[David Pine (IEvangelist)]

Live status header icon + redesigned videos page

Adds a real-time live indicator to the aspire.dev site header, immediately left of cookie preferences, and replaces the legacy /community/videos/ curated list with a focused two-tab live page for YouTube and Twitch.

When a stream is live, state is pushed to connected clients over Server-Sent Events from StaticHost. The header icon strobes everywhere except /community/videos/ and while native Picture-in-Picture is already open. Clicking the live header icon opens a native Document Picture-in-Picture window when supported, and falls back to the videos page otherwise. The PiP window is tracked as site-global state so it survives Astro client-side navigations without recreating the embed or interrupting playback; closing native PiP only closes PiP and does not redirect.

What's included

• Frontend live icon, SSE client, header wiring, and videos page rewrite.
• Native Document Picture-in-Picture controller for live embeds, with YouTube/Twitch embed selection from the server-provided primarySource and PiP-open state shared across Astro navigations.
• YouTube/Twitch tab icons and offline channel embeds: YouTube loads the aspiredotdev channel live-stream embed and Twitch loads the aspiredotdev channel player even when no live event is active.
• ASP.NET Core live-status backend with GET /api/live, GET /api/live/stream, Twitch EventSub webhook, YouTube WebSub webhook, and a dev-only override endpoint.
• Twitch and YouTube background services with resilient named HttpClients, webhook signature validation, reconciling polls/subscription renewal, and safe idle behavior when provider credentials are missing.
• AppHost dashboard URLs, Scalar API reference, and local dashboard commands for offline/online fake states and signed fake webhook invocations.
• Server-side protection for dev/dashboard commands via a per-run secret AppHost parameter sent as X-Aspire-Live-Dev-Command-Key and validated by StaticHost.
• wwwroot/.gitignore guard so local copies of the built frontend output cannot be accidentally added to source control.
• Frontend scripts build:statichost and build:statichost:skip-search that build Astro directly into src/statichost/StaticHost/wwwroot while preserving the Scalar assets and ignore guard.

Local testing

Start the AppHost from the worktree root with aspire start --isolated --apphost .\src\apphost\Aspire.Dev.AppHost\Aspire.Dev.AppHost.csproj, open the Aspire dashboard, select the aspiredev resource, and run the live-status commands from the Actions context menu.

To refresh the local StaticHost static files without search indexing, run from src/frontend:

pnpm build:statichost:skip-search

In AppHost run mode, StaticHost gets Live__EnableDevEndpoint=true and per-run secret parameters for the dev command key and fake webhook signing keys. Without real provider API credentials, Twitch and YouTube workers stay idle, so the feature is effectively off until a dashboard command triggers it.

Useful endpoints on the aspiredev resource: /api/live, /api/live/stream, /api/live/twitch/webhook, /api/live/youtube/webhook, /api/live/_dev/set, and /scalar/v1. The Twitch webhook is POST-only for notifications and the YouTube webhook supports GET verification plus POST notifications; plain GETs now return descriptive text instead of an unhelpful 404.

Tests

• tests/StaticHost.Tests covers webhook HMAC verification, YouTube Atom parsing, JSON shape, live-state aggregation, coalescing, subscribe/unsubscribe, and timing behavior.
• src/frontend/tests/unit/live-status.vitest.test.ts covers the live-status client public API.
• src/frontend/tests/e2e/live-status.spec.ts covers mocked /api/live + SSE behavior, header strobing, videos-page no-strobe behavior, PiP-open strobe suppression, native PiP click interception, PiP state surviving Astro client-side navigation, and idle channel embeds.

Configuration

"Live": {
  "EnableDevEndpoint": false,
  "DevCommandSecret": "",
  "Twitch": { "ClientId": "", "ClientSecret": "", "WebhookSecret": "", "ChannelLogin": "aspiredotdev" },
  "YouTube": { "ApiKey": "", "WebhookSecret": "", "ChannelHandle": "@aspiredotdev" }
}

User-secrets in dev, env vars / Key Vault in prod. Missing provider secrets degrade safely: the workers log and remain idle, while the API/SSE endpoints continue serving the non-live state.

[Copilot]

Pull request overview

Adds a new end-to-end “live status” feature to aspire.dev: StaticHost exposes live state + SSE + Twitch/YouTube webhooks, and the frontend consumes it to drive a header live icon, a redesigned /community/videos/ live page, and a site-global Document Picture-in-Picture experience.

