feat: ComponentOnce live development workbench

[swittk]

Scope

Review the new optional ComponentOnce development environment without changing the published runtime/package formats.

Added

• @componentonce/dev browser workbench and host-profile contract
• componentonce dev CLI dispatcher
• production-compiler graph watcher for TS/JS/CSS/CSS Modules/assets
• real browser host externals + shared React singleton
• Props / Payload / Context fixtures
• package/manifest/capability/asset inspection
• last-good preview + redbox-style diagnostics
• responsive presets + free drag resize
• configurable port and explicit interface binding
• host-defined visual/theme variants
• v2 package export

Invariants

• trusted internal code only; this is not an untrusted-code sandbox
• no core/runtime package-format change
• no Next/Vite/product-framework dependency in ComponentOnce core
• successful source rebuilds go through the canonical production compiler
• loopback-only by default; broader binding is explicit and still Host/origin validated
• React singleton remains host-owned

Validation

• repo-wide build: PASS
• repo-wide unit tests: PASS
• repo-wide TypeScript checks: PASS
• compiler graph-watch regression: PASS
• dev-server security/bind tests: PASS
• Playwright real-Chrome workbench regression: PASS
• exported dev package parses/instantiates through normal runtime: PASS
• git diff --check: PASS

Review setup

This PR intentionally targets premerge/componentonce-v0, not the default branch. Nothing should auto-merge or publish from this PR. Review/fix cycles happen on review/componentonce-dev-env; promotion to default branch is a separate owner decision.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 513a7c23-377c-4d18-b53c-f0e1d53a1686

📥 Commits

Reviewing files that changed from the base of the PR and between b57559c and 5b4334a.

⛔ Files ignored due to path filters (2)

• packages/dev/examples/logo.svg is excluded by !**/*.svg
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (26)

• README.md
• packages/compiler-esbuild/src/cli.ts
• packages/compiler-esbuild/src/compiler.ts
• packages/compiler-esbuild/test/watch.test.ts
• packages/dev/README.md
• packages/dev/browser/workbench.spec.ts
• packages/dev/build-ui.mjs
• packages/dev/examples/assets.d.ts
• packages/dev/examples/card.module.css
• packages/dev/examples/card.tsx
• packages/dev/examples/host.css
• packages/dev/examples/host.ts
• packages/dev/package.json
• packages/dev/playwright.config.ts
• packages/dev/src/cli.ts
• packages/dev/src/client.ts
• packages/dev/src/host.ts
• packages/dev/src/index.ts
• packages/dev/src/preview.tsx
• packages/dev/src/protocol.ts
• packages/dev/src/server.ts
• packages/dev/src/ui.ts
• packages/dev/src/workbench.css
• packages/dev/test/server.test.ts
• packages/dev/tsconfig.json
• packages/dev/tsconfig.test.json

 __________________________________________________
< My OKRs are all about finding bugs in your code. >
 --------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[swittk]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[swittk]

Superseded by a full-repository review PR based on a true empty commit. This delta PR is intentionally closed so the review covers the entire ComponentOnce tree.

[swittk]

Historical local-path cleanup complete; this superseded PR is reclosed. PR #2 remains the full-repository review.