fix(web): send session cookies on playground/agent generate requests

[Taranum01]

Summary

• Add credentials: "include" to the Playground/Agent generate() fetch so Better Auth session cookies reach Jawn on cross-origin self-hosted deployments (localhost:3000 → :8585).
• Forward params.signal to fetch so streaming cancel works as intended.

Closes #5653

Problem

Self-hosted Playground returns 401 Invalid session on POST /v1/playground/generate even when the user is logged in. Other dashboard Jawn calls succeed because they use getJawnClient(), which always sends credentials: "include". The Playground path uses a raw fetch() without credentials, so the session cookie is omitted and BetterAuthWrapper.getSession() fails.

Test plan

• Self-hosted all-in-one: log in, open Playground, click Run — request includes Cookie header and does not return Invalid session
• Agent chat generate path (/v1/agent/generate) works in self-hosted Better Auth mode
• Cloud/hosted Helicone Playground still works
• Cancel mid-stream still aborts the request

Made with Cursor

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[vercel]

Someone is attempting to deploy a commit to the Helicone Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
helicone-bifrost	Skipped		Jun 27, 2026 6:47pm

[Taranum01]

Friendly bump — Vercel checks on this fork PR show "Authorization required to deploy" (helicone / helicone-eu); that’s expected until a maintainer approves the workflow, not a code failure.

The change itself is small (2 lines): add credentials: \"include\" and forward signal on the Playground/Agent generate() fetch so session cookies reach Jawn like getJawnClient() already does.

Ready for review when someone has time. Thanks!