Navigating to /login triggers SDK boot which loads stale localStorage
tokens, attempts /auth/refresh (fails with 401), and clears all auth
state including the cookie we just set.
Fix: navigate to /api/v1/health (JSON endpoint, no SPA boot), set
arm_token cookie via document.cookie, then navigate to real surfaces.
The Go page-auth middleware reads the cookie on subsequent requests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Playwright's addCookies (both domain-based and url-based) fails to
send SameSite=Strict cookies in Docker DNS environments. The server
middleware reads arm_token from cookies, but the cookie is originally
set by client-side JS (document.cookie with SameSite=Strict).
New approach: navigate to /login first, then inject the token into
localStorage (key: arm_auth) and set the cookie via document.cookie
in page context — exactly how the real login flow works. This ensures
the cookie attributes match what the server expects.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both test drivers (surface-test-driver.js, e2e-smoke-driver.js) set
the arm_token cookie using domain: hostname, which fails in Docker
where the hostname is a DNS name like "armature". Playwright's
addCookies with a bare domain doesn't reliably match the request
origin in this environment.
Switch to url-based cookie setting which matches the full origin
and works reliably across local and Docker environments. Also wait
for .sw-topbar with waitForSelector instead of immediate DOM check
to handle Preact SPA boot timing.
This fixes the v0.7.2 "Run All button not found" issue — the root
cause was auth redirect to /login, not a rendering problem.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
