test(runtime): verify live same-origin canary

scripts/real-browser-e2e-origin.mjs

@@ -0,0 +1,34 @@
+const FORBIDDEN_PORT = 8788;
+
+export function parseExternalE2eOrigin(value) {
+  if (value === undefined) return undefined;
+  if (value === '') throw new Error('E2E_ORIGIN must not be empty when set.');
+
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error('E2E_ORIGIN must be a valid absolute URL.');
+  }
+
+  if (
+    url.protocol !== 'http:' ||
+    url.hostname !== '127.0.0.1' ||
+    !url.port ||
+    url.username ||
+    url.password ||
+    url.pathname !== '/' ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error(
+      'E2E_ORIGIN must be an HTTP origin on numeric loopback with an explicit port (for example http://127.0.0.1:8789).',
+    );
+  }
+
+  if (Number(url.port) === FORBIDDEN_PORT) {
+    throw new Error(`E2E_ORIGIN must not use forbidden legacy port ${FORBIDDEN_PORT}.`);
+  }
+
+  return url.origin;
+}

scripts/real-browser-e2e.mjs

@@ -10,10 +10,13 @@ import process from 'node:process';
 import { setTimeout as delay } from 'node:timers/promises';
 import { fileURLToPath } from 'node:url';
 
+import { parseExternalE2eOrigin } from './real-browser-e2e-origin.mjs';
+
 const { WebSocket } = globalThis;
 const DIST = fileURLToPath(new URL('../apps/web/dist/', import.meta.url));
 const CLEAN_DIST = process.argv.includes('--clean-dist');
 const FORBIDDEN_PORT = 8788;
+const EXTERNAL_ORIGIN = parseExternalE2eOrigin(process.env.E2E_ORIGIN);
 
 const CHROME_CANDIDATES = [
   process.env.CHROME_BIN,
@@ -276,9 +279,12 @@ let profile;
 
 try {
   const chromeBinary = await executableChrome();
-  http = createHttpServer((request, response) => void builtAssetHandler(request, response));
-  const serverPort = await listenOnSafeEphemeralPort(http);
-  const origin = `http://127.0.0.1:${serverPort}`;
+  let origin = EXTERNAL_ORIGIN;
+  if (!origin) {
+    http = createHttpServer((request, response) => void builtAssetHandler(request, response));
+    const serverPort = await listenOnSafeEphemeralPort(http);
+    origin = `http://127.0.0.1:${serverPort}`;
+  }
 
   profile = await mkdtemp(join(tmpdir(), 'multi-simadmin-chrome-'));
   chrome = spawn(
@@ -327,8 +333,23 @@ try {
 
   const unknownApi = await fetch(`${origin}/api/v1/not-a-real-route`);
   assert.equal(unknownApi.status, 404, 'Unknown API routes must not receive the SPA shell');
-  assert.match(unknownApi.headers.get('content-type') ?? '', /^application\/json\b/u);
-  assert.deepEqual(await unknownApi.json(), { error: 'Not Found', statusCode: 404 });
+  const unknownApiContentType = unknownApi.headers.get('content-type') ?? '';
+  assert.doesNotMatch(unknownApiContentType, /^text\/html\b/u);
+  assert.match(unknownApiContentType, /^application\/(?:problem\+)?json\b/u);
+  const unknownApiProblem = await unknownApi.json();
+  if (EXTERNAL_ORIGIN) {
+    assert(
+      unknownApiProblem &&
+        typeof unknownApiProblem === 'object' &&
+        (unknownApiProblem.status === 404 ||
+          unknownApiProblem.statusCode === 404 ||
+          typeof unknownApiProblem.title === 'string' ||
+          typeof unknownApiProblem.type === 'string'),
+      'Unknown external API route must return a JSON Problem Details object',
+    );
+  } else {
+    assert.deepEqual(unknownApiProblem, { error: 'Not Found', statusCode: 404 });
+  }
 
   const loaded = cdp.once('Page.loadEventFired');
   await cdp.send('Page.navigate', { url: `${origin}/fleet` });
@@ -384,7 +405,11 @@ try {
 
   assert.deepEqual(failures, [], `Browser failures detected:\n${failures.join('\n')}`);
   console.log(`PASS real Chrome E2E (${chromeBinary})`);
-  console.log(`PASS isolated built-asset server on ${origin} (legacy port 8788 untouched)`);
+  console.log(
+    EXTERNAL_ORIGIN
+      ? `PASS live same-origin canary on ${origin} (legacy port 8788 untouched)`
+      : `PASS isolated built-asset server on ${origin} (legacy port 8788 untouched)`,
+  );
   console.log(
     'PASS keyboard navigation and rendered API states: /fleet -> /jobs -> /audit -> /settings/instances',
   );