Tests: exercise automatic browser access instead of URL tokens

tests/e2e/ask-home.spec.js

@@ -311,7 +311,7 @@ test('Ask controls and Home remain accessible at a narrow width', async ({ page
 });
 
 test('a real pending source leaves the Home review inbox after governed approval', async ({ page }) => {
-  await page.goto('/?view=manage#token=engraphis-playwright-local-only');
+  await page.goto('/?view=manage');
   await expect(page.locator('#connection-status')).toContainText('Local engine connected');
   await page.locator('#create-workspace-toggle').click();
   await page.locator('#new-workspace-name').fill('home-review-' + Date.now());

tests/e2e/history-project.spec.js

@@ -29,7 +29,7 @@ async function historyFixture(page) {
     repo: 'beta', content: 'Beta has a separate lineage claim.', dedupe: false,
     metadata: { corrects: alpha.id },
   });
-  await page.goto('/?workspace=' + workspace + '&view=library#token=' + token);
+  await page.goto('/?workspace=' + workspace + '&view=library');
   await expect(page.locator('#workspace-select')).toHaveValue(workspace);
   await expect(page.locator('#project-select')).toBeEnabled();
   await page.locator('#project-select').selectOption('alpha');

tests/e2e/ledger-features.spec.js

@@ -4,10 +4,11 @@
 const { test, expect } = require('@playwright/test');
 const { answerActionDialog } = require('./action-dialog-helper');
 
-const TOKEN_URL = '/#token=engraphis-playwright-local-only';
+const DASHBOARD_URL = '/';
 
-// The real server answers the very first request with 401 until the URL token has been
-// exchanged for the browser session, so resource-load reports are expected noise here.
+// The dashboard opens automatically for the Playwright server (it runs with an API token,
+// but automatic browser access is the default), so resource-load reports are expected noise
+// only while the first bootstrap request settles.
 function pageErrors(page) {
   const errors = [];
   page.on('pageerror', error => errors.push(error.message));
@@ -52,7 +53,7 @@ const MARKDOWN = [
 test('Quick import renders Markdown inertly and the editor previews, guards and diffs edits', async ({ page }) => {
   const errors = pageErrors(page);
   const workspace = `features-import-${Date.now()}`;
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   await createWorkspace(page, workspace);
 
@@ -122,7 +123,7 @@ test('Quick import renders Markdown inertly and the editor previews, guards and
 test('Library keeps a keyboard reorder across reloads', async ({ page }) => {
   const errors = pageErrors(page);
   const workspace = `features-order-${Date.now()}`;
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   await createWorkspace(page, workspace);
   await addMemory(page, 'First written', 'Written first.');
@@ -154,7 +155,7 @@ test('Workspaces can be described, copied, merged, exported and hard-deleted', a
   const stamp = Date.now();
   const source = `features-source-${stamp}`;
   const target = `features-target-${stamp}`;
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   await createWorkspace(page, target);
   await createWorkspace(page, source);
@@ -197,7 +198,7 @@ test('Workspaces can be described, copied, merged, exported and hard-deleted', a
 test('Secure erase removes a leaked secret only after an explicit confirmation', async ({ page }) => {
   const errors = pageErrors(page);
   const workspace = `features-erase-${Date.now()}`;
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   await createWorkspace(page, workspace);
   await addMemory(page, 'Leaked deploy key', 'The deploy key is test-key-not-real-0001.');
@@ -220,7 +221,7 @@ test('Secure erase removes a leaked secret only after an explicit confirmation',
 
 test('Dialogs never display bidi controls carried by untrusted names', async ({ page }) => {
   const errors = pageErrors(page);
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   // A crafted title could reorder the dialog's prose on screen, e.g. to make "Delete" read
   // as something harmless. Every explicit and implicit direction control is dropped.
@@ -247,7 +248,7 @@ test('Dialogs never display bidi controls carried by untrusted names', async ({
 test('A save that fails after leaving the editor is still reported', async ({ page }) => {
   const errors = pageErrors(page);
   const workspace = `features-save-${Date.now()}`;
-  await page.goto(TOKEN_URL);
+  await page.goto(DASHBOARD_URL);
   await expect(page.locator('#connection-status')).toContainText('connected');
   await createWorkspace(page, workspace);
   await addMemory(page, 'Existing note', 'Already saved.');

tests/e2e/memory-workflow.spec.js

@@ -427,7 +427,7 @@ test('record history pages by lineage and recovers visibly from a stale continua
 
 test('a real project memory is scoped, discoverable, revised atomically, and retained after reload', async ({ page }) => {
   const workspace = 'project-workflow-' + Date.now();
-  await page.goto('/?view=manage#token=engraphis-playwright-local-only');
+  await page.goto('/?view=manage');
   await expect(page.locator('#connection-status')).toContainText('Local engine connected');
   await page.locator('#create-workspace-toggle').click();
   await page.locator('#new-workspace-name').fill(workspace);

tests/e2e/workspace-routing.spec.js

@@ -242,7 +242,7 @@ test('saved routing and a selected-memory move work against the isolated local s
   const repo = 'routing-project-' + suffix;
   const errors = [];
   page.on('pageerror', error => errors.push(error.message));
-  await page.goto('/?view=manage#token=engraphis-playwright-local-only');
+  await page.goto('/?view=manage');
   await expect(page.locator('#connection-status')).toContainText('Local engine connected');
   for (const workspace of [from, to]) {
     await page.locator('#create-workspace-toggle').click();

tests/e2e/workspace-smoke.spec.js

@@ -5,8 +5,8 @@ test('a real local workspace saves, recalls, and corrects a memory with history'
   const errors = [];
   page.on('pageerror', error => errors.push(error.message));
   const workspace = `browser-smoke-${browserName}-${Date.now()}`;
-  // The Playwright server is token-gated, so the one-shot fragment token signs in.
-  await page.goto('/#token=engraphis-playwright-local-only');
+  // The Playwright server runs with an API token; automatic browser access opens it.
+  await page.goto('/');
   await expect(page.locator('#connection-status')).toContainText('Local engine connected');
   await expect(page.locator('#browser-auth-dialog')).not.toBeVisible();
   await expect(page).not.toHaveURL(/token=/);