One command for the local setup, in a Codespace as well

AGENTS.md

@@ -36,6 +36,7 @@ backend (`test/e2e/`), and the build of the branches `standard` and `rap`
 | `card/` | The card example: a UI Integration Card of type `Component`, generic - the class it runs is a card parameter, the backend a card destination the host resolves (`webapp/Component.js`, `onCardReady`) - with `webapp/dt/Configuration.js` for the host's configuration editor and a preview page in `webapp/test/` that `ui5 build` leaves out |
 | `test/e2e/` | Playwright tests of the examples, one spec file each (`playwright.config.mjs`) |
 | `scripts/build-bsp.mjs` | The branches, built with abap2UI5's tools into `out/standard/` and `out/rap/` |
+| `scripts/backend.mjs`, `scripts/start-local.mjs` | The local setup of `main`: `npm run backend` serves abap2UI5 from `@abap2ui5/node-runtime` (a root devDependency) on `localhost:3000`; `npm run start-local[:fe\|:fe-v2\|:card]` at the root starts it - unless port 3000 answers already - and then the example's own `start-local`. Not delivered: an example's README runs the backend as its own folder |
 | `README.md` | The README of `main` and, with a first line of its own, of both branches |
 | `abaplint.jsonc` | abaplint over the examples' ABAP, against abap2UI5's main (`npm run abaplint`) |
 | `.github/workflows/` | `ci.yaml` (checks, the branch build, e2e against abap2UI5 main and the 1.145.0 floor - on every pull request and every night), `deliver.yaml` (on every push to `main`: the same CI, then the branches) |
@@ -111,6 +112,14 @@ examples before it is published. Keep that interface stable:
   in every release the control supports). Do not bring back a middleware
   that drops `Origin`; a proxy that does not send the header is the thing to
   fix.
+- **The one exception is a GitHub Codespace, in `scripts/backend.mjs`.**
+  The port forwarding of a codespace rewrites `Origin` and
+  `X-Forwarded-Host` before the request reaches any of our code, so no
+  proxy setting can make them match. With `CODESPACES=true` - and only
+  then - the local backend drops `Origin`, `Referer` and
+  `X-Forwarded-Host`, and abap2UI5's lenient check lets the request
+  through. Outside a codespace the backend is `serve()` as it ships; never
+  widen the exception, and never move it into a UI5 middleware.
 
 ## The branches
 

README.md

@@ -399,15 +399,34 @@ installs the control from npm once, for all of them, in the version
 
 ```bash
 npm ci
-npm run start-local              # the freestyle example - start, start:fe, start:fe-v2, start:card for the others
+npm run start-local              # the freestyle example, against abap2UI5 in Node - nothing else to install
+npm run start-local:fe           # the same for start-local:fe-v2 and start-local:card
 ```
 
+`npm run start-local` at the root is the whole local setup in one command:
+it starts abap2UI5 transpiled to JavaScript on `http://localhost:3000`
+([`@abap2ui5/node-runtime`](https://www.npmjs.com/package/@abap2ui5/node-runtime),
+a devDependency of the workspace; `scripts/backend.mjs`) and then the
+example's dev server with `ui5-local.yaml`. A backend already answering on
+port 3000 - `npm run backend` in a terminal of its own, or `npm run express`
+in an abap2UI5 checkout - is used instead. `npm start`, `start:fe`,
+`start:fe-v2` and `start:card` go to the SAP system in the example's
+`ui5.yaml`.
+
+It runs in a GitHub Codespace as well: open the forwarded port 8080. The
+port forwarding of a codespace rewrites `Origin` and `X-Forwarded-Host`, and
+abap2UI5's CSRF check would reject every roundtrip ("CSRF validation
+failed - cross-origin request rejected"); in a codespace (`CODESPACES=true`)
+the local backend drops those headers before abap2UI5 reads them. Keep the
+codespace's ports private.
+
 | Command | |
 |---|---|
 | `npm run lint` / `npm run format:check` | ESLint and Prettier |
 | `npm run abaplint` | the ABAP of `fiori-elements-v2/abap` against abap2UI5's main (`abaplint.jsonc`) |
 | `npm run build` | `ui5 build` of the examples - the control lands in `dist/thirdparty/z2ui5/embed/` |
 | `ABAP2UI5_DIR=../abap2UI5 npm run bsp` | the branches in `out/standard/` and `out/rap/` (`scripts/build-bsp.mjs`), built with abap2UI5's BSP tools and checked with its page invariants |
+| `npm run backend` | abap2UI5 in Node on port 3000 (`scripts/backend.mjs`), for the e2e tests or an example started with its own `npm run start-local` |
 | `npx playwright test` | the examples in a browser against the backend on port 3000 - the freestyle one on UI5 1.136 and 1.71, the Fiori elements ones on SAPUI5 1.136, the card on OpenUI5 1.136 (`PW_CHROMIUM_PATH` for an installed Chromium) |
 
 CI (`ci.yaml`) runs all of them on every pull request and every night, the