feat(playground): run the engine in the browser, on a public repo

[maxgfr]

Adds site/playground/: paste a public GitHub repository and index it entirely client-side — the same walk, the same tree-sitter grammars, the same link-graph, compiled for the browser and run in a Web Worker.

The engine source is untouched

Node builtins are redirected at resolution time to shims in src/browser/ (an in-memory VFS, a synchronous SHA-1, a Buffer covering readText's four decode paths). Everything spawn-based degrades along fallbacks the engine already ships and already tests: sh() reports its binary missing, so git.ts returns no commit and grep.ts uses its pure-JS backend.

scripts/engine.mjs, engine.d.mts and cli.mjs are byte-identical to before.

Walk decides what is downloaded

A file list carries paths and sizes, and sizes alone satisfy lstatSync — so the tree is mounted with no contents, the real walk() runs on it, and its keep-list is the download list. No ignore rule, size cap or capped flag is reimplemented in the UI. pruneUnfetched() drops whatever was listed but never fetched, so a file can never reach the index as a phantom empty one.

Source ordering is measured, not assumed

jsDelivr's branch manifest is a snapshot rather than the branch head. On t3-oss/create-t3-turbo it listed 125 files of which 37 no longer existed (404 on raw too, so genuinely deleted). The GitHub trees API listed 141 blobs and all 141 fetched. So GitHub is primary, jsDelivr is the fallback for when the 60/hour API limit runs out, and the caveat is shown rather than hidden — 88 → 132 files indexed on that repo.

Verified

repo	measured in headless Chrome
gin-gonic/gin@master	129 files, 1 613 symbols, tier AST · go, 185 ms
t3-oss/create-t3-turbo@main	132 files, 183 symbols, tier AST · javascript, tsx, typescript, 48 ms

• tests/browser-build.test.ts indexes three fixtures through the VFS and asserts graph.json / symbols.json are byte-identical to the Node build — with the grammars asserted loaded, so the comparison cannot pass vacuously.
• Shim behaviour is checked against the real node: modules; the whole palette runs against a real index; the fetch pipeline has an opt-in live test (CODEINDEX_PLAYGROUND_E2E=1).
• pnpm test 1 119 passing, typecheck clean, check:build holds the committed bundle byte-reproducible.

Note on the build

Built by scripts/build-browser.mjs rather than a third tsup target: tsup registers its own node-protocol plugin ahead of user plugins and resolves node:fs to an external bare "fs" — which no browser can load, and which Node quietly satisfies from the real disk (a silent failure under test).

[github-actions]

🎉 This PR is included in version 2.23.0 🎉

The release is available on:

• v2.23.0
• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