertions, logs, and a set-variable action.
+  description: Run `node examples/demo-api/server.js`, edit scripts/assertions/actions in the request Runtime tab if desired, then send to see passing runtime output.
 http:
   method: POST
   url: "{{baseUrl}}/runtime/token"
@@ -34,6 +34,10 @@ runtime:
       code: |-
         pm.test("status is 200", () => pm.expect(pm.response.code).to.eql(200));
         test("token action source exists", () => assert(response.json().nested.owner === "script-owner"));
+    - type: tests
+      disabled: true
+      code: |-
+        test("disabled test is preserved", () => assert(false));
   assertions:
     - expression: res.status
       operator: equals

examples/demo-api/Runtime/scripted-echo.yml

@@ -2,7 +2,7 @@ info:
   name: Runtime Scripted Echo
   type: http
   seq: 2
-  description: Run `node examples/demo-api/server.js`, then send this request to verify before-request scripts can set headers and runtime variables before HTTP execution.
+  description: Run `node examples/demo-api/server.js`, edit the before-request script from the request Runtime tab, then send to verify script-authored headers and variables.
 http:
   method: POST
   url: "{{baseUrl}}/runtime/echo"

examples/demo-api/WebSocket/runtime-lifecycle.yml

@@ -48,4 +48,4 @@ runtime:
       variable:
         scope: runtime
         name: runtimeSocketMessages
-docs: Run `node examples/demo-api/server.js`, select the LOCAL environment, then send this request to see WebSocket before/after scripts, assertions, tests, and set-variable actions.
+docs: Run `node examples/demo-api/server.js`, select the LOCAL environment, optionally edit the request Runtime tab, then send to see WebSocket scripts, assertions, tests, and set-variable actions.

examples/demo-api/gRPC/runtime-unary-lifecycle.yml

@@ -59,4 +59,4 @@ runtime:
       variable:
         scope: runtime
         name: grpcRuntimeRequestId
-docs: Run `node examples/demo-api/grpc-server.js`, select the LOCAL environment, then send this request to see unary gRPC metadata/message mutation plus runtime tests, assertions, logs, and set-variable actions.
+docs: Run `node examples/demo-api/grpc-server.js`, select the LOCAL environment, optionally edit the request Runtime tab, then send to see unary gRPC metadata/message mutation plus runtime tests, assertions, logs, and set-variable actions.

schema/missio-extensions.json

@@ -24,6 +24,10 @@
     {
       "extension": "non-HTTP runtime actions and WebSocket assertions",
       "reason": "Missio runs the same scripts, assertions, tests, and set-variable actions across supported protocol executors. The upstream schema omits some runtime lifecycle fields from WebSocket and gRPC runtime objects, so Missio extends them for protocol parity."
+    },
+    {
+      "extension": "disabled runtime scripts",
+      "reason": "Missio's visual request editor can toggle runtime scripts without deleting them. The disabled flag keeps authored scripts present in YAML while letting the runtime skip them."
     }
   ],
   "definitions": {
@@ -190,6 +194,16 @@
         }
       }
     },
+    {
+      "description": "Allow runtime scripts to be disabled without deleting them",
+      "target": "$defs/Script/properties",
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "description": "Whether the runtime script is disabled"
+        }
+      }
+    },
     {
       "description": "Allow runtime actions on gRPC requests",
       "target": "$defs/GrpcRequestRuntime/properties",

schema/opencollectionschema.json

@@ -2508,6 +2508,10 @@
         "code": {
           "type": "string",
           "description": "The script code"
+        },
+        "disabled": {
+          "type": "boolean",
+          "description": "Whether the runtime script is disabled"
         }
       },
       "required": [