Playwright headless auth bypass not working in Docker — every
approach (addCookies, localStorage injection, /health cookie set)
fails because the SDK boot cycle clears auth state. Park these
jobs until the cookie injection issue is resolved.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
9 code smells from chat gut (dead channels references, stale routes),
migration numbering gaps, and store/workflow/middleware test coverage
gaps identified in April 2026 codebase analysis. Gate for v0.8.x.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Navigating to /login triggers SDK boot which loads stale localStorage
tokens, attempts /auth/refresh (fails with 401), and clears all auth
state including the cookie we just set.
Fix: navigate to /api/v1/health (JSON endpoint, no SPA boot), set
arm_token cookie via document.cookie, then navigate to real surfaces.
The Go page-auth middleware reads the cookie on subsequent requests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Playwright's addCookies (both domain-based and url-based) fails to
send SameSite=Strict cookies in Docker DNS environments. The server
middleware reads arm_token from cookies, but the cookie is originally
set by client-side JS (document.cookie with SameSite=Strict).
New approach: navigate to /login first, then inject the token into
localStorage (key: arm_auth) and set the cookie via document.cookie
in page context — exactly how the real login flow works. This ensures
the cookie attributes match what the server expects.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both test drivers (surface-test-driver.js, e2e-smoke-driver.js) set
the arm_token cookie using domain: hostname, which fails in Docker
where the hostname is a DNS name like "armature". Playwright's
addCookies with a bare domain doesn't reliably match the request
origin in this environment.
Switch to url-based cookie setting which matches the full origin
and works reliably across local and Docker environments. Also wait
for .sw-topbar with waitForSelector instead of immediate DOM check
to handle Preact SPA boot timing.
This fixes the v0.7.2 "Run All button not found" issue — the root
cause was auth redirect to /login, not a rendering problem.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New Playwright-based smoke test that visits every installed surface
and asserts: shell topbar renders, no JS console errors, home link
exists. Captures full-page screenshot + console log on failure.
Baseline screenshots captured for all surfaces (informational).
Follows the existing surface-test-driver.js/run-surface-tests.sh
pattern: shell script authenticates, Node driver navigates.
New files:
- ci/e2e-smoke-test.sh — auth + invoke driver
- ci/e2e-smoke-driver.js — Playwright navigation assertions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three bugs in path-based CI gating:
- VERSION and scripts/* triggered frontend+backend tests unnecessarily;
now classified as deploy-only (scripts/db-* still matches as BE)
- docs-only changes skipped build-and-deploy, but docs are served
in-app by the Docs surface — every change needs a deploy
- Updated path gating comment block and pipeline header to match
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
