diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e5929f..e9a3961 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,11 +15,10 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: ruby-3.4.4
           bundler-cache: true
 
       - name: Lint code for consistent style
-        run: bin/rubocop -f github
+        run: bundle exec standardrb
 
   test:
     runs-on: ubuntu-latest
@@ -34,12 +33,6 @@ jobs:
           - 5432:5432
         options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
 
-      # redis:
-      #   image: redis
-      #   ports:
-      #     - 6379:6379
-      #   options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
-
     steps:
       - name: Install packages
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y build-essential git libpq-dev libyaml-dev pkg-config google-chrome-stable
@@ -50,20 +43,18 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: ruby-3.4.4
           bundler-cache: true
 
       - name: Run tests
         env:
           RAILS_ENV: test
           DATABASE_URL: postgres://postgres:postgres@localhost:5432
-          # REDIS_URL: redis://localhost:6379/0
-        run: bin/rails db:test:prepare test
+        run: bundle exec rake app:db:test:prepare test test:system
 
       - name: Keep screenshots from failed system tests
         uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: screenshots
-          path: ${{ github.workspace }}/tmp/screenshots
+          path: ${{ github.workspace }}/test/dummy/tmp/screenshots
           if-no-files-found: ignore
diff --git a/.rubocop.yml b/.rubocop.yml
deleted file mode 100644
index f9d86d4..0000000
--- a/.rubocop.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-# Omakase Ruby styling for Rails
-inherit_gem: { rubocop-rails-omakase: rubocop.yml }
-
-# Overwrite or add rules to create your own house style
-#
-# # Use `[a, [b, c]]` not `[ a, [ b, c ] ]`
-# Layout/SpaceInsideArrayLiteralBrackets:
-#   Enabled: false
diff --git a/.ruby-version b/.ruby-version
new file mode 100644
index 0000000..f989260
--- /dev/null
+++ b/.ruby-version
@@ -0,0 +1 @@
+3.4.4
diff --git a/.standard.yml b/.standard.yml
new file mode 100644
index 0000000..95f7716
--- /dev/null
+++ b/.standard.yml
@@ -0,0 +1,2 @@
+ignore:
+  - test/dummy/db/schema.rb
diff --git a/CHANGELOG.md b/CHANGELOG.md
index de3b08a..2c1df9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.6] - 2026-07-10
+
+### Security
+- Production Basic authentication moved from the controller into a Rack
+  middleware inserted in front of `WebConsole::Middleware`, so it now covers
+  web-console's evaluator endpoints (`/__web_console/repl_sessions/:id`) as
+  well as the console page. Previously a console session ID acted as an
+  unauthenticated bearer token for code execution until process restart.
+
+### Fixed
+- The console renders under a strict nonce-based Content Security Policy.
+  The page stylesheet carries Rails' per-request nonce, and requesting the
+  nonce during rendering makes it available to web-console's injected
+  scripts even when the app hoists the CSP middleware above web-console
+  (previously such apps got a nonempty header nonce but `nonce=""` scripts,
+  i.e. a blank console).
+- Console input evaluates in a fresh top-level binding, so constants
+  resolve the same way as in `bin/rails console` instead of inside the
+  engine's namespace (`ApplicationController` no longer resolves to
+  `SlashConsole::ApplicationController`, and app constants no longer need a
+  leading `::`). Local variables persist within a console session but not
+  across sessions.
+- Removed the duplicate `WebConsole::Middleware` the engine inserted
+  alongside the copy web-console's own railtie already adds.
+
 ## [0.1.5] - 2025-09-15
 
 ### Fixed
@@ -53,5 +78,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Development mode with no authentication required
 - Standard Ruby style guide compliance
 
-[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0
\ No newline at end of file
+[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.6...HEAD
+[0.1.6]: https://github.com/firstdraft/slash_console/compare/v0.1.0...v0.1.6
+[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0
diff --git a/Gemfile b/Gemfile
index e13dc1b..6497867 100644
--- a/Gemfile
+++ b/Gemfile
@@ -9,8 +9,10 @@ gem "pg"
 
 gem "propshaft"
 
