[ddehilster]

/studio/try/ is a second page in the same build: pick one of VisualText's own analyzers,
type text, press Run, and see the pass sequence, the knowledge base, what the run wrote,
the parse trees, and — with Log files on — each pass's own tree and the text marked with
what its rules matched. It is drawn with @visualtext/analyzer-views and loads no Monaco:
5.5 kB of JavaScript.

Full write-up: docs/TRY-PAGE.md.

The decision this rests on: canned analyzers, not a sandbox

Running an analyzer is running its author's code, and docs/ARCHITECTURE.md says the
per-run sandbox strangers would need is not built. Of the three ways to have a public try
page — build the sandbox, ship only our own analyzers, or keep the invite gate — this is the
second.

The visitor never supplies code. The analyzers are copied in when the image is built,
from a pinned VisualText/analyzers release — the same analyzers.zip VisualText downloads
as its examples, so the page offers exactly the set a VisualText user has — and the page
offers no way to edit the NLP++. The text is data the rules read, not rules the engine runs.

Two things have to stay true for that argument to hold, and neither is enforced by the
server, so both are written down rather than assumed:

1. The page stays read-only. Accepting a pasted grammar, an uploaded .nlp, or an
   analyzer named by URL puts it straight back behind the sandbox that does not exist.
2. /api/run is still the general endpoint — it accepts any files a caller sends. The
   restraint lives in the page, not the server. Making this reachable anonymously without
   rate-limiting and fronting /api/run would put an RCE endpoint on the host that serves
   visualtext.org.

This PR changes nothing about who can reach anything. The page ships behind whatever
already guards /studio/. INSTALL.md gains a section on what opening it wider would need.

Which analyzers, and how they were chosen

All 21 analyzers in the repository were run through POST /api/run with develop: true
before any UI existed. 19 ran clean. The eight on the page were picked from those for showing
different things; the survey table is in docs/TRY-PAGE.md so nobody repeats it.

Two that are not there:

• parse-en-us is refused — it calls interactive(), which nlp_run.BLOCKED lists with
  the desktop app's popups. At both of its call sites it is a read-only predicate, and in both
  the false branch is the safer one (no openfile, an in-memory buffer). Unblocking it
  would very likely give the page the full English parser. Deliberately not done here —
  loosening a security control belongs in its own change, with someone deciding it on purpose.
  Written up as an open question.
• tutorial-01 is 26 MB, over the run server's 8 MB limit, for a sequence of one pass.

Verification

• All eight run clean against the shipped file sets (not the source tree): 0 problems,
  0 skipped trees.
• passes() against the per-pass trees: 0 orphans across all eight. Both numbering traps
  are live in the set — corporate has a stub (takes no number), and a switched-off /nlp
  pass (keeps its number, writes no tree) is covered by the tests.
• ruleMatches() over real trees fetched through /api/run/tree, on every pass of every
  analyzer. The all-@CODE passes correctly mark nothing.
• docker build + smoke-test.sh pass under the restrictions the container runs with,
  including the new try-page checks.
• 39 unit tests (6 new).

Writing src/try/result.ts found two real bugs: readOutput() returns a { output } wrapper
while <nlp-values> wants the parsed value (every field would have been listed as
output.something), and the run server calls a tree's size size where the views want
bytes. Both now live in one place with tests pinning them.

Not verified: the rendered page. There is no browser on the machine this was built on, so
npm run selftest could not run and nobody has watched it draw. Everything behind the pixels
is verified programmatically. Worth a look in a browser before merge.

Notes for the reviewer

• analyzer-views/README.md says the package serves "both pages" — with this merged that is
  three. Left alone here since it was just rewritten; flagging for whoever owns it.
• VisualText/analyzers has no LICENSE file. This page redistributes its contents to
  every visitor. .gitignore declines to commit the copy, for the same reason it declines to
  commit analyzer-templates, but the underlying question is the owner's.
• Two small shared extractions to avoid drift, both pure moves: scripts/analyzer-files.mjs
  (what travels with an analyzer, shared with copy-samples.mjs) and src/theme.css (the
  palette, shared with the editor page).

🤖 Generated with Claude Code