Changes:

• Implemented StaticHost live-status backend (JSON + SSE, Twitch EventSub + YouTube WebSub, background reconciliation/polling, dev-only override endpoint, Scalar OpenAPI in dev).
• Added frontend live-status client + header integration + PiP controller, and rewrote /community/videos/ into a two-tab live embeds page.
• Added comprehensive unit/e2e tests plus a build script to emit Astro output directly into StaticHost wwwroot.

Reviewed changes

Copilot reviewed 50 out of 51 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/StaticHost.Tests/StaticHost.Tests.csproj	Adds new StaticHost test project and dependencies.
tests/StaticHost.Tests/Live/YouTubeWebSubServiceTests.cs	Unit tests for YouTube worker tick behavior.
tests/StaticHost.Tests/Live/YouTubeWebhookHandlerTests.cs	Unit tests for YouTube signature + Atom parsing helpers.
tests/StaticHost.Tests/Live/YouTubeClientTests.cs	Unit tests for YouTube Data API + PubSubHubbub client.
tests/StaticHost.Tests/Live/TwitchWebhookHandlerTests.cs	Unit tests for Twitch signature verification and webhook handler behavior.
tests/StaticHost.Tests/Live/TwitchEventSubServiceTests.cs	Unit tests for Twitch reconcile logic (create/delete subs).
tests/StaticHost.Tests/Live/TwitchClientTests.cs	Unit tests for Twitch Helix client behavior.
tests/StaticHost.Tests/Live/TwitchAppTokenProviderTests.cs	Unit tests for token acquisition + refresh behavior.
tests/StaticHost.Tests/Live/LiveTestHelpers.cs	Shared test helpers (fake options monitor, HTTP handler recording, etc.).
tests/StaticHost.Tests/Live/LiveStatusJsonTests.cs	Ensures YouTube property name serialization is correct.
tests/StaticHost.Tests/Live/LiveStatusBroadcasterTests.cs	Unit tests for broadcaster aggregation + coalescing + subscriptions.
tests/StaticHost.Tests/GlobalUsings.cs	Global usings for the new test project.
src/statichost/StaticHost/wwwroot/scalar/aspire-theme.css	Adds Aspire-themed Scalar CSS for dev API reference.
src/statichost/StaticHost/wwwroot/.gitignore	Prevents committing locally-built Astro output while preserving Scalar assets.
src/statichost/StaticHost/StaticHost.csproj	Adds resilience/OpenAPI/Scalar packages and debug content trimming for wwwroot.
src/statichost/StaticHost/Program.cs	Wires live-status + OpenAPI/Scalar in dev and adjusts static assets serving behavior.
src/statichost/StaticHost/Live/YouTube/YouTubeWebSubService.cs	Implements YouTube background worker (subscribe + polling).
src/statichost/StaticHost/Live/YouTube/YouTubeWebhookHandler.cs	Adds pure helper methods for YouTube webhook signature + payload parsing.
src/statichost/StaticHost/Live/YouTube/YouTubeClient.cs	Implements YouTube API + PubSubHubbub client.
src/statichost/StaticHost/Live/YouTube/IYouTubeClient.cs	Defines YouTube client abstraction + result types.
src/statichost/StaticHost/Live/Twitch/TwitchWebhookHandler.cs	Adds pure helper methods for Twitch EventSub signature + state updates.
src/statichost/StaticHost/Live/Twitch/TwitchEventSubService.cs	Implements Twitch background worker reconcile loop + state seeding.
src/statichost/StaticHost/Live/Twitch/TwitchClient.cs	Implements Twitch Helix client for user/stream/subscription operations.
src/statichost/StaticHost/Live/Twitch/TwitchAppTokenProvider.cs	Implements cached Twitch app token provider for Helix requests.
src/statichost/StaticHost/Live/Twitch/ITwitchClient.cs	Defines Twitch client abstraction + record types.
src/statichost/StaticHost/Live/README.md	Documents architecture, endpoints, configuration, and testing strategy.
src/statichost/StaticHost/Live/LiveStatusServiceCollectionExtensions.cs	Adds DI registration for live-status feature + named resilient HttpClients.
src/statichost/StaticHost/Live/LiveStatusOptions.cs	Adds strongly-typed configuration options for live-status feature.
src/statichost/StaticHost/Live/LiveStatusBroadcaster.cs	Implements live snapshot aggregation + coalesced broadcasts + subscriptions.
src/statichost/StaticHost/Live/LiveStatus.cs	Defines live snapshot schema + source-gen JSON context.
src/statichost/StaticHost/Live/LiveEndpoints.cs	Maps /api/live JSON, SSE stream, webhooks, and dev endpoint.
src/statichost/StaticHost/GlobalUsings.cs	Updates global usings to include live-status namespace.
src/statichost/StaticHost/appsettings.json	Adds Live configuration section defaults.
src/frontend/tests/unit/live-status.vitest.test.ts	Adds unit tests for the live-status client public API.
src/frontend/tests/e2e/ui-regressions.spec.ts	Updates header action ordering assertions and adds navigation regression coverage.
src/frontend/tests/e2e/live-status.spec.ts	Adds extensive e2e coverage for SSE behavior, header state, PiP, and videos page behavior.
src/frontend/src/content/docs/community/videos.mdx	Replaces curated videos list with “Aspire Live” page embedding YouTube/Twitch.
src/frontend/src/content/docs/community/index.mdx	Renames community CTA to “Watch live streams”.
src/frontend/src/components/YouTubeEmbed.astro	Supports channel live-stream embed + adjusts iframe labeling.
src/frontend/src/components/TwitchEmbed.astro	Adjusts iframe labeling and props typing.
src/frontend/src/components/starlight/Header.astro	Adds header live icon + loads live-status client + adds PiP controller.
src/frontend/src/components/starlight/Head.astro	Enables Astro ClientRouter for client-side transitions.
src/frontend/src/components/LiveVideosTabs.astro	Adds two-tab live embeds component wired to live-status snapshots.
src/frontend/src/components/LivePip.astro	Implements site-global Document Picture-in-Picture controller UI + logic.
src/frontend/src/components/live-status.ts	Adds singleton SSE client, DOM wiring, dismissal logic, and snapshot pub/sub.
src/frontend/src/assets/icons/live.svg	Adds the “live” header icon SVG.
src/frontend/scripts/build-static-host.mjs	Adds script to build Astro directly into StaticHost wwwroot while preserving Scalar assets.
src/frontend/package.json	Adds build:statichost and build:statichost:skip-search scripts.
src/frontend/config/sidebar/community.topics.ts	Renames “Videos” navigation entry to “Live Streams” (with translations).
src/frontend/astro.config.mjs	Supports configurable outDir via ASTRO_OUT_DIR.
src/apphost/Aspire.Dev.AppHost/AppHost.cs	Adds local dev dashboard commands + per-run secrets for live-status simulation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Adam Ratzman (adamint)]

