- Add withCredentials: true to socket.io client so session cookies are sent cross-origin with the WebSocket upgrade request - Add cookie extraction in gateway extractTokenFromHandshake() as a fallback after auth.token, parsing all three BetterAuth session cookie name variants (__Secure-, bare, __Host- prefixes) - Fix Chat.tsx useWebSocket call: use actual workspace ID from auth context (currentWorkspaceId ?? workspaceId) instead of user.id Closes #534 Co-Authored-By: Claude Opus 4.6 <[email protected]>