[BasilZafar11]

Summary

Fixes #60

Opening Hosted Policies previously requested retired policy filesystem APIs and immediately failed with 410. Keep the existing Policies navigation item and replace the editor with a static observe-only guidance page: edit policy.yaml locally, run mutiny run --hosted, and replay regressions with local mutiny test. Copyable CLI guidance and working campaign/project links provide the next steps. Copy explicitly distinguishes the bundled demo policy from a user's local project policy, addressing the overlapping Policies wording in #47.

Remove unused policy filesystem methods and PolicyContent from the Hosted client. The page has no API import or effects; it cannot request retired policy endpoints. Backend 410 behavior is unchanged.

Add two web component/client tests using Node's built-in test runner and the existing TypeScript compiler, without new dependencies. The real page and command component render with API/network access forbidden; the client test checks that retired policy operations are absent. npm test now runs in web CI and is documented in the web README.

This branch reuses the verified local-font build correction from #133 so its build is independent of the confirmed Next.js Google font loader failure. It is otherwise based on current upstream main 5ae4b0e (fork main matches).

Type of change

• Bug fix
• Tests
• Hosted API / UI (secondary surface)

Checklist

• Read contributing guidelines, security policy, code of conduct, and support
• Linked related issue
• Core stays free of framework SDK imports
• Added regression tests
• Documentation and UI copy match observe-only behavior
• One Policies UX concern; no new metadata product or filesystem access
• Authorized local testing only

Test plan

• npm test: 2 passed.
• npm run lint: passed.
• npx tsc --noEmit: passed.
• npm run build: passed, including final copyable command component, lint/type validation, and all 10 static pages.
• uv run --locked pytest tests/integration/test_api_hosted_filesystem_access_removed.py -q --tb=short: 15 passed; retired APIs still return 410 and existing observe-only ingest/demo checks pass.
• git diff --check: passed.
• Production-build browser check at desktop and 390x844: policy guidance visible, no editor or error state, copy button shows Copied, campaign/project links open their existing routes. API logs show only shell health requests while on Policies; no policy filesystem requests.

Full backend/reliability, CLI smoke, and package artifact checks were left to existing CI. Tests/ingest/campaign implementations are unchanged.

[vercel]

@BasilZafar11 is attempting to deploy a commit to the priyanshu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[CodewithJha]

I reviewed this against #60 (MUT-007) acceptance criteria and ran it.

Acceptance criteria

• The page no longer calls /api/policies or /api/policies/content. I built the app, served it, and /policies returns 200 with static guidance only. The retired client methods and the PolicyContent type are removed from api.ts, and tsc is clean, so nothing else used them. Solved.
• The 410 behavior is untouched: the diff has no API changes. Solved.
• The experience is an explicit observe-only state. You chose option (b) as the issue asked and said so. The copy matches the CLI: mutiny init, then mutiny run --hosted, whose init stub already has hosted.api_url. It also says plainly that the bundled demo uses its own sample policy. Solved.
• A test that the retired endpoints aren't used: solved. See the notes below.
• Campaigns, tests and projects flows unchanged: only the policies page, api.ts, the test, package.json, a CI step and a README note change. Solved.

What I ran

• On a merge of this branch with current main: npm ci, npm test (2 pass), npm run lint, npx tsc --noEmit and npm run build all pass.
• I tried to break the tests. Restoring the old policies/page.tsx fails test 1 with Unexpected import: react. Restoring the old api.ts fails test 2. So both tests fail on the pre-fix code and pass on the fix.

What I liked

• The test loads the real page module with fetch forbidden and checks that no input, textarea or form renders. That protects the "no policy editor, no API call" decision itself, not only the string content.
• Deleting the dead client methods and types, instead of leaving them unused, means a future page can't quietly call a retired endpoint by accident.
• It is the first Hosted UI test and it is wired into CI, which is a real start on #74. I'm leaving #74 open, because one page is not full coverage.

Non-blocking note
The test loader only stubs a fixed set of imports, so adding a new import to the page will need a matching stub. That is fine for now and arguably a feature.

Merging.

[CodewithJha]

Merged. Thanks for the contribution.

You handled this well. You took option (b) from #60 and said so, deleted the dead client methods so a retired endpoint can't be called by accident, and wrote a test that actually breaks when the old page or client comes back (I checked by restoring both). It is also the first Hosted UI test, and it runs in CI.

This closes #60. I'm leaving #74 open, since this covers one page.

If you'd like to continue working on Mutiny, these would be good related areas to look at:

• [TEST] MUT-026: Hosted UI has zero tests #74: extend the harness you added to the other Hosted pages.
• frontend: clearer empty-state copy for policies/tests (sample vs project) #47: clearer empty-state copy for policies and tests (sample versus project). It touches the page you just rewrote.
• a11y: aria-live region for Hosted campaign running/finished status #33: an aria-live region for the campaign running/finished status, a small frontend change.

No pressure on any of them.