I left inline comments for the must-fix local-dev, webhook validation/caching, broadcaster ordering, and frontend state/test issues. These all look fixable in place, and CI is green at this head. I could not run the site or browser paths inside the isolated worker because the dependencies and local server were unavailable there, so this pass relies on CI plus direct source inspection for that proof.

[aspire-repo-bot]

Frontend HTML artifact ready

The latest frontend build uploaded the frontend-dist artifact for PR #758. Use the VS Code button below to open this PR with GitHub Artifacts Explorer and browse the built HTML locally.

This comment updates automatically when a new frontend build artifact is uploaded.

[Eric Erhardt (eerhardt)]

review the usage of key vault and redis

[Mitch Denny (mitchdenny)]

Review findings

Reviewed commit 0e3a7f540bb84987a32bf280f9467ef5bb298318. These issues should be addressed before merging.

High

1. Client-side navigation removes the unanswered cookie-consent banner.
   Head.astro:43: the new global ClientRouter replaces the dynamically inserted WCP banner during body swaps, while window.__aspireWcpConsentInitialized survives and prevents initialization from restoring it. Visitors in consent-required regions who navigate before answering lose the banner. Preserve a persistent consent host and its required root state across navigation, and add a navigate-before-consenting regression test. This was reproduced with the actual consent initializer in a simulated body swap.

2. A stale YouTube search can overwrite a newer live observation.
   LiveEndpoints.cs:417-420: webhook confirmation unconditionally publishes its search result. An offline search can start, the polling worker can discover and publish a newly started broadcast, and the older empty response can then overwrite it with (false, null). The worker no longer performs known-video checks and can wait until its next discovery deadline, up to 30 minutes away. The positive polling write has the corresponding stale-result race. Apply results conditionally against the provider state observed before the request, share offline-confirmation logic, and test these request interleavings.

