api-harness

API harness CLI contract

Use the API harness to drive Agentweaver through its REST API, capture the complete request/response evidence, and emit a normalized agentweaver.persona-judge-verdict/v1 JSON verdict. It is for backend/API end-to-end validation; use the UI or MCP harness for those surfaces.

Run all commands below from the repository root. The harness requires Node 18 or newer. At its first authenticated call, it obtains the complete Authorization value only through the cached UI-harness recorder-session provider, in memory, and never accepts bearer material in process arguments or borrows gh auth token or GITHUB_TOKEN for a remote target.

Browser-managed authentication for staging (Entra Conditional Access)

Agentweaver staging uses Entra Conditional Access. Before an authenticated API run, run the documented demo-recording session setup once for that target. The recorder-session provider reads its cached UI storage/session sidecar, verifies it belongs to the requested origin, and returns the complete Authorization value only in memory. Pass that value to the header unchanged; do not add another scheme. It never starts a second browser sign-in or exports the value to an environment variable, CLI argument, transcript, finding, verdict, or log:

node scripts/api-harness/run-persona.mjs `
  --scenario generated-artifacts-seam `
  --target https://<host>.staging.<domain>

The provider uses scripts/demo-recording/.auth/recording.storageState.json and its .sessionStorage.json sidecar by default; use --recorder-auth-root only for an explicitly chosen protected auth root. To reuse a supported UI login:

node scripts/api-harness/run-persona.mjs --scenario generated-artifacts-seam --target https://<host>.staging.<domain> --recorder-auth-root scripts/ui-harness/.auth

run-oracle-acceptance.mjs accepts the same --recorder-auth-root; the context budget CLI uses --auth-root scripts/ui-harness/.auth. In an explicit root, recording.storageState.json takes precedence if both layouts exist; otherwise staging.storageState.json and its matching seed are used. No search in another directory or fallback after an invalid selected cache occurs. --auth-provider recorder-session remains accepted for clarity but is the default. If the cached recorder session is absent, expired, or belongs to another origin, it fails with npm run demo:record -- open --base-url <origin> for the recorder layout, or node scripts/ui-harness/login-chrome-default.mjs --base-url <origin> for the selected UI layout. Microsoft Entra account selection, credentials, MFA, and consent remain human-only. For a decoded JWT with an exp claim, a provider reuses the in-memory Authorization value only while it remains unexpired. After expiry it revalidates the same selected cache path and origin; a refreshed session can be reused without creating a new provider, but an expired or wrong-origin replacement fails before an API call. Tokens without a decodable expiry retain the existing behavior. Do not fall back to generic Playwright, direct CDP/DevTools, ad-hoc profile launch/copy, or manual browser automation; surface the provider's recovery error and use the demo-recording login/cached-session flow. That flow requires the installed literal Google Chrome chrome.exe on Playwright's chrome channel, never bundled Chromium.