@sleep2agi/agent-network-dashboard 0.6.3-preview.51 → 0.6.3-preview.53

package/tests/e2e-messages-spec-visual-align.spec.ts

@@ -0,0 +1,244 @@
+import { test, expect, Page, BrowserContext } from '@playwright/test';
+
+// /messages visual-alignment guardrail — pins the numbers that SPEC.md
+// §2/§5/§6 dictate for the chat area.
+//
+// Method (per 07-31 通信龙 判据 "断言事实，不是声明"):
+//   values are read from getComputedStyle() on the real rendered DOM,
+//   NOT from any data-* attribute that would just restate the class
+//   value. If the visual token drifts, the number drifts, the assertion
+//   goes red — assertion side is same-source with reality (the browser's
+//   computed style), not with the declaration (the Tailwind class).
+//
+// Witnessed-red discipline (per 07-31 通信龙 判据 "一条一条打，不是整体打"):
+//   each assertion is its own `test(...)` block so witnessed-red on any
+//   ONE token (revert only that class, re-run) turns exactly ONE test
+//   red. If reverting shell bg turned two assertions red, that would
+//   prove they're coupled — not each guarding its own thing.
+
+const BASE = process.env.TEST_URL || 'http://localhost:3200';
+
+const MOCK_MESSAGES = {
+  messages: [
+    // First bubble in the list — outgoing task alpha→beta, so bubble
+    // background hits the SPEC #1E3A5F "self" color.
+    {
+      id: 'm1',
+      type: 'task',
+      from_alias: 'alpha',
+      to_alias: 'beta',
+      priority: 'normal',
+      content: 'ALPHA_TO_BETA_BODY',
+      created_at: '2026-07-31 12:00:00',
+      task_id: 't1',
+    },
+    // Second — incoming reply from beta→alpha, so we can also probe
+    // the SPEC #1E293B "other" color separately.
+    {
+      id: 'm2',
+      type: 'reply',
+      from_alias: 'beta',
+      to_alias: 'alpha',
+      priority: 'normal',
+      content: 'BETA_TO_ALPHA_BODY',
+      created_at: '2026-07-31 12:00:05',
+    },
+    // Third — broadcast, verifies the SPEC §5 "left 2px accent bar"
+    // pattern that we reused for broadcast distinction.
+    {
+      id: 'm3',
+      type: 'broadcast',
+      from_alias: 'admin',
+      priority: 'high',
+      content: 'BROADCAST_BODY',
+      created_at: '2026-07-31 12:00:10',
+    },
+  ],
+};
+
+// Rate-limit avoidance (10/15min/IP): one login per worker, reuse the
+// cookie across all tests in this file. With --workers=1 the module
+// var is truly shared. If the first login gets 429 (limit exhausted),
+// throw immediately — otherwise every subsequent test would re-attempt
+// and burn budget further while all failing the same way.
+let cachedSessionCookie: string | null = null;
+let loginErr: Error | null = null;
+async function login(context: BrowserContext) {
+  if (loginErr) throw loginErr;
+  if (!cachedSessionCookie) {
+    const res = await context.request.post(`${BASE}/api/auth/login`, {
+      data: { password: process.env.ANET_DASHBOARD_PASSWORD || 'admin123' },
+    });
+    if (res.status() === 429) {
+      loginErr = new Error(
+        'Login rate-limited (10/15min). Restart dev to clear the counter.',
+      );
+      throw loginErr;
+    }
+    // playwright merges multi-value headers with newlines in headers();
+    // set-cookie is often multi-value so parse from headersArray instead.
