Fix admin ticket validation format mismatch

tests/web_ui_session/browser.cjs

@@ -55,7 +55,8 @@ function browser({onlyLoader = false, withLoader = false, role = 'user'} = {}) {
         if (next !== undefined) return typeof next === 'function' ? next(options) : next;
         if (url === '/api/session') return session({role});
         if (url === '/api/status') return json({});
-        if (url === '/api/ws-ticket' || url === '/api/admin/ws-ticket') return ticket();
+        if (url === '/api/ws-ticket') return ticket();
+        if (url === '/api/admin/ws-ticket') return json({ticket: '0123456789abcdef'.repeat(4), expires_in: 30});
         throw new Error('network unavailable');
     }});
     if (withLoader || onlyLoader) vm.runInContext(loader, context);
@@ -207,7 +208,7 @@ async function test(name, fn) { await fn(); ++passed; console.log('PASS JS:', na
         const u = await connected(); assert.equal(u.nodes['terminal-selector'].hidden, true);
         u.click('select-admin'); u.click('admin-toggle'); await tick(); assert.equal(u.terminals.length, 1); assert.equal(u.sockets.length, 1);
         const b = await adminBrowser(), [serial, admin] = b.sockets, [st, at] = b.terminals;
-        assert.match(admin.url, /\/ws\/admin\?ticket=/);
+        assert.equal(admin.url, 'wss://sak.local/ws/admin?ticket=' + '0123456789abcdef'.repeat(4));
         assert.equal(b.calls.find(c => c.url === '/api/admin/ws-ticket').headers['X-CSRF-Token'], token);
         st.input('WRONG'); at.input('x'.repeat(1025)); assert.equal(serial.sent.length, 0);
         assert.deepEqual(admin.sent.map(x => x.length), [512, 512, 1]);
@@ -224,6 +225,16 @@ async function test(name, fn) { await fn(); ++passed; console.log('PASS JS:', na
         assert.ok(!serial.closed); assert.equal(b.nodes['admin-toggle'].textContent, 'Open admin');
         b.click('select-serial'); st.input('ok'); assert.deepEqual([...serial.sent.at(-1)], [111, 107]);
     });
+    await test('admin rejects serial-format and malformed tickets before upgrade without disturbing serial', async () => {
+        for (const value of ['t'.repeat(32), 'a'.repeat(63), 'a'.repeat(65), 'g'.repeat(64), null]) {
+            const b = browser({role: 'admin'}); b.start(); await tick();
+            const serial = b.sockets[0]; serial.emit('open');
+            b.queues['/api/admin/ws-ticket'].push(json({ticket: value}));
+            b.click('select-admin'); b.click('admin-toggle'); await tick();
+            assert.equal(b.sockets.length, 1); assert.ok(!serial.closed);
+            assert.equal(b.nodes['admin-detail'].textContent, 'Admin connection failed. Open admin to retry.');
+        }
+    });
     await test('bounded hidden output continues draining, separate scrollback and input overflow closes only admin', async () => {
         const b = await adminBrowser(), [serial, admin] = b.sockets, [st, at] = b.terminals;
         assert.equal(st.options.scrollback, 5000); assert.equal(at.options.scrollback, 5000);