fix: add credentials:include to all fetch calls for IAP auth

docs/HANDOFF.md

@@ -1,3 +1,26 @@
+# HANDOFF — 2026-06-19
+
+## Status
+Deploy SUCCESS kl 23:10 CEST — build 6af0bb06
+
+## Problem løst
+OPAX-hub (opax.vauco.no) hadde ikke-fungerende chat, panel-switching og suggest-knapper.
+
+## Rot-årsak
+Alle fetch()-kall manglet `credentials: 'include'` — IAP-cookies ble ikke sendt med API-requests.
+
+## Fix
+Lagt til `credentials: 'include'` i:
+- fetchWithTimeout() — linje 804
+- sendMessage() fetch til /run — linje 1102  
+- termKey() fetch til /terminal/exec — linje 1050
+
+## Neste sesjon
+- Verifiser at Jason-chat fungerer med IAP-auth i nettleser
+- Sjekk at panel-switching og build-status oppdateres korrekt
+
+---
+
 # HANDOFF — Vauco OS
 
 **Sist oppdatert:** 2026-06-15 19:46 CEST  
@@ -81,8 +104,8 @@
 
 ```bash
 # 1. Verifiser Gitea
-curl -s http://34.59.131.162:3000/api/v1/repos/chris/OSVauco \
-  -H "Authorization: token 94527a0f5353c4b1db29a007b98f340b5fd1f385" \
+curl -s http://34.59.131.162:3000/api/v1/repos/chris/OSVauco 
+  -H "Authorization: token 94527a0f5353c4b1db29a007b98f340b5fd1f385" 
   | python3 -c "import sys,json; r=json.load(sys.stdin); print('mirror:', r['mirror'], '| commits OK')"
 
 # 2. Verifiser Jason

static/opax.html

@@ -801,7 +801,7 @@ setInterval(pollBuild,30000)
 function fetchWithTimeout(url, ms=10000){
   const ctrl = new AbortController()
   const timer = setTimeout(()=>ctrl.abort(), ms)
-  return fetch(url, { signal: ctrl.signal })
+  return fetch(url, { signal: ctrl.signal, credentials: 'include' })
     .then(r=>{ clearTimeout(timer); return r })
     .catch(e=>{ clearTimeout(timer); throw e })
 }
@@ -1084,17 +1084,17 @@ function appendTyping(){
 }
 function rmTyping(){ document.getElementById('typing')?.remove() }
 
-const inp=document.getElementById('msg-input'),sbtn=document.getElementById('send-btn')
-inp.addEventListener('input',()=>sbtn.disabled=!inp.value.trim())
+const chatInp=document.getElementById('msg-input'),sbtn=document.getElementById('send-btn')
+chatInp.addEventListener('input',()=>sbtn.disabled=!chatInp.value.trim())
 function autoResize(el){ el.style.height='auto';el.style.height=Math.min(el.scrollHeight,160)+'px' }
 function handleKey(e){ if(e.key==='Enter'&&!e.shiftKey){e.preventDefault();if(!sbtn.disabled)sendMessage()} }
-function suggest(btn){ inp.value=btn.textContent.trim();inp.dispatchEvent(new Event('input', { bubbles: true }));autoResize(inp);sbtn.disabled=false;sendMessage() }
+function suggest(btn){ chatInp.value=btn.textContent.trim();chatInp.dispatchEvent(new Event('input', { bubbles: true }));autoResize(chatInp);sbtn.disabled=false;sendMessage() }
 
 let busy=false
 async function sendMessage(){
   if(busy)return
-  const txt=inp.value.trim();if(!txt)return
-  busy=true;sbtn.disabled=true;inp.value='';inp.style.height='auto'
+  const txt=chatInp.value.trim();if(!txt)return
+  busy=true;sbtn.disabled=true;chatInp.value='';chatInp.style.height='auto'
   document.getElementById('error-bar').classList.remove('show')
   const ts=Date.now(),hist=lh();hist.push({role:'user',text:txt,ts});sh(hist)
   appendMsg('user',txt,ts);appendTyping()
@@ -1106,7 +1106,7 @@ async function sendMessage(){
   }catch(err){
     rmTyping()
     const b=document.getElementById('error-bar');b.textContent='Jason svarte ikke: '+err.message;b.classList.add('show')
-  }finally{busy=false;sbtn.disabled=!inp.value.trim();inp.focus()}
+  }finally{busy=false;sbtn.disabled=!chatInp.value.trim();chatInp.focus()}
 }
 function clearHistory(){ if(!confirm('Tøm hele chat-historikken?'))return; localStorage.removeItem(STORAGE_KEY);sessionStorage.removeItem(SESSION_KEY);location.reload() }
 function exportHistory(){
@@ -1114,7 +1114,7 @@ function exportHistory(){
   const a=document.createElement('a');a.href=URL.createObjectURL(new Blob([lines.join('\n\n')],{type:'text/plain'}));a.download='jason-historikk-'+new Date().toISOString().slice(0,10)+'.txt';a.click()
 }
 ;(function(){ const h=lh();if(!h.length)return;h.forEach(m=>appendMsg(m.role,m.text,m.ts));document.getElementById('messages').scrollTop=99999 })()
-inp.focus()
+chatInp.focus()
 renderTierGrid(5000)
 updatePricing(5000)
 </script>