+    const headers = res.headersArray();
+    const cookies = headers.filter((h) => h.name.toLowerCase() === 'set-cookie');
+    for (const c of cookies) {
+      const m = c.value.match(/anet_dashboard_session=([^;]+)/);
+      if (m) {
+        cachedSessionCookie = decodeURIComponent(m[1]);
+        break;
+      }
+    }
+    if (!cachedSessionCookie) {
+      loginErr = new Error(
+        `login 200 but no anet_dashboard_session cookie in headers: ${JSON.stringify(cookies)}`,
+      );
+      throw loginErr;
+    }
+  }
+  await context.addCookies([
+    {
+      name: 'anet_dashboard_session',
+      value: cachedSessionCookie,
+      domain: new URL(BASE).hostname,
+      path: '/',
+    },
+  ]);
+}
+
+async function mockAll(page: Page) {
+  await page.route('**/api/hub/messages**', (r) =>
+    r.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify(MOCK_MESSAGES),
+    }),
+  );
+  await page.route('**/api/hub/status**', (r) =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: '{"sessions":[]}' }),
+  );
+  await page.route('**/api/hub/nodes**', (r) =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: '{"nodes":[]}' }),
+  );
+  await page.route('**/api/hub/health', (r) =>
+    r.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: '{"ok":true,"sse_sessions":{}}',
+    }),
+  );
+}
+
+async function gotoMessages(page: Page) {
+  await login(page.context());
+  await mockAll(page);
+  await page.setViewportSize({ width: 1440, height: 900 });
+  await page.goto(`${BASE}/messages`, { waitUntil: 'domcontentloaded' });
+  // Wait for the actual mocked message content — NOT just any
+  // rounded-2xl, because the loading skeleton is also rounded-2xl
+  // (h-20 rounded-2xl bg-gray-800/20). Waiting for the literal
+  // mock body text pins that SWR has settled and rendered.
+  // See feedback_checker_scope_bug_vacuous_pass.md.
+  await page.waitForFunction(
+    () => document.body.textContent?.includes('ALPHA_TO_BETA_BODY') || false,
+    undefined,
+    // Turbopack sometimes rebuilds after a source edit — first mount
+    // can take 10-20s. Give the ceiling headroom for CI-cold dev servers.
+    { timeout: 25_000 },
+  );
+}
+
+// Read computedStyle from the bubble that contains a known mock text.
+// Text-anchored so the query is stable against other rounded-2xl chrome
+// (headers, nav, etc.) — and independent of DOM ordering.
+async function bubbleStyleByContent(page: Page, needle: string) {
+  return await page.evaluate((n) => {
+    const bubbles = Array.from(document.querySelectorAll('div.rounded-2xl'));
+    const bubble = bubbles.find(
+      (el) =>
+        (el.textContent || '').includes(n) &&
+        Array.from(el.classList).some((c) => c.startsWith('bg-')),
+    );
+    if (!bubble) return null;
+    const cs = getComputedStyle(bubble);
+    return {
+      maxWidth: cs.maxWidth,
+      backgroundColor: cs.backgroundColor,
+      borderLeftColor: cs.borderLeftColor,
+      borderLeftWidth: cs.borderLeftWidth,
+    };
+  }, needle);
+}
+
+async function broadcastBubbleStyle(page: Page) {
+  return bubbleStyleByContent(page, 'BROADCAST_BODY');
+}
+
+test.describe('/messages · SPEC visual alignment', () => {
+  // ── 1. SHELL BG · SPEC §2 chat area #141826 ──────────────────
+  test('shell bg is SPEC #141826 (rgb 20,24,38)', async ({ page }) => {
+    await gotoMessages(page);
+    const bg = await page.evaluate(() => {
+      const shell = document.querySelector('[data-testid="messages-shell"]');
+      if (!shell) return null;
+      return getComputedStyle(shell).backgroundColor;
+    });
+    // #141826 rendered as computed rgb(20, 24, 38) by every browser.
+    expect(bg).toBe('rgb(20, 24, 38)');
+  });
+
+  // ── 2. BUBBLE MAX-WIDTH · SPEC §5 min(640px, 65%) ───────────
+  test('bubble max-width is SPEC min(640px, 65%)', async ({ page }) => {
+    await gotoMessages(page);
+    // Non-broadcast bubble — mock m1 body "ALPHA_TO_BETA_BODY".