-# Omakase Ruby styling [https://github.com/rails/rubocop-rails-omakase/]
-gem "rubocop-rails-omakase", require: false
+group :test do
+  gem "capybara"
+  gem "selenium-webdriver"
+end
 
 # Start debugger with binding.b [https://github.com/ruby/debug]
 # gem "debug", ">= 1.0.0"
diff --git a/Gemfile.lock b/Gemfile.lock
index ebec208..e26a22c 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    slash_console (0.1.0)
+    slash_console (0.1.6)
       rails (>= 7.0)
       web-console (>= 4.0)
 
@@ -79,12 +79,23 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     base64 (0.3.0)
     benchmark (0.4.1)
     bigdecimal (3.2.3)
     bindex (0.8.1)
     builder (3.3.0)
+    capybara (3.40.0)
+      addressable
+      matrix
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.11)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (>= 1.5, < 3.0)
+      xpath (~> 3.2)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.4)
     crass (1.0.6)
@@ -114,6 +125,7 @@ GEM
       net-pop
       net-smtp
     marcel (1.0.4)
+    matrix (0.4.3)
     mini_mime (1.1.5)
     minitest (5.25.5)
     net-imap (0.5.10)
@@ -128,11 +140,14 @@ GEM
     nio4r (2.7.4)
     nokogiri (1.18.10-arm64-darwin)
       racc (~> 1.4)
+    nokogiri (1.18.10-x86_64-linux-gnu)
+      racc (~> 1.4)
     parallel (1.27.0)
     parser (3.3.9.0)
       ast (~> 2.4.1)
       racc
     pg (1.6.2-arm64-darwin)
+    pg (1.6.2-x86_64-linux)
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
@@ -144,6 +159,7 @@ GEM
     psych (5.2.6)
       date
       stringio
+    public_suffix (7.0.5)
     puma (7.0.3)
       nio4r (~> 2.0)
     racc (1.8.1)
@@ -192,6 +208,7 @@ GEM
     regexp_parser (2.11.3)
     reline (0.6.2)
       io-console (~> 0.5)
+    rexml (3.4.4)
     rubocop (1.80.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
@@ -210,18 +227,15 @@ GEM
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
       rubocop-ast (>= 1.38.0, < 2.0)
-    rubocop-rails (2.33.3)
-      activesupport (>= 4.2.0)
-      lint_roller (~> 1.1)
-      rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
-      rubocop-ast (>= 1.44.0, < 2.0)
-    rubocop-rails-omakase (1.1.0)
-      rubocop (>= 1.72)
-      rubocop-performance (>= 1.24)
-      rubocop-rails (>= 2.30)
     ruby-progressbar (1.13.0)
+    rubyzip (3.4.1)
     securerandom (0.4.1)
+    selenium-webdriver (4.45.0)
+      base64 (~> 0.2)
+      logger (~> 1.4)
+      rexml (~> 3.2, >= 3.2.5)
+      rubyzip (>= 1.2.2, < 4.0)
+      websocket (~> 1.0)
     standard (1.51.1)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.0)
@@ -249,20 +263,25 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
+    websocket (1.2.11)
     websocket-driver (0.8.0)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
     zeitwerk (2.7.3)
 
 PLATFORMS
   arm64-darwin
+  x86_64-linux
 
 DEPENDENCIES
+  capybara
   pg
   propshaft
   puma
-  rubocop-rails-omakase
+  selenium-webdriver
   slash_console!
   standard (~> 1.0)
 
diff --git a/README.md b/README.md
index cddcb75..58f169a 100644
--- a/README.md
+++ b/README.md
@@ -46,19 +46,24 @@ Without these environment variables, you'll see an error message explaining what
 SlashConsole is a lightweight wrapper around [the excellent `web-console` gem](https://github.com/rails/web-console). It:
 
 1. Provides a dedicated route for console access (instead of only on error pages).
-2. Renders a full-page console interface.
-3. Uses basic authentication when in production.
+2. Renders a full-page console interface, including in apps that enforce a strict nonce-based Content Security Policy.
+3. In production, requires basic authentication via a Rack middleware that protects both the console page and web-console's code-evaluation endpoints (`/__web_console/repl_sessions/:id`).
+4. Evaluates console input at the top level, so constants resolve the same way as in `bin/rails console`.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests.
+After checking out the repo, run `bundle install` to install dependencies.
 