3. A lost YouTube verification response can leave the subscription inactive for days.
   YouTubeWebSubSubscriptionState.cs:131-144: confirmation clears Pending and schedules renewal before the challenge response reaches the hub. If that response is lost, matching verification retries return 404 because the pending token is gone. The hub cannot activate the subscription, but the application defers another request until renewal, four days later for a five-day lease. Retain recently confirmed topic/token data and accept bounded idempotent retries without repeatedly extending the lease. Cover a retry on another worker after response loss.

4. Prematurely invalidated Twitch tokens remain cached.
   TwitchAppTokenProvider.cs:26-40: a token rejected before its advertised expiry continues to be returned on every reconciliation. Helix 401 responses never invalidate or reacquire it, so polling and subscription repair keep failing until expiry or process restart. On 401, conditionally invalidate the rejected token, obtain a fresh app token, and retry once. Add an early-invalidation regression test.

Medium

5. C# and TypeScript API search controllers interfere after navigation.
   TypeScript module page:662: both languages retain astro:page-load controllers targeting the same pkg-* elements and shared globals. After C# package -> TypeScript module -> C# package navigation, the TypeScript renderer replaces C# search links with non-clickable elements because C# results lack its expected h URL field. Guard initialization with language-specific page/root ownership, including the type/member controllers. This was reproduced by executing the actual controller scripts; add a cross-language navigation regression test.

6. The backend test suites are not executed by CI.
   Aspire.Dev.slnx:9: adding the AppHost test project to the solution does not make the current workflows run it. apphost-build.yml only builds the AppHost; tools-tests.yml only runs the two generator suites. Wire Aspire.Dev.AppHost.Tests and StaticHost.Tests into CI and include their test paths in change detection.

Test coverage

Local runs passed: 33 focused live-infrastructure tests and four AppHost tests after restore/build, plus 46 provider tests using the resulting binaries with --no-build --no-restore. Existing CI checks pass, including desktop/tablet/mobile e2e. The scenarios above lack regression coverage. Mapped live HTTP endpoints and production Redis coordination/synchronizer behavior are not covered by the current tests; coordination tests exercise the in-memory fake. Axe audits omit the videos page and open live picker.

The frontend reproductions were dependency-free simulations, not browser runs. Frontend dependencies were absent, so local Vitest, browser tests, and typechecking were not run. No local frontend build was run.

[David Pine (IEvangelist)]

Mitch Denny (@mitchdenny) Addressed the agreed feedback in cc7b010.

• Preserve the original WCP consent host, runtime, vendor styles, root consent state, and banner offset across client navigation, with navigate-before-consenting coverage.
• Fence YouTube results atomically using provider-specific epoch/revision metadata in Redis. Polling and webhook checks now share offline evidence; stale positive/negative and overlapping same-state results cannot overwrite newer observations.
• Persist recently confirmed WebSub tokens for idempotent cross-worker retries, bounded by the original lease or ten minutes. Retries never extend renewal, and replacement subscriptions invalidate old tokens.
• Conditionally invalidate rejected Twitch tokens and retry every Helix operation once with a fresh token, without discarding concurrent replacements.
• Give all six API search surfaces language/page-owned roots, local index data, and abortable controller/timer lifecycles.
• Run both backend suites and mandatory real-Redis integration coverage in the existing AppHost CI job, with the test directories and solution included in change detection.

Also added mapped HTTP endpoint tests and live videos/open-picker axe and keyboard coverage. Redis tests use an explicit disposable instance and exact-key cleanup, never a shared/default database or database-wide flush.

Local results: 236 StaticHost tests (including 18 against Redis 8.6), 4 AppHost tests, and 107 focused frontend unit tests passed. Consent/live/accessibility coverage passed 62 browser cases across desktop/tablet/mobile, with 7 existing device-specific skips. All 12 API navigation cases passed using native transitions on desktop and the supported ClientRouter swap fallback on touch projects. Native touch emulation surfaced Chromium InvalidStateError transition-capture aborts; those were not hidden by filtering page errors, and the explicit fallback cases still assert preserved JavaScript context and clickable correct-language results.

The repository-wide TypeScript check has existing failures: baseline 187 diagnostics, current 185, with zero newly introduced diagnostics. No local frontend production build was run; the updated commit has triggered CI.