Auto-login via hidden iframe POST (code-server only accepts empty href)

Form POSTs into a hidden iframe to set the session cookie cross-origin,
then navigates top window to the ?folder URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

index.html

@@ -2937,17 +2937,22 @@ const SCHEDULE = [
       }
     }
 
-    // Auto-login: POST password to code-server, then go to ?folder=... URL.
+    // Auto-login: POST password to code-server в скрытый iframe (получаем cookie),
+    // затем переходим в нужную ?folder URL — cookie позволит пропустить login.
     const CODE_PASSWORD = 'zorro';
     function redirectTo(cdn, vscodeUrl) {
       const fullUrl = vscodeUrl || (CODE_BASE + encodeURIComponent(cdn) + '/');
-      // href = query+hash portion (everything after origin), e.g. "?folder=/Users/..."
       const u = new URL(fullUrl);
-      const href = u.search + u.hash;
+
+      const iframe = document.createElement('iframe');
+      iframe.name = 'code-login-iframe';
+      iframe.style.display = 'none';
+      document.body.appendChild(iframe);
 
       const form = document.createElement('form');
       form.method = 'POST';
       form.action = u.origin + '/login';
+      form.target = 'code-login-iframe';
       form.style.display = 'none';
       const add = (name, value) => {
         const i = document.createElement('input');
@@ -2956,8 +2961,18 @@ const SCHEDULE = [
       };
       add('password', CODE_PASSWORD);
       add('base', '.');
-      add('href', href);
+      add('href', '');
       document.body.appendChild(form);
+
+      let navigated = false;
+      const go = () => {
+        if (navigated) return;
+        navigated = true;
+        window.location.href = fullUrl;
+      };
+      iframe.addEventListener('load', () => setTimeout(go, 150));
+      // Fallback на случай, если iframe не вызовет load
+      setTimeout(go, 2500);
       form.submit();
     }