 To install this gem onto your local machine, run `bundle exec rake install`.
 
 ### Running Tests
 
+The test suite needs a local PostgreSQL server. Prepare the test database once, then:
+
 ```bash
-bundle exec rake test
+bundle exec rake app:db:test:prepare
+bundle exec rake test         # integration + unit tests
+bundle exec rake test:system  # browser smoke tests (needs Chrome)
 ```
 
 ### Linting
diff --git a/Rakefile b/Rakefile
index e7793b5..da8ad9a 100644
--- a/Rakefile
+++ b/Rakefile
@@ -6,3 +6,19 @@ load "rails/tasks/engine.rake"
 load "rails/tasks/statistics.rake"
 
 require "bundler/gem_tasks"
+
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/**/*_test.rb"].exclude("test/system/**/*", "test/dummy/**/*")
+  t.verbose = false
+end
+
+Rake::TestTask.new("test:system") do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/system/**/*_test.rb"]
+  t.verbose = false
+end
+
+task default: :test
diff --git a/app/controllers/slash_console/console_controller.rb b/app/controllers/slash_console/console_controller.rb
index f32ec94..d2f1ea4 100644
--- a/app/controllers/slash_console/console_controller.rb
+++ b/app/controllers/slash_console/console_controller.rb
@@ -4,27 +4,30 @@ class ConsoleController < ApplicationController
 
     skip_before_action :verify_authenticity_token, if: -> { defined?(verify_authenticity_token) }
 
+    # BasicAuthMiddleware is the primary guard: it protects both this page
+    # and web-console's evaluator endpoints, but only at the engine's
+    # standard /rails mount point. These filters remain as a second layer
+    # so the page stays protected if an application mounts the engine at a
+    # custom path.
     before_action :ensure_credentials_configured, if: -> { Rails.env.production? }
     before_action :authenticate_user, if: -> { Rails.env.production? }
 
     def index
-      console
+      console(SlashConsole.console_binding)
       render :index
     end
 
     private
 
     def ensure_credentials_configured
-      if ENV["ADMIN_USERNAME"].blank? || ENV["ADMIN_PASSWORD"].blank?
-        render plain: 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".',
-          status: :service_unavailable
+      unless BasicAuthMiddleware.credentials_configured?
+        render plain: BasicAuthMiddleware::CREDENTIALS_MESSAGE, status: :service_unavailable
       end
     end
 
     def authenticate_user
-      authenticate_or_request_with_http_basic("Rails Console") do |username, password|
-        ActiveSupport::SecurityUtils.secure_compare(username, ENV["ADMIN_USERNAME"]) &&
-          ActiveSupport::SecurityUtils.secure_compare(password, ENV["ADMIN_PASSWORD"])
+      authenticate_or_request_with_http_basic(BasicAuthMiddleware::REALM) do |username, password|
+        BasicAuthMiddleware.authorized?(username, password)
       end
     end
   end
diff --git a/app/views/slash_console/console/index.html.erb b/app/views/slash_console/console/index.html.erb
index 63dca4e..4fe04ad 100644
--- a/app/views/slash_console/console/index.html.erb
+++ b/app/views/slash_console/console/index.html.erb
@@ -3,7 +3,9 @@
   <head>
     <title>Rails Console</title>
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <style>
+    <%# Asking Rails for the nonce here also makes it available to the
+        web-console middleware when it injects the console scripts below. %>
+    <style nonce="<%= content_security_policy_nonce %>">
       body, html {
         margin: 0;
         padding: 0;
@@ -18,4 +20,4 @@
   <body>
     <!-- Console will be injected here by web-console middleware -->
   </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/bin/rubocop b/bin/rubocop
deleted file mode 100755
index 40330c0..0000000
--- a/bin/rubocop
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env ruby
-require "rubygems"
-require "bundler/setup"
-
-# explicit rubocop config increases performance slightly while avoiding config confusion.
-ARGV.unshift("--config", File.expand_path("../.rubocop.yml", __dir__))
-
-load Gem.bin_path("rubocop", "rubocop")
diff --git a/lib/slash_console.rb b/lib/slash_console.rb
index ee0ad9a..98666f3 100644
--- a/lib/slash_console.rb
+++ b/lib/slash_console.rb
@@ -1,6 +1,15 @@
 require "slash_console/version"
+require "slash_console/basic_auth_middleware"
 require "slash_console/engine"
 require "web-console"
 
 module SlashConsole
+  # A fresh binding at the top level, so that console input sees the same
+  # +self+ and constant resolution as bin/rails console, rather than the
+  # engine's lexical namespace. Each call returns a new binding: local
+  # variables persist across evaluations within a console session but do
+  # not leak between sessions or into TOPLEVEL_BINDING itself.
+  def self.console_binding
+    TOPLEVEL_BINDING.eval("binding")
+  end
 end
diff --git a/lib/slash_console/basic_auth_middleware.rb b/lib/slash_console/basic_auth_middleware.rb
new file mode 100644
index 0000000..445feb5
--- /dev/null
+++ b/lib/slash_console/basic_auth_middleware.rb
@@ -0,0 +1,71 @@
+module SlashConsole
+  # Basic authentication for the console in production.
+  #
+  # Authentication must happen in the middleware stack, not in
+  # ConsoleController: web-console's evaluator endpoints (PUT/POST
+  # <mount_point>/repl_sessions/:id) are served directly by
+  # WebConsole::Middleware and never reach the router, so a controller
+  # filter cannot protect them. This middleware is inserted before
+  # WebConsole::Middleware and guards both the console page and the
+  # evaluator endpoints with the same credentials.
+  class BasicAuthMiddleware
+    REALM = "Rails Console"
+    CREDENTIALS_MESSAGE = 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".'
+
+    # The paths the engine serves at its standard mount point: the root
+    # (/rails), the console page, and either with a format suffix or
+    # trailing slash. Deliberately does not cover other /rails/* paths --
+    # unmatched requests cascade past the engine to the host app, which
+    # owns paths like /rails/active_storage/*.
+    CONSOLE_PATHS = %r{\A/rails(?:/(?:console)?(?:\.[^/]*)?/?)?\z}
+
+    class << self
+      def credentials_configured?
+        ENV["ADMIN_USERNAME"].present? && ENV["ADMIN_PASSWORD"].present?
+      end
+
+      def authorized?(username, password)
+        ActiveSupport::SecurityUtils.secure_compare(username.to_s, ENV["ADMIN_USERNAME"].to_s) &&
+          ActiveSupport::SecurityUtils.secure_compare(password.to_s, ENV["ADMIN_PASSWORD"].to_s)
+      end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      return @app.call(env) unless Rails.env.production? && protects?(env[Rack::PATH_INFO].to_s)
+
+      unless self.class.credentials_configured?
+        return [503, {"content-type" => "text/plain"}, [CREDENTIALS_MESSAGE]]
+      end
+
+      auth = Rack::Auth::Basic::Request.new(env)
+      if auth.provided? && auth.basic? && self.class.authorized?(*auth.credentials)
+        @app.call(env)
+      else
+        unauthorized
+      end
+    end
+
+    private
+
+    def protects?(path)
+      CONSOLE_PATHS.match?(path) || evaluator_path?(path)
+    end
+
+    def evaluator_path?(path)
+      mount_point = WebConsole::Middleware.mount_point
+      path == mount_point || path.start_with?("#{mount_point}/")
+    end
+
+    def unauthorized
+      headers = {
+        "content-type" => "text/plain",
+        "www-authenticate" => %(Basic realm="#{REALM}")
+      }
+      [401, headers, ["HTTP Basic: Access denied.\n"]]
+    end
+  end
+end
diff --git a/lib/slash_console/engine.rb b/lib/slash_console/engine.rb
index f650bb6..7024fd0 100644
--- a/lib/slash_console/engine.rb
+++ b/lib/slash_console/engine.rb
@@ -13,8 +13,13 @@ class Engine < ::Rails::Engine
       require "web_console/extensions"
     end
 
