fix(coding): remediate data service review findings

tests/unit/preview-data-session.test.ts

@@ -127,13 +127,58 @@ describe('preview data session manager', () => {
     expect(manager.getSnapshot()).toBeNull();
   });
 
-  it('requires an HTTP loopback Origin and invalidates on browser lifecycle events', async () => {
+  it('accepts HTTP/HTTPS loopback Origins, including their default ports', async () => {
     const { manager, projectPath } = await createManager();
+    for (const origin of [
+      'http://localhost',
+      'http://localhost:80',
+      'https://localhost',
+      'https://localhost:443',
+      'http://127.0.0.1',
+      'https://127.0.0.1:443',
+      'http://[::1]',
+      'https://[::1]:443',
+    ]) {
+      await expect(manager.open({ projectPath, origin, browserGeneration: 1 }))
+        .resolves.toMatchObject({ origin: new URL(origin).origin });
+    }
     await expect(manager.open({
       projectPath,
       origin: 'https://example.com:443',
       browserGeneration: 1,
     })).rejects.toMatchObject({ code: 'invalid_origin' });
+    await expect(manager.open({
+      projectPath,
+      origin: 'http://localhost:80/path',
+      browserGeneration: 1,
+    })).rejects.toMatchObject({ code: 'invalid_origin' });
+  });
+
+  it('requires matching browser generation before invalidating lifecycle events', async () => {
+    const { manager, projectPath } = await createManager();
+    await manager.open({ projectPath, origin: 'http://127.0.0.1:13210', browserGeneration: 2 });
+
+    manager.handleAgentBrowserLifecycle({
+      type: 'closed',
+      projectId: '11111111-1111-4111-8111-111111111111',
+      projectPath,
+      generation: 1,
+      url: 'http://127.0.0.1:13210/',
+    });
+    expect(manager.getSnapshot()).not.toBeNull();
+
+    manager.handleAgentBrowserLifecycle({
+      type: 'closed',
+      projectId: '11111111-1111-4111-8111-111111111111',
+      projectPath,
+      generation: 2,
+      url: 'http://127.0.0.1:13210/',
+    });
+    expect(manager.getSnapshot()).toBeNull();
+  });
+
+  it('invalidates on browser lifecycle events from the current generation', async () => {
+    const { manager, projectPath } = await createManager();
 
     const lifecycleTypes: AgentBrowserLifecycleEvent['type'][] = [
       'cross-origin-navigation',