From a3b63a3236877e0d3a4cc9cd0c4200fae92cf9d2 Mon Sep 17 00:00:00 2001 From: "Anthony Fu (via agent)" Date: Tue, 21 Jul 2026 07:19:06 +0000 Subject: [PATCH] fix(e2e): opt dev server out of the OTP auth handshake for automation devframe v0.7.5 gates RPC calls behind an interactive one-time-code handshake by default. The e2e dev-mode server has no way to complete that handshake headlessly, so every RPC call (including the initial payload fetch) was rejected with DF0036, failing dev.spec.ts. Add a --auth/--no-auth flag to the dev command (mirroring devframe's own --no-auth convention) and use it from the e2e orchestrator. --- packages/node-modules-inspector/src/node/cli.ts | 5 +++++ test/e2e/utils/orchestrate.mjs | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/packages/node-modules-inspector/src/node/cli.ts b/packages/node-modules-inspector/src/node/cli.ts index f8cfbb06..e2b4408b 100644 --- a/packages/node-modules-inspector/src/node/cli.ts +++ b/packages/node-modules-inspector/src/node/cli.ts @@ -118,6 +118,7 @@ cli .option('--host ', 'Host', { default: process.env.HOST || '127.0.0.1' }) .option('--port ', 'Port', { default: process.env.PORT || 9999 }) .option('--open', 'Open browser', { default: true }) + .option('--auth', 'Require the one-time-code auth handshake before RPC calls', { default: true }) .action(async (options) => { const host = options.host const port = await resolveDevServerPort(devframe, { @@ -135,6 +136,10 @@ cli root: options.root, config: options.config, depth: Number(options.depth), + // Forwarded to createDevServer's own auth resolution (not consumed by + // devframe.setup) — `--no-auth` opts out of the interactive OTP gate + // for trusted automation (e.g. the e2e suite driving a headless browser). + auth: options.auth, }, openBrowser: options.open ? url : false, }) diff --git a/test/e2e/utils/orchestrate.mjs b/test/e2e/utils/orchestrate.mjs index 2ba934d1..bac3d1c6 100644 --- a/test/e2e/utils/orchestrate.mjs +++ b/test/e2e/utils/orchestrate.mjs @@ -144,7 +144,11 @@ async function startServers() { start( 'dev', 'node', - ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open'], + // `--no-auth` skips devframe's interactive OTP handshake — a headless + // Playwright browser can't complete the "open the printed magic link" + // step, and the RPC calls the SPA makes on load would otherwise be + // rejected as untrusted (DF0036). + ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open', '--no-auth'], ) start( 'build',