e2e: integration harness (69/69 green) + fix /agent/ws missing bearer auth (BUG-1)

e2e/scenarios/spawn-validation.mjs

@@ -0,0 +1,34 @@
+// scenarios/spawn-validation.mjs — spawn request validation and status shape.
+// Deliberately does NOT POST a valid repo: that path needs Docker, which the
+// harness must not require.
+
+import { rest, TEST_TOKEN } from "../lib.mjs";
+
+export async function run(ctx) {
+  const { r, base, token } = ctx;
+
+  const noSlash = await rest(base, token, "/api/spawn", { method: "POST", body: { repo: "nosuchthing" } });
+  r.check(
+    "spawn repo without path separator → 400",
+    noSlash.status === 400 && typeof noSlash.json?.error === "string",
+    `got ${noSlash.status} ${noSlash.text}`,
+  );
+
+  const badChars = await rest(base, token, "/api/spawn", { method: "POST", body: { repo: "grp/prj!bad" } });
+  r.check("spawn repo with invalid chars → 400", badChars.status === 400, `got ${badChars.status}`);
+
+  const malformed = await fetch(`${base}/api/spawn`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${TEST_TOKEN}`, "Content-Type": "application/json" },
+    body: "{not json",
+  });
+  r.check("spawn with malformed JSON body → 400", malformed.status === 400, `got ${malformed.status}`);
+  await malformed.text();
+
+  const status = await rest(base, token, "/api/spawn/status");
+  r.check(
+    "GET /api/spawn/status → 200 array",
+    status.status === 200 && Array.isArray(status.json),
+    `got ${status.status} ${status.text}`,
+  );
+}