feat: add URL-driven workspace state and streamed Codex research

e2e/integrations/access.test.ts

@@ -1,63 +1,53 @@
-import { expect, test } from '../fixtures'
+import { expect, test } from "../fixtures";
 
-test('owner can open the app but missing or foreign identity is forbidden', async ({
-  request,
-}) => {
-  expect((await request.get('/')).status()).toBe(200)
+test("owner can open the app but missing or foreign identity is forbidden", async ({ request }) => {
+  expect((await request.get("/")).status()).toBe(200);
+  expect((await request.get("/", { headers: { "Tailscale-User-Login": "" } })).status()).toBe(403);
   expect(
     (
-      await request.get('/', { headers: { 'Tailscale-User-Login': '' } })
-    ).status(),
-  ).toBe(403)
-  expect(
-    (
-      await request.get('/', {
-        headers: { 'Tailscale-User-Login': '[email protected]' },
+      await request.get("/", {
+        headers: { "Tailscale-User-Login": "[email protected]" },
       })
     ).status(),
-  ).toBe(403)
-})
+  ).toBe(403);
+});
 
-test('mutations require exact Origin even with same-origin Fetch Metadata', async ({
-  request,
-}) => {
-  expect((await request.post('/')).status()).toBe(403)
+test("mutations require exact Origin even with same-origin Fetch Metadata", async ({ request }) => {
+  expect((await request.post("/")).status()).toBe(403);
   expect(
     (
-      await request.post('/', {
+      await request.post("/", {
         headers: {
-          Origin: 'https://other.invalid',
-          'Sec-Fetch-Site': 'same-origin',
+          Origin: "https://other.invalid",
+          "Sec-Fetch-Site": "same-origin",
         },
       })
     ).status(),
-  ).toBe(403)
-})
+  ).toBe(403);
+});
 
-test('server functions also reject foreign identity and cross-site calls', async ({
+test("server functions also reject foreign identity and cross-site calls", async ({
   page,
   request,
 }) => {
-  const serverRequest = page.waitForRequest((request) =>
-    request.url().includes('/_serverFn/'),
-  )
-  await page.goto('/deck')
-  const url = (await serverRequest).url()
+  const serverRequest = page.waitForRequest((request) => request.url().includes("/_serverFn/"));
+  await page.goto("/deck");
+  const url = (await serverRequest).url();
   expect(
     (
       await request.get(url, {
         headers: {
-          'Tailscale-User-Login': '[email protected]',
-          'Sec-Fetch-Site': 'same-origin',
+          "Tailscale-User-Login": "[email protected]",
+          "Sec-Fetch-Site": "same-origin",
         },
       })
     ).status(),
-  ).toBe(403)
+  ).toBe(403);
   expect(
     (
       await request.get(url, {
-        headers: { 'Sec-Fetch-Site': 'cross-site' },
+        headers: { "Sec-Fetch-Site": "cross-site" },
       })
     ).status(),
-  ).toBe(403)
-})
+  ).toBe(403);
+});