+    const s = await bubbleStyleByContent(page, 'ALPHA_TO_BETA_BODY');
+    expect(s).not.toBeNull();
+    // Browser normalizes without spaces around the comma.
+    expect(s!.maxWidth).toBe('min(640px, 65%)');
+  });
+
+  // ── 3. BUBBLE BG · SPEC §6 tokens (either #1E3A5F self or #1E293B other) ──
+  test('bubble bg is one of the SPEC bubble tokens', async ({ page }) => {
+    await gotoMessages(page);
+    // Non-broadcast bubble — mock m1 body "ALPHA_TO_BETA_BODY".
+    const s = await bubbleStyleByContent(page, 'ALPHA_TO_BETA_BODY');
+    expect(s).not.toBeNull();
+    // Accept-set = exactly the SPEC-defined bubble bg tokens; NOT a
+    // shape match, NOT "any dark color" (see
+    // feedback_tolerant_assertion_accepts_noncompliance.md +
+    // feedback_allowlist_must_be_exact_value_not_shape_match.md).
+    expect(['rgb(30, 41, 59)', 'rgb(30, 58, 95)']).toContain(s!.backgroundColor);
+  });
+
+  // ── 4. BROADCAST · SPEC §5 left 2px accent bar #7DD3FC ──────
+  test('broadcast bubble has 2px left accent bar (#7DD3FC)', async ({ page }) => {
+    await gotoMessages(page);
+    const s = await broadcastBubbleStyle(page);
+    expect(s).not.toBeNull();
+    // #1E293B = the "other" bubble token — broadcast is not self.
+    expect(s!.backgroundColor).toBe('rgb(30, 41, 59)');
+    // 2px accent bar in SPEC accent color #7DD3FC = rgb(125, 211, 252).
+    expect(s!.borderLeftWidth).toBe('2px');
+    expect(s!.borderLeftColor).toBe('rgb(125, 211, 252)');
+  });
+
+  // ── 5. TIMESTAMP · SPEC §5 11px / #64748B ───────────────────
+  test('timestamp is 11px in SPEC #64748B', async ({ page }) => {
+    await gotoMessages(page);
+    // The timestamp span sits at the end of each bubble header — pinned
+    // by its ml-auto + text-[11px] combo. Query by containing formatted
+    // time text ("ago" wording from timeAgo). We assert on ANY such
+    // span — pipeline gives us multiple.
+    const stamp = await page.evaluate(() => {
+      const spans = Array.from(document.querySelectorAll('span'));
+      // Pick the first span whose Tailwind class list includes the
+      // 11px arbitrary utility. That class is set only by the
+      // timestamp render sites we changed.
+      const el = spans.find((s) => s.className.includes('text-[11px]'));
+      if (!el) return null;
+      const cs = getComputedStyle(el);
+      return { fontSize: cs.fontSize, color: cs.color };
+    });
+    expect(stamp).not.toBeNull();
+    expect(stamp!.fontSize).toBe('11px');
+    // #64748B rendered as rgb(100, 116, 139).
+    expect(stamp!.color).toBe('rgb(100, 116, 139)');
+  });
+});

package/tests/e2e-pin-mute-attr-always-present.spec.ts

@@ -0,0 +1,171 @@
+import { test, expect, Page } from '@playwright/test';
+
+const BASE = process.env.TEST_URL || 'http://localhost:3100';
+
+// 通信龙 07-31: attribute-always-present guarantee for pin/mute.
+//
+// The wire that USED to emit `data-node-pinned="true" | undefined` made a
+// gate script that counts "rows with the attribute" indistinguishable
+// from a wire that was ripped out — both looked like zero. This spec
+// enforces the new invariant AND proves the attribute tracks real state
+// (not a hardcoded literal that would also pass the capability check).
