[adamshiervani]

• npm run test:e2e: builds the API and runs dist/index.js against Postgres and SeaweedFS (S3). 87 tests:
  • Releases: registration via /releases/sync, update checks (URLs exist and match their hashes), upload-to-100% rollout, a new SKU's first staged release, rollout buckets, SKU fallback, prerelease, redirects.
  • HTTP: auth on every protected route, CORS, security headers, error bodies, logout, OIDC callback.
  • Devices: token exchange, removal.
  • WebSocket signaling: device and client auth, offer/answer/ICE relay, REAL_IP_HEADER, reconnects.
• CI runs the e2e tests after the unit tests. compose.development.yaml adds the S3 service.
• npm run compare -- --candidate <url|local|staging>: sends the same safe requests to two deployments (reference defaults to prod) and groups differences by cause. In a terminal it asks whether each group is expected. Replaces scripts/compare-releases.sh.
• DELETE /devices/:id without credentials answers 401. The WebSocket upgrade handler and device disconnect cleanup catch their errors.
• Prerelease /releases falls back to the newest of the 5 newest versions that has a build for the SKU, as the stable path does. /releases/app/latest and /releases/system_recovery/latest answer 404 instead of an older file.
• With appVersion or systemVersion, only that part is pinned; the other follows the rollout like a background check.

---

Note

Medium Risk
Touches core release selection (rollouts, S3 fallbacks, latest redirects) and device delete auth responses; wrong logic could change what devices receive or break tooling. E2E adds CI complexity (Postgres, SeaweedFS, longer runs).

Overview
Adds a Vitest e2e layer (e2e/, vitest.e2e.config.ts) that builds dist/index.js, provisions a dedicated Postgres DB and SeaweedFS bucket with fixture artifacts, and exercises releases (sync, rollouts, pins, prerelease, redirects), HTTP (auth, CORS, headers), devices, and WebSocket signaling. CI starts the S3 service from compose.development.yaml, waits on :8333, then runs npx vitest run --config vitest.e2e.config.ts after unit tests.

Introduces npm run compare (scripts/compare-api.mts) to diff safe GET/preflight responses between two API bases with grouped output and optional TTY confirmation; removes scripts/compare-releases.sh. README documents e2e and compare.

Release behavior changes: stable /releases now mixes pinned and rollout—only unconstrained (*) app/system use staged rollout; the other part follows getReleaseByRange or rollout as described. Prerelease S3 picks the newest semver match that actually has an artifact for the SKU (up to five candidates), so a missing build on the latest upload does not block older builds. /releases/app/latest and /releases/system_recovery/latest require the newest version to ship that SKU—otherwise 404 (no silent fallback to older objects). Legacy layout paths require the object to exist in S3.

Auth/devices: verifySession is extracted; DELETE /devices/:id without a device bearer uses it so invalid sessions return 401 consistently. WebRTC upgrade handling and lastSeen updates are wrapped to avoid unhandled rejections; device reconnect flow is adjusted so the new connection proceeds after the old socket closes.

Unit tests in test/releases.test.ts cover the new release and redirect rules.

^{Reviewed by Cursor Bugbot for commit b0c6e7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 4b0f576. Configure here.}