Onboarding: fix webchat URL loopback and canonical session

src/commands/onboard-helpers.e2e.test.ts

@@ -1,9 +1,11 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
+  buildWebchatUrl,
   normalizeGatewayTokenInput,
   openUrl,
   resolveBrowserOpenCommand,
   resolveControlUiLinks,
+  resolveLocalBrowserControlUiLinks,
   validateGatewayPasswordInput,
 } from "./onboard-helpers.js";
 
@@ -107,6 +109,35 @@ describe("resolveControlUiLinks", () => {
     expect(links.httpUrl).toBe("http://127.0.0.1:18789/");
     expect(links.wsUrl).toBe("ws://127.0.0.1:18789");
   });
+
+  it("coerces lan bind to loopback for local browser links", () => {
+    const links = resolveLocalBrowserControlUiLinks({
+      port: 18789,
+      bind: "lan",
+    });
+    expect(links.httpUrl).toBe("http://127.0.0.1:18789/");
+    expect(links.wsUrl).toBe("ws://127.0.0.1:18789");
+  });
+});
+
+describe("buildWebchatUrl", () => {
+  it("encodes canonical session key exactly once", () => {
+    const url = buildWebchatUrl({
+      httpUrl: "http://127.0.0.1:18789/",
+      sessionKey: "agent:main:main",
+    });
+    expect(url).toBe("http://127.0.0.1:18789/chat?session=agent%3Amain%3Amain");
+  });
+
+  it("preserves base path and appends token in fragment", () => {
+    const url = buildWebchatUrl({
+      httpUrl: "http://127.0.0.1:18789/ui/",
+      sessionKey: "agent:main:main",
+      token: "abc 123",
+    });
+    expect(url).toBe("http://127.0.0.1:18789/ui/chat?session=agent%3Amain%3Amain#token=abc%20123");
+    expect(url).not.toContain("%2520");
+  });
 });
 
 describe("normalizeGatewayTokenInput", () => {