+//
+// TWO assertions, both required:
+//   (A) capability   — every rail row emits data-node-pinned AND
+//                      data-node-muted, and the value is 'true' | 'false'
+//                      (never absent, never something else). If a future
+//                      refactor drops the emit, THIS reds.
+//   (B) real state   — toggling pin on one row flips ITS attribute from
+//                      'false' to 'true' — and leaves the others alone.
+//                      If someone hardcodes both to 'false' (would pass
+//                      A), THIS reds. Same shape for muted.
+//
+// Rate-limit guard (10 logins / 15min / IP): per-worker cachedCookie
+// (same as e2e-batch-list-actions.spec.ts).
+
+let cachedCookie: string | undefined;
+
+async function login(context: Page['context'] extends () => infer C ? C : never) {
+  if (cachedCookie) {
+    await context.addCookies([{
+      name: 'anet_dashboard_session',
+      value: cachedCookie,
+      domain: new URL(BASE).hostname,
+      path: '/',
+    }]);
+    return;
+  }
+  const res = await context.request.post(`${BASE}/api/auth/login`, {
+    data: { password: process.env.ANET_DASHBOARD_PASSWORD || 'admin123' },
+  });
+  const setCookie = res.headers()['set-cookie'] || '';
+  const m = setCookie.match(/anet_dashboard_session=([^;]+)/);
+  if (m) {
+    cachedCookie = decodeURIComponent(m[1]);
+    await context.addCookies([{
+      name: 'anet_dashboard_session',
+      value: cachedCookie,
+      domain: new URL(BASE).hostname,
+      path: '/',
+    }]);
+  }
+}
+
+const FIXTURE_SESSIONS = {
+  sessions: [
+    { alias: 'node-alpha', status: 'idle', network_id: 'net_x' },
+    { alias: 'node-beta',  status: 'idle', network_id: 'net_x' },
+    { alias: 'node-gamma', status: 'idle', network_id: 'net_x' },
+  ],
+};
+const FIXTURE_NODES = {
+  nodes: [
+    { alias: 'node-alpha', node_id: 'n_alpha', team: null, tags: [], attrs_revision: 0 },
+    { alias: 'node-beta',  node_id: 'n_beta',  team: null, tags: [], attrs_revision: 0 },
+    { alias: 'node-gamma', node_id: 'n_gamma', team: null, tags: [], attrs_revision: 0 },
+  ],
+};
+
+async function stubHub(page: Page) {
+  await page.route('**/api/hub/status**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify(FIXTURE_SESSIONS) }));
+  await page.route('**/api/hub/nodes**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify(FIXTURE_NODES) }));
+  await page.route('**/api/hub/networks**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ networks: [{ network_id: 'net_x', network_name: 'net_x' }] }) }));
+  await page.route('**/api/hub/health', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ ok: true, version: '0.9.0-test', sse_connections: 0, sse_sessions: {} }) }));
+  await page.route('**/api/hub/tasks**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ tasks: [] }) }));
+  await page.route('**/api/hub/stats**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({}) }));
+  await page.route('**/api/hub/messages**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ messages: [] }) }));
+  await page.route('**/api/hub/events**', r =>
+    r.fulfill({ status: 200, contentType: 'text/event-stream', body: '' }));
+  await page.route('**/api/anet/node-config**', r =>
+    r.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ model: '', flags: {}, channels: [], config_revision: 0 }) }));
+}
+
+test.describe('Pin/mute attr — always present + tracks real state', () => {
+  test('every rail row emits data-node-pinned AND data-node-muted with value ∈ {true,false}', async ({ page, context }) => {
+    await login(context);
+    await stubHub(page);
+    // Ensure no leftover state from prior runs would tint the "false"
+    // starting point — clear both storage keys before navigating.
