Polish mock policy server UI

[joshspicer]

Summary

• polish the mock policy server UI with a compact header, persistent light/dark themes, and clearer schema controls
• add an editable process-local schema source backed by POST /api/schema
• redesign client setup around Mock Server API and file-based delivery mechanisms
• improve setup guidance, accessibility, responsive behavior, and managed-settings documentation

Validation

• npm run eslint -- scripts/mock-policy-server/public/app.ts scripts/mock-policy-server/server.ts
• focused TypeScript check for scripts/mock-policy-server/public/app.ts
• git diff --check
• exercised schema GET/POST routes and both setup delivery options in the integrated browser

[Copilot]

Copilot review overview

🟡 Changes recommended

The critical schema-route exposure and unresolved moderate UI and accessibility issues must be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 3

New issues introduced by this change (4)

Severity	Finding
	scripts/​mock-policy-server/​server.ts — This new unauthenticated control route turns the server into an arbitrary JSON file reader and HTTP…
	scripts/​mock-policy-server/​public/​app.ts — This always collapses the Schema section on reload and, because setExpandableSectionState…
	scripts/​mock-policy-server/​public/​style.css — Avoid :has() here. Descendant mutations such as checking these radios invalidate ancestor…
	scripts/​mock-policy-server/​public/​style.css — Keeping this aria-live node at display: none while empty can prevent assistive technology from…

What changed in this PR

Polishes the mock policy server UI and adds runtime schema-source editing.

Changes:

• Adds persistent themes and redesigned setup controls.
• Adds POST /api/schema for process-local schema loading.
• Updates managed-settings and local-testing documentation.

File	Review
scripts/​mock-policy-server/​server.ts	Critical: The unauthenticated schema route enables arbitrary JSON file reads and HTTP fetching when exposed. Require authentication or restrict access and sources.
scripts/​mock-policy-server/​README.md	Documentation updated; no unresolved comments.
scripts/​mock-policy-server/​public/​style.css	Moderate: Replace :has() selection styling and keep the empty live region rendered for assistive technology.
scripts/​mock-policy-server/​public/​index.html	Nit: Remove unsupported aria-expanded from native radio controls and corresponding updates.
scripts/​mock-policy-server/​public/​app.ts	Moderate: Restore the persisted Schema section expansion state instead of overwriting it with false.
.github/​skills/​policy-and-managed-settings/​local-testing.md	Testing guidance updated; no unresolved comments.

Suppressed comments (1)

scripts/mock-policy-server/public/index.html:63

• aria-expanded is not a supported state for the native radio role. The radio's checked state already communicates which delivery mechanism is selected; retain aria-controls, but remove aria-expanded here and the corresponding updates in selectSetupMethod to avoid exposing invalid semantics to assistive technology.

						<input id="setup-method-proxy" type="radio" name="setup-method" value="proxy"
							aria-expanded="true" aria-controls="proxy-method-content" checked>

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.