fix: use webpack watch mode on port 8065 instead of dev-server on 9005

Switch from 'make dev' (webpack-dev-server on :9005) to 'make run'
(webpack --watch writing to channels/dist/). The Go server on :8065
serves the rebuilt assets directly, so everything is on a single port.

This required adding -ldflags BuildNumber=dev to the air build command.
Without it, the server:
1. Rewrites root.html on startup, stripping 'unsafe-eval' from the
   CSP meta tag
2. Omits 'unsafe-eval' from the HTTP CSP header

Both block the eval-based source maps that webpack watch mode produces,
causing a blank page (React never mounts because all eval() calls in
the bundle are blocked by CSP).

With BuildNumber=dev, the server skips root.html rewriting and adds
'unsafe-eval' + 'unsafe-inline' to the CSP header, matching what
developers get when running 'make run' locally.

Updated all .cursor guidance to reference only port 8065.

Co-authored-by: Nick Misasi <nick13misasi@gmail.com>

.cursor/.air.toml

@@ -13,8 +13,9 @@ root = "."
 tmp_dir = "/tmp/air"
 
 [build]
-  # Build command — same as cursor-cloud-run-server but compiles a binary
-  cmd = "MM_NO_DOCKER=true go build -tags '$(BUILD_TAGS)' -o /tmp/air/mattermost ./cmd/mattermost"
+  # Build command — sets BuildNumber=dev so the server adds 'unsafe-eval' to CSP
+  # (required for webpack watch-mode source maps) and skips rewriting root.html.
+  cmd = "MM_NO_DOCKER=true go build -ldflags '-X github.com/mattermost/mattermost/server/public/model.BuildNumber=dev' -tags '$(BUILD_TAGS)' -o /tmp/air/mattermost ./cmd/mattermost"
   # Binary to run
   bin = "/tmp/air/mattermost"
   # Full binary command with env vars (air <v1.62 doesn't support [build.env])

.cursor/environment.json

@@ -14,9 +14,9 @@
       "description": "Builds and runs the Mattermost backend server on :8065 with hot-reload via Air. Auto-restarts on Go file changes."
     },
     {
-      "name": "Webapp Dev Server",
-      "command": "cd webapp && make dev",
-      "description": "Runs webpack-dev-server on :9005 with hot module replacement. Use http://localhost:9005 (not 8065) to view UI changes live."
+      "name": "Webapp Watcher",
+      "command": "cd webapp && make run",
+      "description": "Runs webpack in watch mode, rebuilding channels/dist/ on file changes. The Go server on :8065 serves the updated assets automatically."
     },
     {
       "name": "Server Tests",
@@ -26,12 +26,8 @@
   ],
   "ports": [
     {
-      "name": "Mattermost Server (API)",
+      "name": "Mattermost",
       "port": 8065
-    },
-    {
-      "name": "Webapp Dev Server (HMR)",
-      "port": 9005
     }
   ]
 }

.cursor/rules/mattermost-dev.mdc

@@ -10,8 +10,8 @@ This environment runs natively on Ubuntu without Docker. PostgreSQL, Redis, and
 
 ## Environment Overview
 
-- **Server**: Go backend at `server/` -- API and static assets on `http://localhost:8065`
-- **Webapp**: React/TypeScript frontend at `webapp/` -- webpack-dev-server on `http://localhost:9005` (use this for UI development)
+- **Server**: Go backend at `server/` -- runs on `http://localhost:8065`
+- **Webapp**: React/TypeScript frontend at `webapp/` -- webpack watch mode rebuilds assets served by the server on `http://localhost:8065`
 - **Database**: PostgreSQL 14 on `localhost:5432` (user: `mmuser`, password: `mostest`, database: `mattermost_test`)
 - **Redis**: `localhost:6379`
 - **Browser**: agent-browser manages headless Chromium on-demand (no persistent Chrome process)
@@ -38,18 +38,18 @@ cd server && make cursor-cloud-run-server
 The server:
 - Sets `MM_NO_DOCKER=true` (skips Docker)
 - Uses `config/config-cursor-cloud.json` (dedicated config for this environment)
-- Serves the API and static webapp assets on `:8065`
-- For live UI development, use the Webapp Dev Server on `:9005` instead
+- Serves the API and webapp assets on `:8065`
+- Built with `BuildNumber=dev` so that webpack watch-mode source maps work correctly
 
-### Run the Webapp Dev Server
+### Webapp Watch Mode
+
+The Webapp Watcher terminal runs webpack in watch mode:
 
 ```bash
-cd webapp && make dev
+cd webapp && make run
 ```
 
-This starts webpack-dev-server with hot module replacement on **port 9005**. Use `http://localhost:9005` to view the webapp during development -- changes to React/TypeScript/SCSS files are picked up automatically without a manual rebuild. The dev server proxies API requests to the Go server on port 8065.
-
-**Important**: When using agent-browser or verifying UI changes, navigate to `http://localhost:9005` (not 8065). Port 8065 serves the last static build and will not reflect webapp source changes until a full `npm run build`.
+This watches for file changes and rebuilds `webapp/channels/dist/` automatically. Since the Go server serves assets from that directory, changes are visible at `http://localhost:8065` after a page reload -- no separate port or dev server needed.
 
