Manual preview testing

Read docs/contributing/preview-manual-testing.md. Do not improvise gh comment scraping, local E2E against the preview URL, or raw D1 seeding of preview resources.

Prefer control-kody when you also need doctor, local login, Feature Map lookup, or a /health SHA check:

npm run control-kody -- preview -- --request 'GET /onboarding.json' --check /onboarding/step-2

Command

npm run preview:manual-test

On medium or high risk, do not stop at the default health/login smoke. The seed user (me@kentcdodds.com / ilikecode, username user-me) has no secrets, packages, or jobs until you create them. Script that data and the assertions as the same logged-in user:

npm run preview:manual-test -- \
  --request 'POST /onboarding/checklist-dismiss.json {}' \
  --request 'GET /onboarding.json' \
  --check /onboarding/step-2

--request spec: METHOD /path [status] [json-body] (default success: 2xx). Use the JSON APIs the UI uses (/account/*.json in packages/worker/universal/routes.ts). --json includes session.cookieHeader; --cookie-file writes it for follow-up curl.

--pr, --url, --no-wait, --skip-login, --help as documented.

When

After the PR is ready for review (drafts and forks have no preview) and you have pushed the commits you want to exercise. Typical triggers: visual-recap risk is medium (extends) or high (adds); auth, workers, or deploy-path behavior changed; the user asked to try the preview.

This does not replace npm run validate.

After the scripted session

1. Open the printed URL. On Cloud Agents, use the computerUse subagent.
2. Sign in at /login with the seed credentials. Button label is Sign in.
3. Confirm the data you created and exercise the UI this PR changes. Stay on the preview origin.
4. Record what you saw on the PR.

GET /mcp is 401 without OAuth; /admin is 403 (seed account is not admin). Neither is a regression.