fix: preserve auth and response bounds for session reads

web/workspace/src/lib/workspace/session-observation.test.ts

@@ -2,6 +2,7 @@ import {
   isCurrentWorkerSessionRequest,
   workerSessionAction,
   type WorkerSessionRequestIdentity,
+  workerSessionRequestInit,
 } from "./session-observation";
 import type { SessionSnapshot } from "$lib/generated/protocol";
 
@@ -23,6 +24,19 @@ const snapshot: SessionSnapshot = {
   entries: [],
 };
 
+Deno.test("worker session request includes same-origin credentials", () => {
+  const controller = new AbortController();
+  const init = workerSessionRequestInit(controller.signal);
+  assert(
+    init.credentials === "same-origin",
+    "session observation must use the Workspace auth cookie boundary",
+  );
+  assert(
+    init.signal === controller.signal,
+    "request must retain its abort fence",
+  );
+});
+
 Deno.test("worker session observation selects live, retained, and unavailable behavior", () => {
   assert(
     workerSessionAction({ availability: "live_protocol" }).kind ===

web/workspace/src/lib/workspace/session-observation.ts

@@ -17,6 +17,14 @@ export interface WorkerSessionRequestIdentity {
   workerId: string;
 }
 
+export function workerSessionRequestInit(signal: AbortSignal): RequestInit {
+  return {
+    signal,
+    credentials: "same-origin",
+    headers: { accept: "application/json" },
+  };
+}
+
 export function workerSessionAction(
   observation: WorkerSessionObservation,
 ): WorkerSessionAction {

web/workspace/src/routes/w/[workspaceId]/workers/[workerRef]/console/+page.svelte

@@ -55,6 +55,7 @@
     import {
         isCurrentWorkerSessionRequest,
         workerSessionAction,
+        workerSessionRequestInit,
         type WorkerSessionObservation,
         type WorkerSessionRequestIdentity,
     } from "$lib/workspace/session-observation";
@@ -951,7 +952,7 @@
             workerApiPath(
                 `/runtimes/${encodeURIComponent(target.runtimeId)}/workers/${encodeURIComponent(target.workerId)}/session`,
             ),
-            { signal: controller.signal, headers: { accept: "application/json" } },
+            workerSessionRequestInit(controller.signal),
         )
             .then(async (response) => {
                 if (!response.ok) {