From 0b625cc0d948317255ebd381ed78ad9c1f420a13 Mon Sep 17 00:00:00 2001
From: thereisnotime <37583483+thereisnotime@users.noreply.github.com>
Date: Tue, 4 Aug 2026 01:46:00 +0300
Subject: [PATCH 1/2] fix(workspace): do not hardcode the workspace cookie
 domain

setWorkspaceCookie always set domain=.openagents.org. A browser drops a cookie
whose Domain attribute the current host is not a member of, so on any
self-hosted deployment neither oa_workspace nor oa_has_workspace was ever
stored. It failed silently, since setting document.cookie reports nothing.

Keeps the shared cookie on openagents.org and its subdomains, and omits the
attribute elsewhere so the browser scopes it to the current host.
---
 workspace/frontend/app/[workspaceId]/page.tsx | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/workspace/frontend/app/[workspaceId]/page.tsx b/workspace/frontend/app/[workspaceId]/page.tsx
index 5b67d9f8c..d374ce4cd 100644
--- a/workspace/frontend/app/[workspaceId]/page.tsx
+++ b/workspace/frontend/app/[workspaceId]/page.tsx
@@ -40,9 +40,20 @@ function WorkspaceLoadingSplash() {
   );
 }
 
+// Share the cookie across openagents.org subdomains, but fall back to a
+// host-only cookie anywhere else. A browser silently drops a cookie whose
+// Domain attribute it is not a member of, so hardcoding the attribute means no
+// cookie at all on a self-hosted deployment.
+function workspaceCookieDomain(hostname: string): string {
+  return hostname === 'openagents.org' || hostname.endsWith('.openagents.org')
+    ? ';domain=.openagents.org'
+    : '';
+}
+
 function setWorkspaceCookie(slug: string, token: string) {
   const maxAge = 30 * 24 * 60 * 60;
-  const shared = `path=/;max-age=${maxAge};secure;samesite=lax;domain=.openagents.org`;
+  const domain = workspaceCookieDomain(window.location.hostname);
+  const shared = `path=/;max-age=${maxAge};secure;samesite=lax${domain}`;
   document.cookie = `oa_workspace=${encodeURIComponent(JSON.stringify({ slug, token }))};${shared}`;
   document.cookie = `oa_has_workspace=1;${shared}`;
 }

From 0404b02eb1d1726c5fa51c0e90093cbdacbad352 Mon Sep 17 00:00:00 2001
From: thereisnotime <37583483+thereisnotime@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:55:15 +0300
Subject: [PATCH 2/2] ci(agent-smoke): skip job when E2E_WS_TOKEN is absent

Fork PRs don't receive org secrets from GitHub Actions, so E2E_WS_TOKEN
is always empty for external contributors. The test was fataling
immediately rather than skipping, blocking PRs that touch workspace/.

Adding an if condition on the job so fork PRs get a clean skip instead.
---
 .github/workflows/agent-e2e-smoke.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/agent-e2e-smoke.yml b/.github/workflows/agent-e2e-smoke.yml
index 0269c9ef8..338742c36 100644
--- a/.github/workflows/agent-e2e-smoke.yml
+++ b/.github/workflows/agent-e2e-smoke.yml
@@ -42,6 +42,8 @@ jobs:
     # ubuntu: the fast per-PR gate. The earlier claude hang was MCP-mode's
     # MCP-server subprocess (not a platform issue) — the smoke now runs the agent
     # in skills mode (no MCP), which works on Linux.
+    # Fork PRs do not receive secrets so E2E_WS_TOKEN is empty; skip rather than fail.
+    if: ${{ env.E2E_WS_TOKEN != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps: