From e8ce1d9031d15ffbb6370d8c1d985310bc1b19f4 Mon Sep 17 00:00:00 2001
From: suyx <dada20041002@163.com>
Date: Wed, 5 Aug 2026 22:22:49 +0800
Subject: [PATCH] =?UTF-8?q?fix(POSTV1-11):=20=E4=BF=AE=E5=A4=8D=E7=94=9F?=
 =?UTF-8?q?=E6=88=90=E6=8F=90=E4=BA=A4=E7=9A=84=E4=BC=9A=E8=AF=9D=E4=BB=A4?=
 =?UTF-8?q?=E7=89=8C=E8=BD=AE=E6=8D=A2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 RELEASE.json                                       |  2 +-
 apps/web/src/project-pages.tsx                     |  8 +++++++-
 tests/api/postv1-generation-csrf.test.ts           | 12 ++++++++++++
 .../package/postv1-codex-browser-support.test.mjs  | 14 ++++++++++++++
 4 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 tests/api/postv1-generation-csrf.test.ts
 create mode 100644 tests/package/postv1-codex-browser-support.test.mjs

diff --git a/RELEASE.json b/RELEASE.json
index 0116eee..ea591d1 100644
--- a/RELEASE.json
+++ b/RELEASE.json
@@ -3,7 +3,7 @@
   "browsers": [
     {
       "brand": "Google Chrome",
-      "fullVersion": "150.0.7871.187"
+      "fullVersion": "151.0.0.0"
     },
     {
       "brand": "Microsoft Edge",
diff --git a/apps/web/src/project-pages.tsx b/apps/web/src/project-pages.tsx
index 835a0d6..c7b64f4 100644
--- a/apps/web/src/project-pages.tsx
+++ b/apps/web/src/project-pages.tsx
@@ -27,6 +27,7 @@ interface LocalDataPayload {
 }
 
 interface AccountSettingsPayload {
+  csrf_token: string;
   local_data: LocalDataPayload;
 }
 
@@ -296,7 +297,12 @@ export function WorkspacePage() {
         if (!active) return;
         if (modelResult.status === "fulfilled") setModels(modelResult.value);
         if (taskResult.status === "fulfilled") setCurrentTask(taskResult.value);
-        if (settingsResult.status === "fulfilled" && settingsResult.value) setLocalData(settingsResult.value.local_data);
+        const settings = settingsResult.status === "fulfilled" ? settingsResult.value : undefined;
+        if (settings) {
+          setLocalData(settings.local_data);
+          // Account settings rotates the mutation token; keep the workspace token current.
+          setSession((current) => current ? { ...current, csrf_token: settings.csrf_token } : current);
+        }
         setGenerationStateLoaded(true);
       });
     }).catch((error) => {
diff --git a/tests/api/postv1-generation-csrf.test.ts b/tests/api/postv1-generation-csrf.test.ts
new file mode 100644
index 0000000..b64769a
--- /dev/null
+++ b/tests/api/postv1-generation-csrf.test.ts
@@ -0,0 +1,12 @@
+import { readFileSync } from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+describe("POSTV1-11 workspace generation CSRF refresh", () => {
+  it("keeps the rotated account-settings token for generation submission", () => {
+    const source = readFileSync("apps/web/src/project-pages.tsx", "utf8");
+
+    expect(source).toContain("csrf_token: string;");
+    expect(source).toContain("csrf_token: settings.csrf_token");
+  });
+});
diff --git a/tests/package/postv1-codex-browser-support.test.mjs b/tests/package/postv1-codex-browser-support.test.mjs
new file mode 100644
index 0000000..832af2a
--- /dev/null
+++ b/tests/package/postv1-codex-browser-support.test.mjs
@@ -0,0 +1,14 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+test("POSTV1-11 release accepts the Codex embedded Chrome major", () => {
+  const release = JSON.parse(
+    fs.readFileSync(path.resolve("RELEASE.json"), "utf8"),
+  );
+  const chrome = release.browsers.find(({ brand }) => brand === "Google Chrome");
+
+  assert.ok(chrome, "release must include Google Chrome");
+  assert.equal(Number.parseInt(chrome.fullVersion.split(".")[0], 10), 151);
+});