-    initializer "slash_console.insert_middleware", after: :load_config_initializers do |app|
-      app.config.middleware.insert_after ActionDispatch::DebugExceptions, WebConsole::Middleware
+    # web-console's own railtie already inserts WebConsole::Middleware
+    # (before ActionDispatch::DebugExceptions), so the engine must not
+    # insert a second copy. It only adds the authentication middleware,
+    # which has to sit in front of WebConsole::Middleware because the
+    # evaluator endpoints are served there and never reach the router.
+    initializer "slash_console.insert_basic_auth_middleware", after: "web_console.insert_middleware" do |app|
+      app.config.middleware.insert_before WebConsole::Middleware, SlashConsole::BasicAuthMiddleware
     end
 
     initializer "slash_console.mount_engine" do |app|
diff --git a/lib/slash_console/version.rb b/lib/slash_console/version.rb
index 59a476e..6143585 100644
--- a/lib/slash_console/version.rb
+++ b/lib/slash_console/version.rb
@@ -1,3 +1,3 @@
 module SlashConsole
-  VERSION = "0.1.5"
+  VERSION = "0.1.6"
 end
diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb
new file mode 100644
index 0000000..cb260d2
--- /dev/null
+++ b/test/application_system_test_case.rb
@@ -0,0 +1,5 @@
+require "test_helper"
+
+class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
+  driven_by :selenium, using: :headless_chrome, screen_size: [1400, 900]
+end
diff --git a/test/dummy/config/initializers/content_security_policy.rb b/test/dummy/config/initializers/content_security_policy.rb
index b3076b3..db6cd49 100644
--- a/test/dummy/config/initializers/content_security_policy.rb
+++ b/test/dummy/config/initializers/content_security_policy.rb
@@ -1,25 +1,21 @@
-# Be sure to restart your server when you modify this file.
+# A strict, enforced, nonce-based Content Security Policy with no
+# unsafe-inline, mirroring the apps this gem must work inside.
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src :self
+    policy.object_src :none
+    policy.script_src :self
+    policy.style_src :self
+  end
 
-# Define an application-wide content security policy.
-# See the Securing Rails Applications Guide for more information:
-# https://guides.rubyonrails.org/security.html#content-security-policy-header
+  config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src style-src]
 
