Description

• Part of Harden browser mode and UI API access #10499
• Closes Decide whether watch-mode b should be redesigned as a real browser-session shortcut or removed #10538

Previously any request to /__vitest_test__ serves the same html as /__vitest_test__/?sessionId=... even though the direct request to /__vitest_test__ doesn't provide working browser mode experience. This PR changes to return 404 on /__vitest_test__ to reduce exposed API credentials surface.

TODO

• doc

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
• Ideally, include a test that fails without this PR but passes with it.
• Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.
• Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

• Run the tests with pnpm test:ci.

Documentation

• If you introduce new functionality, document it. You can run documentation with pnpm run docs command.

Changesets

• Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.