test(researcher): Playwright e2e suite and CI job

[nikola0x0]

Summary

Closes the "e2e test researcher" half of the task: a 15-test Playwright suite plus a researcher-e2e CI job, mirroring the existing chatbot-e2e setup.

Researcher had no automated tests at all — the app with the only real Walrus writes was verified entirely by hand. That's how the title-model P0 in #673 reached production.

Stacked on #673 (base fix/researcher-title-model-chat-crash). The P0 regression spec asserts the error-frame guard from that PR, so merge #673 first; this PR then retargets to dev automatically.

The test that would have caught the P0

e2e/chat-stream.test.ts asserts the raw SSE frames from /api/chat: a failing title model must not put an error frame on the stream.

Verified as a real regression test, not merely a passing one — with the try/catch guard removed it fails with the exact production symptom, while the answer still streams underneath:

Expected length: 0
Received length: 1
Received array:  [{"errorText": "Oops, an error occurred!", "type": "error"}]

Mock seams

Four seams, all keyed off the existing isTestEnvironment, so a run never reaches OpenRouter, Sui, or the relayer:

Seam	What it does
lib/ai/providers.ts	Maps picker model ids onto the three registered mock models. The pre-existing test branch was broken — it passed the raw id straight through, so languageModel("google/gemini-2.5-flash") would have thrown NoSuchModelError on the first message. The branch had simply never run.
lib/ai/models.mock.ts	A FAIL_TITLE_GENERATION sentinel in a user message makes the title model reject, reproducing the P0 on demand.
lib/auth/delegate-account.mock.ts (new)	Fabricates the MemWalAccount object for two fixture identities. The real binding validation still runs, so unregistered keys and unknown accounts fail exactly as they do on-chain — both asserted.
lib/sprint/memwal.ts	MemWalMock from the SDK, one instance per process, so remember → recall round-trips in memory and CI can never write to the production relayer.

Coverage

Spec	Covers
auth.setup.ts	Signs in as account A through the real form (doubles as the happy-path login test) and account B via API; saves both storage states.
e2e/auth.test.ts	Anonymous redirects; unregistered key, unknown account, malformed key rejections.
e2e/chat.test.ts	Input/suggestions render; message streams a reply; chat survives reload with both rows. Asserts zero uncaught page errors, guarding the auto-resume TypeError from 39e102ae.
e2e/chat-stream.test.ts	SSE frame protocol + the P0 regression test above.
e2e/visibility.test.ts	Private/Public boundary across two real accounts.

Two behaviors pinned as they are, not as expected

Both found while writing the specs; neither leaks content:

1. A private chat opened by another user returns HTTP 200, not 404 — app/(chat)/chat/[id]/page.tsx wraps the async component in <Suspense>, so the streaming shell is flushed before notFound() runs. The user correctly sees the not-found page; only the status code is misleading (matters for monitoring/bots). The spec asserts the rendered page and the absence of the canary.
2. Anonymous visitors are redirected to /login even for public chats, since proxy.ts's auth check precedes the visibility check — the known "Public — Anyone with the link" product gap. Pinned deliberately, with a comment to update it if that product decision changes.

Flakiness worked out up front

global-setup.ts clears the auth limiter's Redis keys before each run. The limiter allows 10 verify attempts per IP per minute and a run spends five, so without this a second run inside a minute fails at sign-in with a 429 that looks nothing like the real problem. Both identities also sign in once in a setup project rather than per-test, keeping CI's 2 retries clear of the limit.

Also worth knowing for anyone adding specs (documented in tests/README.md): browser.newContext() inherits the project's use.storageState, so a context that must be someone else — including an anonymous one — has to pass its own explicitly. Miss it and the test still passes, for the wrong reason. My first draft of the visibility specs hit exactly this.

Verification

• 15/15 green on three consecutive runs, ~10s each
• Green from cold with Playwright managing its own webServer, and with AUTH_SECRET / NEXT_PUBLIC_MEMWAL_PACKAGE_ID unset — so the config defaults CI relies on are exercised
• Negative control: guard removed → P0 spec fails as shown above; restored → green
• tsc --noEmit clean; pnpm test:unit 14/14

Notes

• Lint is not wired into the new job: ultracite/biome version mismatch already breaks pnpm lint repo-wide (soft-failed for chatbot in the same workflow). Same follow-up.
• The suite has no live-model or live-Walrus canary by design; the real remember → recall loop against the production relayer stays a manual check.