-# Rails.application.configure do
-#   config.content_security_policy do |policy|
-#     policy.default_src :self, :https
-#     policy.font_src    :self, :https, :data
-#     policy.img_src     :self, :https, :data
-#     policy.object_src  :none
-#     policy.script_src  :self, :https
-#     policy.style_src   :self, :https
-#     # Specify URI for violation reports
-#     # policy.report_uri "/csp-violation-report-endpoint"
-#   end
-#
-#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
-#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-#   config.content_security_policy_nonce_directives = %w(script-src style-src)
-#
-#   # Report violations without enforcing the policy.
-#   # config.content_security_policy_report_only = true
-# end
+  # Host apps may hoist the CSP middleware above ShowExceptions so that
+  # error responses carry the policy too. That places it above
+  # WebConsole::Middleware, meaning the response header's nonce is only
+  # generated AFTER web-console has already injected its scripts -- the
+  # exact topology in which 0.1.5 produced nonce="" scripts and a blank
+  # console. Keep this so the test suite covers that arrangement.
+  config.middleware.move_before ActionDispatch::ShowExceptions, ActionDispatch::ContentSecurityPolicy::Middleware
+end
diff --git a/test/dummy/db/schema.rb b/test/dummy/db/schema.rb
new file mode 100644
index 0000000..4d004c3
--- /dev/null
+++ b/test/dummy/db/schema.rb
@@ -0,0 +1,17 @@
+# This file is auto-generated from the current state of the database. Instead
+# of editing this file, please use the migrations feature of Active Record to
+# incrementally modify your database, and then regenerate this schema definition.
+#
+# This file is the source Rails uses to define your schema when running `bin/rails
+# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
+# be faster and is potentially less error prone than running all of your
+# migrations from scratch. Old migrations may fail to apply correctly if those
+# migrations use external dependencies or application code.
+#
+# It's strongly recommended that you check this file into your version control system.
+
+ActiveRecord::Schema[8.0].define(version: 0) do
+  # These are extensions that must be enabled in order to support this database
+  enable_extension "pg_catalog.plpgsql"
+
+end
diff --git a/test/integration/authentication_test.rb b/test/integration/authentication_test.rb
new file mode 100644
index 0000000..1bd0817
--- /dev/null
+++ b/test/integration/authentication_test.rb
@@ -0,0 +1,138 @@
+require "test_helper"
+
+class AuthenticationTest < ActionDispatch::IntegrationTest
+  USERNAME = "admin"
+  PASSWORD = "sekrit"
+
+  EVALUATOR_PATH = "#{WebConsole::Middleware.mount_point}/repl_sessions/nonexistent"
+
+  setup do
+    @original_username = ENV["ADMIN_USERNAME"]
+    @original_password = ENV["ADMIN_PASSWORD"]
+    ENV["ADMIN_USERNAME"] = USERNAME
+    ENV["ADMIN_PASSWORD"] = PASSWORD
+  end
+
+  teardown do
+    ENV["ADMIN_USERNAME"] = @original_username
+    ENV["ADMIN_PASSWORD"] = @original_password
+  end
+
+  def in_production(&block)
+    Rails.stub(:env, ActiveSupport::EnvironmentInquirer.new("production"), &block)
+  end
+
+  def credentials(username, password)
+    {"Authorization" => ActionController::HttpAuthentication::Basic.encode_credentials(username, password)}
+  end
+
+  test "anonymous console page request is refused in production" do
+    in_production do
+      get "/rails/console"
+    end
+
+    assert_response :unauthorized
+    assert_match(/Basic realm=/, response.headers["WWW-Authenticate"])
+  end
+
+  test "wrong credentials are refused on the console page in production" do
+    in_production do
+      get "/rails/console", headers: credentials(USERNAME, "wrong")
+    end
+
+    assert_response :unauthorized
+  end
+
+  test "anonymous evaluator request is refused in production" do
+    in_production do
+      put EVALUATOR_PATH, params: {input: "1 + 1"}, xhr: true
+    end
+
+    assert_response :unauthorized
+    assert_match(/Basic realm=/, response.headers["WWW-Authenticate"])
+  end
+
+  test "wrong credentials are refused on the evaluator in production" do
+    in_production do
+      put EVALUATOR_PATH, params: {input: "1 + 1"}, xhr: true,
+        headers: credentials("intruder", PASSWORD)
+    end
+
+    assert_response :unauthorized
+  end
+
+  test "valid credentials load the console page in production" do
+    in_production do
+      get "/rails/console", headers: credentials(USERNAME, PASSWORD)
