Handle invalid /client launch tokens safely

[cursor]

Changes

• Added a shared getSafeTokenPayload helper that returns null for malformed, unauthorized, or schema-invalid Copilot launch tokens while preserving unexpected error throws.
• Updated /client to validate the token payload before issuing internal page data fetches, rendering the existing invalid-token UI for invalid launch tokens.
• Short-circuited impossible Copilot token strings before constructing the SDK to avoid /client Sentry/dev-server noise for malformed values.

Testing Criteria

• yarn test src/utils/tokenPayload.test.ts --runInBand covers valid payloads, impossible token strings, Copilot auth failures, malformed payloads, and unexpected errors.
• yarn lint:check exits 0 (existing React hook/compiler warnings remain).
• yarn tsc exits 0.
• Manual browser walkthrough: /client?token=invalid-token renders "Please provide a Valid Token" and not "Something went wrong". Artifact: invalid_client_token_walkthrough_trimmed.mp4.

Notes

• Linear and Sentry MCP servers were unavailable in this run due authentication, so the direct Sentry event details and Linear ticket reply could not be posted from the automation.

Impact & Surface Area of Change

• Affects server rendering for /client launch-token handling only.
• Valid Copilot token payloads continue through the same page data loading path after validation.
• Invalid/malformed launch tokens now stop before internal fetches and show the existing invalid-token UI.

  

[linear-code]

OUT-3972

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tasks-app	Ready	Preview, Comment	Jul 10, 2026 8:07pm