[Mjones13]

Cookie-authenticated Browser preview streams fail with 401 in single-origin development when accessed through a forwarded frontend authority. /api enabled WebSocket proxying but rewrote Host to the backend, leaving the browser Origin unchanged. Production cookie authentication correctly rejected that mismatch.

Add /api to the existing shared Host-preserving proxy policy. This accepted shared edit is one set entry and its explanatory comment; extracting another policy would duplicate the existing Vite integration. Backend origin checks and authentication remain unchanged. Jones-owned tests and additive boundary records contain the regression coverage.

Validation:

• A real disposable Vite proxy feeds actual received headers into production EnvironmentAuth, using synthetic browser cookies, in-memory persistence, and the four scopes from the reported live baseline. No owner credentials or live application state are used.
• The final regression fails against the exact policy from base ac16cfd32a4cb298885a723865eb2c43f58116a6: preview receives Host: 127.0.0.1:<backend-port>, Origin: http://127.0.0.1:26633, and returns 401. With only the candidate policy restored, it passes with the original Host and 101. The same test bytes are used for both runs.
• Covers preview/device cookie upgrades, API/media HTTP, unchanged /ws, media tickets, and refusal of missing/invalid credentials, foreign origins, and another port on the same host. Existing auth, preview-stream and device-hub suites pass all 51 tests; the new regression also passes.
• Shared and server typechecks, targeted lint/format, ordinary commit hook, diff checks, and strict boundary checks pass (zero boundary violations).

Base is current canonical main ac16cfd32a4cb298885a723865eb2c43f58116a6; delivered cohort 424cc87775332fc7d228de49fad68676257f8491 remains an ancestor. The server fallback prefix list, Vite configuration, wire protocol, provider adapters, direct/relay/native connection paths and installed runtime are unchanged. This is source/proxy-auth verification, not final live Browser proof; the root owns live verification, independent review, CI and guarded merge. No watch or merge is requested from this child.

Implemented by Codex (gpt-6.1-sol, high reasoning) through the Codex harness in Jones Code.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}