+    end
+
+    assert_response :success
+    assert_includes response.body, "id=\"console\""
+    assert response.headers["x-web-console-session-id"].present?
+  end
+
+  test "valid credentials reach normal 404 handling for unknown evaluator sessions" do
+    in_production do
+      put EVALUATOR_PATH, params: {input: "1 + 1"}, xhr: true,
+        headers: credentials(USERNAME, PASSWORD)
+    end
+
+    assert_response :not_found
+    assert_includes response.parsed_body.fetch("output"), "no longer available"
+  end
+
+  test "an authenticated console session can evaluate code in production" do
+    in_production do
+      get "/rails/console", headers: credentials(USERNAME, PASSWORD)
+      session_id = response.headers.fetch("x-web-console-session-id")
+
+      put "#{WebConsole::Middleware.mount_point}/repl_sessions/#{session_id}",
+        params: {input: "6 * 7"}, xhr: true, headers: credentials(USERNAME, PASSWORD)
+    end
+
+    assert_response :success
+    assert_includes response.parsed_body.fetch("output"), "42"
+  end
+
+  test "missing credential configuration disables the console page in production" do
+    ENV["ADMIN_USERNAME"] = nil
+
+    in_production do
+      get "/rails/console"
+    end
+
+    assert_response :service_unavailable
+    assert_includes response.body, "ADMIN_USERNAME"
+  end
+
+  test "missing credential configuration disables the evaluator in production" do
+    ENV["ADMIN_PASSWORD"] = nil
+
+    in_production do
+      put EVALUATOR_PATH, params: {input: "1 + 1"}, xhr: true
+    end
+
+    assert_response :service_unavailable
+    assert_includes response.body, "ADMIN_PASSWORD"
+  end
+
+  test "the controller still protects custom mount points in production" do
+    in_production do
+      get "/slash_console/console"
+    end
+
+    assert_response :unauthorized
+
+    in_production do
+      get "/slash_console/console", headers: credentials(USERNAME, PASSWORD)
+    end
+
+    assert_response :success
+  end
+
+  test "no authentication is required outside production" do
+    get "/rails/console"
+
+    assert_response :success
+  end
+end
diff --git a/test/integration/console_evaluation_test.rb b/test/integration/console_evaluation_test.rb
new file mode 100644
index 0000000..ba9bf2e
--- /dev/null
+++ b/test/integration/console_evaluation_test.rb
@@ -0,0 +1,47 @@
+require "test_helper"
+
+class ConsoleEvaluationTest < ActionDispatch::IntegrationTest
+  def start_console_session
+    get "/rails/console"
+    assert_response :success
+    response.headers.fetch("x-web-console-session-id")
+  end
+
+  def evaluate(session_id, input)
+    put "#{WebConsole::Middleware.mount_point}/repl_sessions/#{session_id}",
+      params: {input: input}, xhr: true
+    assert_response :success
+    response.parsed_body.fetch("output")
+  end
+
+  test "evaluates at the top level, not inside the engine's namespace" do
+    session_id = start_console_session
+
+    assert_equal "=> \"ApplicationController\"\n",
+      evaluate(session_id, "ApplicationController.name")
+    assert_equal "=> \"main\"\n", evaluate(session_id, "to_s")
+  end
+
+  test "reaches Rails-loaded constants like rails console does" do
+    session_id = start_console_session
+
+    assert_equal "=> \"test\"\n", evaluate(session_id, "Rails.env")
+    assert_equal "=> \"Dummy::Application\"\n",
+      evaluate(session_id, "Rails.application.class.name")
+  end
+
+  test "local variables persist within a session" do
+    session_id = start_console_session
+
+    evaluate(session_id, "x = 41")
+    assert_equal "=> 42\n", evaluate(session_id, "x + 1")
+  end
+
+  test "local variables do not leak between sessions" do
+    first_session = start_console_session
+    evaluate(first_session, "leaky = true")
+
+    second_session = start_console_session
+    assert_match(/NameError/, evaluate(second_session, "leaky"))
+  end
+end
diff --git a/test/integration/content_security_policy_test.rb b/test/integration/content_security_policy_test.rb
new file mode 100644
index 0000000..0113754
--- /dev/null
+++ b/test/integration/content_security_policy_test.rb
@@ -0,0 +1,36 @@
+require "test_helper"
+
+# The dummy app enforces a strict, nonce-based Content Security Policy
+# (see test/dummy/config/initializers/content_security_policy.rb) with no
+# unsafe-inline. These tests pin the behavior that broke in 0.1.5: the
+# console page rendered blank because its inline style carried no nonce
+# and web-console's injected scripts carried nonce="".
