Restore chatroom browser contracts with a reproducible CI runner

[HMarzban]

The nine chatroom browser specs previously depended on missing authentication and service fixtures, stale selectors, and a licensed virtual list. Running them against a production build also allowed service-worker activation to reload the page during sends and pagination.

This change makes the existing UI contracts reproducible with authenticated Supabase HTTP fixtures and a standalone build-and-test command:

NEXT_PUBLIC_VIRTUOSO_LICENSE=<valid-license> bash scripts/test-chatroom.sh

• Build the extensions and an explicit production E2E app, start an owned temporary server, run all nine specs, retain reports, and clean up the server on success or failure.
• Keep Cypress selectors and disable PWA registration only when NEXT_PUBLIC_E2E=true; normal production builds keep their existing behavior.
• Reset persisted drafts from an inert page on the explicit app origin before the chatroom opens; a seeded IndexedDB regression verifies isolation.
• Exercise current unread/reply/deep-link controls, actual mobile long-press, real clipboard attachment input, send/retry payloads and settled success state, signed storage URLs, and same-day prepend boundaries. Remove the spoiler test's direct-state fallback.
• Add scoped E2E runner selection without losing full-suite timing data, and fail clearly when its server is unavailable in CI.
• Add a manual Chatroom Browser Tests workflow with pinned Node/Bun versions and failure artifacts.
• Scope the existing Next build-safety guard to the checkout being built, preserving servers in other clones. Resolve relative and symlink app paths and fail closed on ambiguous targets; 15 actual-process regressions cover the guard.

Validation: the full standalone command passed its production build and all nine specs: 31 passed, 0 failed, 1 pre-existing pending media-filter test. The temporary server stopped afterward and tracked timing data stayed unchanged. Webapp typecheck, changed-file formatting, actionlint, shell syntax, 15 Next-server guard process tests and normal pre-commit checks passed. The normal full pre-push check:ci passed every run gate: lint/styles/format/audit/types, email/webapp/backend unit tests, all five extension Cypress suites and preflight, and webapp/admin production builds. Backend service E2E and the broad webapp Cypress suite remain named skips in that existing pipeline; the nine chatroom specs were separately validated by the standalone command.

These are browser contract tests using intercepted HTTP. They do not claim database/RLS, real storage persistence, cross-client realtime, PWA lifecycle, or first-send server-echo integration coverage. The existing media-filter test remains pending because its control is not mounted.

Before a hosted run, configure the repository Actions secret NEXT_PUBLIC_VIRTUOSO_LICENSE with a valid commercial Virtuoso Message List license. No key is included in this change or uploaded from the local environment. Automatic PR coverage remains pending that configuration and a successful hosted run, so this PR does not introduce an always-failing required gate.

Related: #276.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1262743. Configure here.}

[cursor]

IndexedDB cleanup hits the wrong origin

Medium Severity

stubChatroom deletes the chatApp database from cy.window() before any visit, so Cypress operates on about:blank rather than the app origin. Composer drafts therefore survive across cases. The new onblocked rejection also cannot succeed once the real page has that database open.

 

^{Reviewed by Cursor Bugbot for commit 1262743. Configure here.}

[cursor]

Guard misses keepAliveTimeout option

Medium Severity

The Next argument parser treats values for options it does not list as positional app paths. --keepAliveTimeout is a real next start flag and is omitted, so a server in another clone that uses it can make the guard fail closed and skip this checkout's production build.

 

^{Reviewed by Cursor Bugbot for commit 1262743. Configure here.}