+    await page.addInitScript(() => {
+      try { window.localStorage.removeItem('anet_chat_pin_v1'); } catch {}
+      try { window.localStorage.removeItem('anet_chat_mute_v1'); } catch {}
+    });
+    await page.goto(`${BASE}/nodes/node-alpha`);
+    await expect(page.locator('[data-node-list-alias="node-alpha"]').first()).toBeVisible({ timeout: 15000 });
+
+    const rows = page.locator('[data-node-list-item]');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(3); // premise: fixture landed
+
+    const pinnedVals: string[] = [];
+    const mutedVals: string[] = [];
+    for (let i = 0; i < count; i++) {
+      const row = rows.nth(i);
+      const pin = await row.getAttribute('data-node-pinned');
+      const mute = await row.getAttribute('data-node-muted');
+      pinnedVals.push(pin ?? '__ABSENT__');
+      mutedVals.push(mute ?? '__ABSENT__');
+    }
+    // Report cardinality alongside failure — if this reds, we want to
+    // see whether N of N were absent (wire ripped) vs 1 of N was 'foo'
+    // (someone typo'd the emit).
+    for (const v of pinnedVals) {
+      expect(v, `pinned attr values across ${count} rows: ${JSON.stringify(pinnedVals)}`)
+        .toMatch(/^(true|false)$/);
+    }
+    for (const v of mutedVals) {
+      expect(v, `muted attr values across ${count} rows: ${JSON.stringify(mutedVals)}`)
+        .toMatch(/^(true|false)$/);
+    }
+  });
+
+  test('toggling pin on node-beta flips its data-node-pinned from false to true (others unchanged)', async ({ page, context }) => {
+    await login(context);
+    await stubHub(page);
+    await page.addInitScript(() => {
+      try { window.localStorage.removeItem('anet_chat_pin_v1'); } catch {}
+      try { window.localStorage.removeItem('anet_chat_mute_v1'); } catch {}
+    });
+    await page.goto(`${BASE}/nodes/node-alpha`);
+    await expect(page.locator('[data-node-list-alias="node-beta"]').first()).toBeVisible({ timeout: 15000 });
+
+    // Baseline — all three rows read 'false' on pinned.
+    // This is the PREMISE, not the conclusion — if the fixture happens
+    // to have someone already pinned, the toggle would flip 'true' →
+    // 'false' and the conclusion assert reverses direction. Assert
+    // premise first to catch that.
+    const alphaBefore = await page.locator('[data-node-list-alias="node-alpha"]').getAttribute('data-node-pinned');
+    const betaBefore = await page.locator('[data-node-list-alias="node-beta"]').getAttribute('data-node-pinned');
+    const gammaBefore = await page.locator('[data-node-list-alias="node-gamma"]').getAttribute('data-node-pinned');
+    expect(alphaBefore).toBe('false');
+    expect(betaBefore).toBe('false');
+    expect(gammaBefore).toBe('false');
+
+    // Toggle pin on node-beta via the context menu (real user path —
+    // togglePin from ../lib/chat-pin). Right-click → ctx-pin.
+    await page.locator('[data-node-list-alias="node-beta"]').click({ button: 'right' });
+    await expect(page.locator('[data-testid="node-context-menu"]')).toBeVisible({ timeout: 3000 });
+    await page.locator('[data-testid="ctx-pin"]').click();
+    // Storage event → useSyncExternalStore rerender — allow a tick.
+    await page.waitForTimeout(200);
+
+    // 🔴 Core: node-beta flipped from 'false' → 'true'. If the attribute
+    // were hardcoded to the literal 'false' (which would pass the
+    // capability test above), THIS reds precisely.
+    const alphaAfter = await page.locator('[data-node-list-alias="node-alpha"]').getAttribute('data-node-pinned');
+    const betaAfter = await page.locator('[data-node-list-alias="node-beta"]').getAttribute('data-node-pinned');
+    const gammaAfter = await page.locator('[data-node-list-alias="node-gamma"]').getAttribute('data-node-pinned');
+    expect(betaAfter).toBe('true');
+    // Others must NOT have changed — sanity that the toggle scoped to
+    // the right alias (not e.g. accidentally pinning every row).
