code-context-mcpBLOCK

| **httpOnly cookie** (preferred) | server-set cookie, JS can't read it | you control the API/domain | XSS cannot read it, so a script injection cannot exfiltrate the session |

| **In-memory access + httpOnly refresh** | access token in a JS variable; refresh token in an httpOnly cookie | cross-domain token API | the long-lived secret is unreadable by JS; the short-lived one

Continue polling until 3 minutes have passed with no actions, then exit

"content": "---\nname: set-up-auth\ndescription: Use when adding authentication to a frontend SPA — current user as TanStack Query server state, tokens never in localStorage (httpOnly cookies, or in-m

"content": "# Auth Patterns\n\nReference for `set-up-auth`. The security-sensitive decisions, made the senior way.\n\n## Rule: tokens never go in `localStorage` / `sessionStorage`\n**Why:** Both are r

const TOKEN = "test-bench-token-0123456789abcdef0123";

const TOKEN = "test-rebinding-token-0123456789abcdef";

const TOKEN = "test-route-parity-token-0123456789abcdef";

const TOKEN = "test-me-archive-token-0123456789abcdef";

const TOKEN = "test-archive-token-0123456789abcdef";

execute, remove_dependency, remove_tag, reset_agents, reset_skills, reset_sprint_process, sync_scrum_data

.prettierignore

.source.json

return createHash("sha1").update(content).digest("hex");

writeFileSync(path.join(outside, "id_rsa"), "PRIVATE KEY\n");

const traversal = path.join(root, "../", path.basename(outside), "id_rsa");

expect(new FreshnessGuard(db).indexIfEligible(path.join(root, "../../.ssh/id_rsa"))).toBe(false);

expect(paths().some((p) => p.includes("id_rsa"))).toBe(false);

symlinkSync(path.join(outside, "id_rsa"), link);

outDir: path.resolve(__dirname, '../../../dist/dashboard'),

const PKG_VERSION = (() => { try { return JSON.parse(fs.readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '../../package.json'), 'utf8')).version; } catch { return '2.0.0'; } })();

const bundledPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../comparison.json");

const bundledBench = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../benchmark-results.json");

const bundledStoch = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../benchmark-stochastic-results.json");

expect(isAllowedOrigin("POST", "http://127.0.0.1:3333")).toBe(true);