implement Cypress end-to-end testing for APAP and MCP smoke coverage

[ibrahimmahdy684]

This PR implements Cypress-based end-to-end testing for APAP and MCP server behavior, focused on first-pass smoke coverage through real HTTP flows.

Implementation details

1. Added Cypress configuration for server-level E2E execution at cypress.config.ts
2. Added smoke tests at apap-mcp-smoke.cy.ts.
3. Added E2E scripts in package.json: test:e2e, test:e2e:open, test:e2e:local
4. Isolated Cypress from main TypeScript build in tsconfig.json to avoid type-scope conflicts.
5. Added Cypress artifact ignores in .gitignore.

Coverage implemented in this PR

1. APAP smoke check:( Capabilities endpoint returns expected response.)
2. MCP smoke check:( Invalid request without valid session is rejected with expected error response.)

Validation run

1. npm test
2. npm run test:e2e:local

closes #147

[github-actions]

This PR is stale because it has been open 15 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR is stale because it has been open with no activity. Remove the stale label or comment to keep it active. Only items with maintainer engagement are auto-closed.

[github-actions]

This PR is stale because it has been open with no activity. Remove the stale label or comment to keep it active. Only items with maintainer engagement are auto-closed.

[JayDS22]

Circling back on this one. A few concerns before it moves forward:

Coverage overlap. The MCP smoke case here (server/cypress/e2e/apap-mcp-smoke.cy.ts:15-29) is already covered by server/handlers/mcp.test.ts:402-416, which asserts the same 400 + "No valid session ID provided" path with a stricter full-envelope toEqual instead of .contain. So of the two tests in this PR, one is a weaker duplicate.

Tool fit. APAP is a headless REST + MCP server (no browser UI). Every existing HTTP-boundary test in server/handlers/ (crud.test.ts, mcp.test.ts, agreements.test.ts, templates.test.ts) uses supertest against the Express app directly. Cypress is a browser E2E framework, and pulling in cypress@^15.13.0 + start-server-and-test@^3.0.0 as dev deps to exercise two HTTP endpoints adds a second E2E stack, a second CI runtime shape, and the Cypress/Electron binaries, all to hit surfaces supertest already covers.

The /capabilities gap is real (nothing in server/handlers/*.test.ts hits it today), but the RI-native fix is ~10 lines in a new handlers/capabilities.test.ts using the same supertest pattern the rest of the suite uses.

Rebase blocker. server/package.json has moved since March: 39882ce2 (test script now ./node_modules/jest/bin/jest.js for Windows runners), 02fb3f0f / #210 (drop crypto stub), plus dependabot bumps. The diff here still targets the old node_modules/.bin/jest form, so the "test" line will conflict on rebase.

tsconfig. The new "exclude" block in server/tsconfig.json is appended after the file's closing } (no newline at end of file), so post-merge the JSON is malformed. npm run build would fail.

Given the coverage overlap on the MCP case and the tooling mismatch for a headless server, my read is this is close-worthy as-is. The /capabilities gap can land as a small supertest addition in handlers/capabilities.test.ts without Cypress. If you'd rather keep this open and rework it into a supertest-based PR that just closes #147, that works too. Otherwise I'll pick up the /capabilities gap directly next week to unblock #147.

[JayDS22]

Circling back with a close since #225 merged the slice-3 pattern and the coverage angle here is now clearly duplicative.

The MCP smoke case in this PR (server/cypress/e2e/apap-mcp-smoke.cy.ts:15-29) asserts the same 400 + "No valid session ID provided" path that server/handlers/mcp.test.ts:402-416 already covers with a stricter full-envelope .toEqual instead of .contain. Landing this would add a second exercise of the same path without new signal.

If there's an end-to-end coverage gap you'd like to close, #147 is the parent issue and open for a fresh scoped PR. Focus areas that would add real value: (a) authenticated resource-read path with a real session id (not covered by unit tests), (b) trigger-agreement wire shape with actual template-engine execution (currently only unit-mocked), (c) SSE-to-Streamable transport disposition once #227 lands.

Closing this out; thanks for flagging the E2E gap in the first place.