+    expect(alphaAfter).toBe('false');
+    expect(gammaAfter).toBe('false');
+  });
+});

package/tests/e2e-proxy-auth-boundary.spec.ts

@@ -0,0 +1,196 @@
+import { test, expect, APIRequestContext } from '@playwright/test';
+
+const BASE = process.env.TEST_URL || 'http://localhost:3100';
+
+// 07-31 通信龙 catch — proxy.ts:22 matcher was missing `/nodes/:path*`.
+// A no-cookie GET to `/nodes/<alias>` returned 200 with the full 36KB
+// page shell, while every other matcher entry correctly returned
+// 307 → /login.
+//
+// What this test verifies — and doesn't:
+//
+// This spec proves the ROUTE GATE (proxy.ts) redirects no-cookie
+// requests. It does NOT prove authentication: `request.cookies.has()`
+// checks presence only, so any garbage cookie value passes the gate.
+// Real authentication is in /api/hub which validates the token
+// contents when the page tries to fetch. See proxy.ts top comment
+// for the full framing.
+//
+// The class of bug caught here: a matcher-list slip letting a
+// dynamic-child route bypass the "no cookie → /login" bounce and
+// serve page bytes to a visitor who has no cookie at all. Today
+// /nodes/[alias] doesn't do a server-side data fetch (通信龙
+// confirmed with a nonexistent alias — 200 + 36108 bytes, page
+// echoes the alias but hits no DB), so no rows leak. Structural,
+// not sensitive; leaks the moment the page grows a server-side
+// fetch that uses its own credentials.
+//
+// The enumeration IS the contract: if you add a new page route
+// with a dynamic child, add its :path* variant to proxy.ts AND
+// add a representative case to CASES here.
+//
+// Uses playwright.request.newContext (no browser, no cookie state).
+// maxRedirects:0 so we see the 307 directly instead of following it.
+
+const CASES: Array<{ path: string; label: string }> = [
+  // Static pages in matcher.
+  { path: '/',         label: 'root landing' },
+  { path: '/node',     label: 'legacy /node singular' },
+  { path: '/tasks',    label: '/tasks index' },
+  { path: '/nodes',    label: '/nodes index' },
+  { path: '/messages', label: '/messages page' },
+  { path: '/logs',     label: '/logs page' },
+  { path: '/settings', label: '/settings index' },
+  { path: '/admin',    label: '/admin page' },
+
+  // Dynamic-child variants — one representative alias per, to prove
+  // the `/:path*` glob catches typical values (unicode alias, hex id,
+  // slugish segment). If a new dynamic route is added upstream,
+  // ADD IT HERE too — the enumeration IS the contract.
+  { path: '/nodes/node-alpha',   label: '/nodes/<alias> ascii  ← 07-31 regression case' },
+  { path: '/nodes/%E6%94%AF%E4%BB%98%E5%8A%A9%E6%89%8B', label: '/nodes/<支付助手> unicode  ← prod-observed alias shape' },
+  { path: '/tasks/abc123',       label: '/tasks/<id> hex' },
+  { path: '/settings/general',   label: '/settings/<subroute>' },
+];
+
+async function assertRedirectsToLogin(request: APIRequestContext, path: string, label: string) {
+  const res = await request.get(`${BASE}${path}`, {
+    // Do NOT follow the redirect — we want to see the 307 itself.
+    maxRedirects: 0,
+  });
+  const status = res.status();
+  const location = res.headers()['location'] || '';
+  const bodyLen = (await res.body()).length;
+
+  // Bundle both attributes in one assertion so we always see BOTH
+  // when it fails — not "status wrong" then discover on next line
+  // that location was also wrong. Message spells out the request so
+  // a red doesn't force digging into locators.
