Chris CoutinhoandClaude Opus 4.7
bea5c3f5ee
Astrolabe's ApiController endpoints (search, chunk-context) require a CSRF `requesttoken` header — axios picks it up from OC.requestToken automatically in the SPA, but page.request.get() does not. The first CI run failed on the search step with 412 CSRF check failed before reaching the chunk-context assertion that was supposed to surface the handler bug. Load the Astrolabe page, read OC.requestToken, and pass it on both calls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>