refactor: simplify codebase — dedup agent core, harden edge cases

[BaruchEric]

• Extract shared agent core (api/agent-core.ts) from playground/server.ts and api/agent.ts; trims ~400 lines of duplication across system prompt, SSE encoding, streamText loop, and request body parsing.
• Consolidate DEFAULT_MODEL to a single source (api/model.ts); re-export from playground/settings.ts; drop drifted copies in api/health.ts and playground/server.ts.
• Middleware fails closed in production when BASIC_AUTH_PASS is unset; logs on cold start when disabled.
• Bound SSE parse buffer at 1 MB to prevent memory growth from a misbehaving server.
• Fix wireResizers early-return leak (moved !first/!second guard before setPointerCapture + body class mutations).
• Persist custom model input on blur/Enter instead of per keystroke.
• Replace inline URL regex with safe-url#isExternal; adds protocol checking via URL parse instead of string prefix.
• Extract appendChildren helper (card/stack/row/grid); CSS.escape form field name in querySelector; tighten numeric validation to HTML input[type=number] semantics.
• design-to-css: export generate() so tests call it in-process instead of spawning bun subprocesses; switch TOKEN_GROUPS allow-list to a deny-list so new DESIGN.md sections aren't silently dropped.
• build-styles: mkdir dist/ before write; parallelize reads.
• lint-design: balanced-brace JSON extractor replaces fragile lastIndexOf('\n{') heuristic.
• settings-ui: generic toggleGroup helper unifies theme/layout button groups; .settings-hide-ai-row CSS class replaces inline styles.
• playground: single WELCOME_SPEC, unified appendLine helper, tidied isFieldChange narrowing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stream-ui	Ready	Preview, Comment	Apr 23, 2026 4:22am