fix(frontend): add credentials: 'include' to auth cookie fetches

frontend/src/api/stt.test.ts

@@ -128,6 +128,7 @@ describe('WAV extension selection logic', () => {
       expect.objectContaining({
         method: 'POST',
         body: expect.any(FormData),
+        credentials: 'include',
       })
     )
 

frontend/src/api/stt.ts

@@ -68,6 +68,7 @@ export const sttApi = {
 
     try {
       const response = await fetch(urlObj.toString(), {
+        credentials: 'include',
         method: 'POST',
         body: formData,
         signal: controller.signal,

frontend/src/components/file-browser/FileBrowser.tsx

@@ -169,7 +169,7 @@ useEffect(() => {
     setError(null)
 
     try {
-      const response = await fetch(getFileApiUrl(path))
+      const response = await fetch(getFileApiUrl(path), { credentials: 'include' })
       if (!response.ok) {
         throw new Error(`Failed to load files: ${response.statusText}`)
       }
@@ -251,7 +251,7 @@ useEffect(() => {
     // Fetch the full file content when selecting a file
     setLoading(true)
     try {
-      const response = await fetch(getFileApiUrl(file.path))
+      const response = await fetch(getFileApiUrl(file.path), { credentials: 'include' })
       if (!response.ok) {
         throw new Error(`Failed to load file: ${response.statusText}`)
       }
@@ -294,6 +294,7 @@ useEffect(() => {
 
     try {
       const response = await fetch(getFileApiUrl(currentPath), {
+        credentials: 'include',
         method: 'POST',
         body: formData,
       })
@@ -364,6 +365,7 @@ useEffect(() => {
   const handleCreateFile = useCallback(async (name: string, type: 'file' | 'folder') => {
     try {
       const response = await fetch(getFileApiUrl([currentPath, name].filter(Boolean).join('/')), {
+        credentials: 'include',
         method: 'PUT',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ type, content: type === 'file' ? '' : undefined }),
@@ -382,6 +384,7 @@ useEffect(() => {
   const handleDelete = useCallback(async (path: string) => {
     try {
       const response = await fetch(getFileApiUrl(path), {
+        credentials: 'include',
         method: 'DELETE',
       })
 
@@ -399,6 +402,7 @@ useEffect(() => {
   const handleRename = useCallback(async (oldPath: string, newPath: string) => {
     try {
       const response = await fetch(getFileApiUrl(oldPath), {
+        credentials: 'include',
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ newPath }),

frontend/src/components/file-browser/FilePreview.tsx

@@ -117,6 +117,7 @@ export const FilePreview = memo(function FilePreview({ file, hideHeader = false,
 
   const saveFileContent = useCallback(async (content: string) => {
     const response = await fetch(getFileApiUrl(file.path), {
+      credentials: 'include',
       method: 'PUT',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ type: 'file', content }),

frontend/src/contexts/AuthContext.tsx

@@ -41,7 +41,7 @@ export function AuthProvider({ children }: AuthProviderProps) {
   useEffect(() => {
     const fetchConfig = async () => {
       try {
-        const response = await fetch('/api/auth-info/config')
+        const response = await fetch('/api/auth-info/config', { credentials: 'include' })
         if (response.ok) {
           const data = await response.json()
           setConfig(data)

frontend/src/contexts/TTSContext.tsx

@@ -115,6 +115,7 @@ export function TTSProvider({ children }: TTSProviderProps) {
 
     try {
       const response = await fetch(`${API_BASE_URL}/api/tts/synthesize`, {
+        credentials: 'include',
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ text }),

frontend/src/lib/auth-loaders.ts

@@ -15,7 +15,7 @@ async function fetchAuthConfig(): Promise<AuthConfig> {
     isFirstUser: false,
     adminConfigured: false,
   }
-  const response = await fetch('/api/auth-info/config')
+  const response = await fetch('/api/auth-info/config', { credentials: 'include' })
   if (!response.ok) {
     return defaultConfig
   }

frontend/src/lib/opencode-event-stream/browserTransport.ts

@@ -20,6 +20,7 @@ export function createBrowserEventStreamTransport(): EventStreamTransport {
 
     async post(path: string, body: unknown): Promise<boolean> {
       const response = await fetch(path, {
+        credentials: 'include',
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),