+class ContentSecurityPolicyTest < ActionDispatch::IntegrationTest
+  test "the console uses the response Content Security Policy nonce" do
+    get "/rails/console"
+
+    assert_response :success
+    csp = response.headers.fetch("Content-Security-Policy")
+    nonce = csp[/nonce-([^']+)/, 1]
+    assert nonce.present?, "expected the CSP header to contain a nonce: #{csp}"
+    assert_includes csp, "script-src 'self' 'nonce-#{nonce}'"
+    assert_includes csp, "style-src 'self' 'nonce-#{nonce}'"
+
+    assert_includes response.body, %(<style nonce="#{nonce}">)
+
+    scripts = response.body.scan(/<script\b[^>]*>/)
+    assert_operator scripts.length, :>=, 3,
+      "expected web-console to inject its scripts into the page"
+    scripts.each { |script| assert_includes script, %(nonce="#{nonce}") }
+
+    refute_includes response.body, %(nonce="")
+  end
+
+  test "the strict policy is not weakened for the console" do
+    get "/rails/console"
+
+    csp = response.headers.fetch("Content-Security-Policy")
+    refute_includes csp, "unsafe-inline"
+    refute_includes csp, "unsafe-eval"
+  end
+end
diff --git a/test/integration/navigation_test.rb b/test/integration/navigation_test.rb
deleted file mode 100644
index ebbc098..0000000
--- a/test/integration/navigation_test.rb
+++ /dev/null
@@ -1,7 +0,0 @@
-require "test_helper"
-
-class NavigationTest < ActionDispatch::IntegrationTest
-  # test "the truth" do
-  #   assert true
-  # end
-end
diff --git a/test/middleware_stack_test.rb b/test/middleware_stack_test.rb
new file mode 100644
index 0000000..b82303c
--- /dev/null
+++ b/test/middleware_stack_test.rb
@@ -0,0 +1,38 @@
+require "test_helper"
+
+class MiddlewareStackTest < ActiveSupport::TestCase
+  def stack
+    Rails.application.middleware.middlewares
+  end
+
+  test "WebConsole::Middleware appears exactly once" do
+    assert_equal 1, stack.count(WebConsole::Middleware)
+  end
+
+  test "authentication runs before WebConsole::Middleware" do
+    auth_index = stack.index(SlashConsole::BasicAuthMiddleware)
+    web_console_index = stack.index(WebConsole::Middleware)
+
+    assert auth_index, "SlashConsole::BasicAuthMiddleware is missing from the stack"
+    assert_equal web_console_index - 1, auth_index
+  end
+
+  test "the protected path pattern covers every path the engine serves" do
+    pattern = SlashConsole::BasicAuthMiddleware::CONSOLE_PATHS
+
+    ["/rails", "/rails/", "/rails/console", "/rails/console/",
+      "/rails/console.html", "/rails/console.json", "/rails/.json"].each do |path|
+      assert_match pattern, path
+    end
+  end
+
+  test "the protected path pattern leaves cascaded host app paths alone" do
+    pattern = SlashConsole::BasicAuthMiddleware::CONSOLE_PATHS
+
+    ["/rails/active_storage/blobs/redirect/abc/photo.jpg",
+      "/rails/conductor/action_mailbox/inbound_emails",
+      "/railsy", "/", "/other"].each do |path|
+      refute_match pattern, path
+    end
+  end
+end
diff --git a/test/system/console_test.rb b/test/system/console_test.rb
new file mode 100644
index 0000000..de84286
--- /dev/null
+++ b/test/system/console_test.rb
@@ -0,0 +1,23 @@
+require "application_system_test_case"
+
+# Browser-level proof that the console actually renders and works while
+# the dummy app enforces a strict nonce-based Content Security Policy. A
+# real browser blocks non-nonced inline styles and scripts, so a blank
+# page here (as shipped in 0.1.5) fails these assertions.
+class ConsoleTest < ApplicationSystemTestCase
+  test "the prompt mounts and evaluates code under a strict CSP" do
+    visit "/rails/console"
+
+    assert_selector ".console-prompt-label", text: ">>"
+
+    # The page's inline stylesheet zeroes the body margin; Chrome's default
+    # is 8px. If CSP blocked the stylesheet (as in 0.1.5), this fails.
+    # (Checks margin-top because web-console's JS sets a bottom margin.)
+    assert_equal "0px", evaluate_script("getComputedStyle(document.body).marginTop")
+
+    find("#console").click
+    send_keys("6 * 7", :enter)
+
+    assert_selector ".console-message", text: "42"
+  end
+end
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 9d47a1b..8acb1df 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -5,6 +5,7 @@
 ActiveRecord::Migrator.migrations_paths = [File.expand_path("../test/dummy/db/migrate", __dir__)]
 ActiveRecord::Migrator.migrations_paths << File.expand_path("../db/migrate", __dir__)
 require "rails/test_help"
+require "minitest/mock"
 
 # Load fixtures from the engine
 if ActiveSupport::TestCase.respond_to?(:fixture_paths=)