+  const actual = { status, location, bodyLen };
+  void actual;  // referenced in the assertion below; explicit for readers
+  expect({ status, location }, `${label} (${path}) — no-cookie GET must 307 → /login`).toMatchObject({
+    status: 307,
+    location: expect.stringMatching(/\/login/),
+  });
+
+  // Extra floor: a redirect response body is basically empty
+  // (browsers ignore it). If bodyLen > 1024, the server is likely
+  // rendering the page anyway and only "suggesting" a redirect via
+  // a soft mechanism, which is not what proxy.ts is doing here —
+  // that would still be a security regression.
+  expect(bodyLen, `${label} redirect body should be small (<1KB), got ${bodyLen}B`).toBeLessThan(1024);
+}
+
+test.describe('proxy.ts cookie-presence gate — no-cookie access redirects to /login', () => {
+  test('every matcher-covered path redirects a no-cookie GET to /login (fresh cookieless request context)', async ({ playwright }) => {
+    // Fresh, cookie-less request context. Not `page`/`context` from
+    // the test fixture, which may have accumulated cookies via test
+    // parallelism or a prior test in this session.
+    const request = await playwright.request.newContext({
+      baseURL: BASE,
+      // Explicitly no storageState → no cookies. This is the whole
+      // premise of the test.
+    });
+    try {
+      // Sanity — verify the request context has no cookie. If a
+      // stray cookie somehow leaks in, our redirects would all
+      // become 200 and the loop would falsely pass. Check /nodes
+      // first (a matcher-covered path) and confirm 307 before
+      // running the enumeration.
+      const sanity = await request.get(`${BASE}/nodes`, { maxRedirects: 0 });
+      expect(sanity.status(), 'sanity: bare /nodes must 307 with no cookie (else test context has stray cookies)').toBe(307);
+
+      for (const c of CASES) {
+        await assertRedirectsToLogin(request, c.path, c.label);
+      }
+    } finally {
+      await request.dispose();
+    }
+  });
+
+  test('positive direction: with ANY cookie value, matcher-covered routes are NOT 307 (gate lets them through — else we broke logged-in users)', async ({ playwright }) => {
+    // Reviewer's ask: the previous two tests only prove "no cookie
+    // → gate redirects". A matcher like ['/(.*)'] would also make
+    // those pass — while breaking every logged-in flow. This test
+    // is the other direction of the two-direction discipline
+    // (feedback_verify_both_directions_with_real_data): the gate
+    // must LET THROUGH requests that hold the cookie.
+    //
+    // We assert "NOT 307" (not "== 200") deliberately. The gate is
+    // upstream of page rendering — proving the redirect doesn't
+    // fire is proving the gate let it pass. Whether the page then
+    // renders 200 or 500 or 404 depends on backend state / dev
+    // hardlink quirks / route existence — none of which is this
+    // gate's job. Assert only what THIS layer controls.
+    //
+    // Cookie value here is INTENTIONALLY garbage — same as the
+    // baseline 通信龙 established:
+    //   Cookie: anet_dashboard_session=complete_garbage_xyz  → 200
+    // "Has cookie" is the gate's whole judgment; value doesn't
+    // matter to it. Using a garbage value here also documents that
+    // fact in the test itself.
+    const request = await playwright.request.newContext({
+      baseURL: BASE,
+      extraHTTPHeaders: {
+        cookie: 'anet_dashboard_session=audit-probe-not-a-real-token',
+      },
+    });
+    try {
+      // Sanity — the cookie header we set is actually attached.
+      // If Playwright drops it (e.g. domain mismatch), every "not
+      // 307" assertion below would false-pass on a redirect that
+      // actually shouldn't happen. So: hit /login (NOT in matcher)
+      // with the cookie, expect 307 → / (session redirects logged-
+      // in users away from login) OR 200 (the login page itself).
+      // Actually cleanest sanity: hit / with cookie and expect
+      // NOT 307-to-/login — same shape as the assertions below.
