test(e2e): add playwright-utils e2e package with a non-blocking CI job

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# QA reviews every change to the isolated UI test package.
+/e2e/ @yz-anaconda

.github/workflows/e2e.yml

@@ -0,0 +1,119 @@
+name: E2E (playwright-utils)
+
+# UI tests in e2e/, built on the private @anaconda/playwright-utils package.
+# Not a required check: a failure is reported on the PR but never blocks a merge.
+
+on:
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    # Fork PRs get no secrets, so the private package can't be installed; skip instead of failing.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_HOST_AUTH_METHOD: trust
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    env:
+      POSTGRES_URL: postgresql://postgres:postgres@localhost:5432/postgres
+      POSTGRES_CONNECT_TIMEOUT: 30000
+      POSTGRES_MAX_QUERY_TIME: 30000
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Nothing here pushes; don't leave the job's GITHUB_TOKEN in .git/config for later steps.
+          persist-credentials: false
+
+      # next.config.mjs refuses to start unless this Git LFS video is real, not a pointer file.
+      # Fetch only that 29 KB file instead of every LFS asset (~53 MB).
+      - name: Fetch the LFS file next.config.mjs checks
+        run: git lfs pull --include="apps/web/public/kilo-anim.mp4"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+          # Caches the app's pnpm store only; the e2e install below uses its own uncached store.
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install app dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install e2e dependencies
+        working-directory: e2e
+        # The token is scoped to this step only. The private package goes to a separate store that is
+        # never cached: Actions caches on main can be restored by fork PRs.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.ANACONDA_PACKAGES_READ_TOKEN }}
+        run: pnpm install --frozen-lockfile --ignore-workspace --ignore-scripts --store-dir "$RUNNER_TEMP/e2e-pnpm-store"
+
+      - name: Run database migrations
+        run: pnpm drizzle migrate
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('e2e/pnpm-lock.yaml') }}
+
+      - name: Install Playwright browser
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        working-directory: e2e
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Install Playwright system dependencies
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        working-directory: e2e
+        run: pnpm exec playwright install-deps chromium
+
+      - name: Start web app
+        run: nohup node e2e/ci/start-web.mjs > web-server.log 2>&1 &
+
+      - name: Warm up routes
+        run: node e2e/ci/warm-up.mjs
+
+      - name: Run tests
+        working-directory: e2e
+        run: pnpm test
+
+      - name: Show web server log
+        if: failure()
+        run: tail -n 100 web-server.log
+
+      - name: Upload report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-report
+          path: |
+            e2e/playwright-report
+            e2e/test-results
+            web-server.log
+          retention-days: 7

.oxfmtrc.json

@@ -9,5 +9,5 @@
   "arrowParens": "avoid",
   "endOfLine": "lf",
   "sortPackageJson": false,
-  "ignorePatterns": ["services/kilo-mcp/catalog.json"]
+  "ignorePatterns": ["services/kilo-mcp/catalog.json", "e2e/**"]
 }

.oxlintrc.json

@@ -13,6 +13,7 @@
   },
   "ignorePatterns": [
     ".next/**",
+    "e2e/**",
     "node_modules/**",
     "**/node_modules/**",
     "**/*.js",

.prettierignore

@@ -47,3 +47,5 @@ pnpm-lock.yaml
 !.env.example
 *.sql
 
+# Isolated QA package with its own Prettier config (see e2e/README.md)
+e2e/

e2e/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+test-results/
+playwright-report/
+.env

e2e/.npmrc

@@ -0,0 +1,2 @@
+@anaconda:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

e2e/.prettierrc

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json.schemastore.org/prettierrc",
+  "semi": true,
+  "trailingComma": "all",
+  "singleQuote": true,
+  "quoteProps": "as-needed",
+  "printWidth": 120,
+  "tabWidth": 2,
+  "bracketSpacing": true,
+  "arrowParens": "avoid",
+  "endOfLine": "lf",
+  "overrides": [
+    {
+      "files": ["*.json"],
+      "options": {
+        "trailingComma": "none"
+      }
+    }
+  ]
+}

e2e/README.md

@@ -0,0 +1,66 @@
+# Kilo Cloud E2E
+
+Playwright UI tests for `apps/web`, built on `@anaconda/playwright-utils`. The legacy tests in
+`apps/web/tests/e2e/` move here spec by spec; until a spec is migrated, it keeps running from there.
+
+## Why this folder is separate
+
+`@anaconda/playwright-utils` is a private package on GitHub Packages, and this repo is public. So
+`e2e/` is its own package outside the pnpm workspace, with its own lockfile: the root install never
+needs the private registry. Root `oxlint`/`oxfmt` skip `e2e/`; it uses the ESLint and Prettier
+config from `@anaconda/playwright-utils`.
+
+## Install
+
+Requires Node 24 and a GitHub token with `read:packages` (`gh auth refresh -h github.com -s read:packages`).
+Pass the token as an env var only; `.npmrc` reads it from `NODE_AUTH_TOKEN`.
+
+```
+NODE_AUTH_TOKEN=$(gh auth token) pnpm install --frozen-lockfile --ignore-workspace --ignore-scripts
+pnpm exec playwright install chromium
+```
+
+`--ignore-scripts` skips the package's postinstall, which only downloads Chromium.
+
+## Run
+
+Start the app from the repo root (`pnpm dev:start`), then from `e2e/`:
+
+| Script | Purpose |
+|---|---|
+| `pnpm test` | Run all tests |
+| `pnpm test:smoke` / `pnpm test:reg` | Only `@smoke` / `@reg` tests |
+| `pnpm report` | Open the last HTML report |
+| `pnpm validate` / `pnpm lint` / `pnpm format` | Type check, ESLint, Prettier |
+| `pnpm check:code-quality` | playwright-utils quality checks |
+
+`URL` overrides the base URL and `POSTGRES_URL` the database used for seeding. Both default to what
+`pnpm dev:start` uses, port offset included: `http://localhost:<3000 + offset>` and `POSTGRES_URL` from
+the repo root's `.env.local`.
+
+## CI
+
+`.github/workflows/e2e.yml` runs on pull requests and the merge queue. It is not a required check, and
+it skips fork PRs, which get no secrets. The job starts Postgres, runs migrations, installs `e2e/`
+with the `ANACONDA_PACKAGES_READ_TOKEN` secret (on that step only), starts `next dev` with
+`ci/start-web.mjs`, compiles the tested routes with `ci/warm-up.mjs`, and runs `pnpm test`. The
+report, failure traces and the server log are uploaded as the `e2e-report` artifact for 7 days.
+
+To reproduce it locally, from the repo root: `pnpm dev:stop`, then `pnpm test:db` (starts and migrates
+this worktree's Postgres), `node e2e/ci/start-web.mjs` and `node e2e/ci/warm-up.mjs`; then
+`CI=1 URL=http://localhost:3000 pnpm test` in `e2e/`. `PORT` moves `start-web.mjs` and `warm-up.mjs`
+off 3000; set `URL` to match.
+
+## Layout
+
+```
+tests/
+  specs/ui/<product>/          # specs
+  pages/{ui,api}/<product>/    # page objects (UI) and API helpers
+  fixtures/fixture.ts          # registers every page object; specs import `test` from here
+  support/core/                # database seeding, hydration wait
+  testdata/{ui,api}/<product>/ # paths, labels and other test data
+```
+
+Each test seeds its own user with plain SQL and signs in through the dev-only fake login, so nothing
+depends on shared dev data.