 ### Build Webapp Only
 

.cursor/setup-admin.sh

@@ -72,6 +72,6 @@ echo ">>> Adding admin to default team..."
 
 echo ""
 echo ">>> Admin setup complete!"
-echo ">>> Login at http://localhost:9005 (webapp dev server) or http://localhost:8065 (static build)"
+echo ">>> Login at http://localhost:8065"
 echo ">>>   Username: ${ADMIN_USERNAME}"
 echo ">>>   Password: ${ADMIN_PASSWORD}"

.cursor/skills/agent-browser

@@ -0,0 +1 @@
+../../.agents/skills/agent-browser

.cursor/skills/browser-qa.md

@@ -9,18 +9,17 @@ This skill teaches you how to use the `agent-browser` CLI to interact with a run
 
 ## Environment
 
-- **Webapp Dev Server (preferred for UI work)**: `http://localhost:9005` -- serves the webapp with hot module replacement; use this when verifying UI changes
-- **Mattermost Server (API / static build)**: `http://localhost:8065` -- serves the Go API and the last static webapp build; use this for API-only checks or when the dev server is not running
+- **Mattermost URL**: `http://localhost:8065` -- serves both the API and webapp assets
 - **Browser**: agent-browser manages its own headless Chromium (installed via `agent-browser install --with-deps`)
 - **All commands use**: `agent-browser <command>` (no `--cdp` flag needed; agent-browser launches and manages its own browser)
 
-**Important**: When verifying webapp code changes, always use port **9005** (the webpack dev server). Port 8065 serves a static build that does not reflect source changes until `npm run build` is run manually.
+Webapp source changes are picked up automatically by the webpack watcher running in the Webapp Watcher terminal. After a change, reload the page at `http://localhost:8065` to see the update.
 
 ## Quick Start
 
 ```bash
-# 1. Open Mattermost (use port 9005 when the webapp dev server is running)
-agent-browser open http://localhost:9005
+# 1. Open Mattermost
+agent-browser open http://localhost:8065
 
 # 2. Take a snapshot to see interactive elements
 agent-browser snapshot -i
@@ -45,7 +44,7 @@ If sample data was injected (`make inject-test-data`):
 ### Login Flow
 
 ```bash
-agent-browser open http://localhost:9005/login
+agent-browser open http://localhost:8065/login
 agent-browser snapshot -i
 
 # Find the login input (look for input with name="loginId" or placeholder containing "Email" or "Username")
@@ -90,7 +89,7 @@ cd server && make cursor-cloud-setup-admin
 ```
 
 If you need to set up via browser instead (e.g., testing the signup flow):
-1. Navigate to `http://localhost:9005` (or `http://localhost:8065` if the dev server is not running) - it will redirect to `/signup_user_complete`
+1. Navigate to `http://localhost:8065` - it will redirect to `/signup_user_complete`
 2. Fill in email, username, password
 3. The first account automatically becomes system admin
 4. Complete or skip the onboarding wizard
@@ -113,7 +112,7 @@ If you need to set up via browser instead (e.g., testing the signup flow):
 
 ```bash
 # Navigate to a channel (e.g., Town Square)
-agent-browser open http://localhost:9005/dev/channels/town-square
+agent-browser open http://localhost:8065/dev/channels/town-square
 agent-browser wait --load networkidle
 agent-browser snapshot -i
 
@@ -144,7 +143,7 @@ agent-browser snapshot -i
 
 ```bash
 # Option 1: Direct URL navigation
-agent-browser open http://localhost:9005/dev/channels/off-topic
+agent-browser open http://localhost:8065/dev/channels/off-topic
 
 # Option 2: Click channel in sidebar
 agent-browser snapshot -i
@@ -225,10 +224,9 @@ npx playwright test --grep "relevant test pattern"
 
 ### Page not loading
 ```bash
-# Verify Mattermost server is running (API is always on 8065)
+# Verify Mattermost server is running
 curl -s http://localhost:8065/api/v4/system/ping
 # If not, check the Mattermost Server terminal
-# If the API works but the UI on :9005 doesn't load, check the Webapp Dev Server terminal
 ```
 
 ### Stale refs

.cursor/skills/skill-creator

@@ -0,0 +1 @@
+../../.agents/skills/skill-creator