+      const sanity = await request.get(`${BASE}/`, { maxRedirects: 0 });
+      const sanityLoc = sanity.headers()['location'] || '';
+      expect(
+        !(sanity.status() === 307 && sanityLoc.includes('/login')),
+        `sanity: bare / with cookie must NOT redirect to /login (got ${sanity.status()} → ${sanityLoc}). If it did, the cookie header did not attach and the loop below is meaningless.`,
+      ).toBe(true);
+
+      for (const c of CASES) {
+        const res = await request.get(`${BASE}${c.path}`, { maxRedirects: 0 });
+        const status = res.status();
+        const location = res.headers()['location'] || '';
+        // "NOT 307 → /login" — either any status other than 307,
+        // OR 307 that redirects somewhere other than /login (unlikely
+        // but not our concern; a 307 → /foo isn't proxy.ts kicking
+        // the user out).
+        const bouncedByGate = status === 307 && location.includes('/login');
+        expect(
+          bouncedByGate,
+          `${c.label} (${c.path}) — with cookie MUST NOT be gate-redirected. Got ${status} → ${location || '(no location)'}. This means proxy.ts is rejecting cookie-holders — the matcher is over-broad or the has() check is inverted.`,
+        ).toBe(false);
+      }
+    } finally {
+      await request.dispose();
+    }
+  });
+
+  test('🔴 07-31 regression: no-cookie /nodes/<alias> MUST redirect (this was reachable in prod v52)', async ({ playwright }) => {
+    // Standalone version of the specific case that broke, so a red
+    // here anchors the historical incident. If someone loosens the
+    // matcher again, this test names the exact prod URL that broke.
+    const request = await playwright.request.newContext({ baseURL: BASE });
+    try {
+      const res = await request.get(`${BASE}/nodes/node-alpha`, { maxRedirects: 0 });
+      const status = res.status();
+      const location = res.headers()['location'] || '';
+      const bodyLen = (await res.body()).length;
+      expect({ status, location, bodyLen }).toMatchObject({
+        status: 307,
+        location: expect.stringMatching(/\/login/),
+      });
+      // Pre-fix behavior: status 200, bodyLen ~= 36000. Assert an
+      // upper floor as belt-and-suspenders (the toMatchObject above
+      // catches the primary status miss; this catches "someone made
+      // proxy.ts return a soft redirect with a full-body page").
+      expect(bodyLen).toBeLessThan(1024);
+    } finally {
+      await request.dispose();
+    }
+  });
+});

package/tests/e2e-stage-a-node-list.spec.ts

@@ -40,16 +40,23 @@ const HUB_HEALTH = {
   },
 };
 
+// Login rate limit is 10/15min/IP (app/lib/rate-limit.ts): with 4 spec
+// files in one combined run, per-test logins blow the budget and late
+// tests land on the sign-in page (false red). Login once per worker.
+let cachedSessionCookie: string | null = null;
 async function login(context: Page['context'] extends () => infer C ? C : never) {
-  const res = await context.request.post(`${BASE}/api/auth/login`, {
-    data: { password: process.env.ANET_DASHBOARD_PASSWORD || 'admin123' },
-  });
-  const setCookie = res.headers()['set-cookie'] || '';
-  const m = setCookie.match(/anet_dashboard_session=([^;]+)/);
-  if (m) {
+  if (!cachedSessionCookie) {
+    const res = await context.request.post(`${BASE}/api/auth/login`, {
+      data: { password: process.env.ANET_DASHBOARD_PASSWORD || 'admin123' },
+    });
+    const setCookie = res.headers()['set-cookie'] || '';
+    const m = setCookie.match(/anet_dashboard_session=([^;]+)/);
+    if (m) cachedSessionCookie = decodeURIComponent(m[1]);
+  }
+  if (cachedSessionCookie) {
     await context.addCookies([{
       name: 'anet_dashboard_session',
-      value: decodeURIComponent(m[1]),
+      value: cachedSessionCookie,
       domain: new URL(BASE).hostname,
       path: '/',
     }]);