Add authenticated website test harness

ci/README.md

@@ -1,5 +1,9 @@
 # WebBrain Cloud E2E
 
+Persistent authenticated account workflows use the separate opt-in
+[authenticated runner](../website-tests/README.md). They do not run
+in this public/incognito CI suite or inherit its mutation permissions.
+
 `ci/` runs catalogued browser-agent scenarios in a fresh WebBrain Cloud
 incognito browser. Each scenario produces a structured result, exported trace,
 deterministic rubric, optional `.webm` recording, and a suite summary.

package.json

@@ -5,6 +5,9 @@
   "private": true,
   "type": "module",
   "scripts": {
+    "authenticated": "npm --prefix website-tests run cli --",
+    "test:authenticated": "npm --prefix website-tests test",
+    "test:authenticated:installed": "npm --prefix website-tests run test:installed",
     "test": "npm run test:failure-recovery && npm run test:shard:quick && npm run test:shard:runtime-unit && npm run test:shard:browser-a && npm run test:shard:browser-b1 && npm run test:shard:browser-b2 && npm run test:shard:browser-c && npm run test:shard:tail",
     "test:failure-recovery": "node --test test/failure-recovery.mjs test/failure-recovery-ui.mjs test/post-submit-model-recovery.mjs test/run-ui-response-retry.mjs test/ask-stream-retry-ui.mjs",
     "test:captcha:ui": "node test/captcha-settings-ui.mjs && node test/captcha-application-ui.mjs",

test/README.md

@@ -1,5 +1,10 @@
 # Tests
 
+Authenticated local/Cloud workflows are separately opt-in. See
+[the setup, scenario matrix and verification limits](../website-tests/README.md).
+`npm run test:authenticated` checks the harness without live accounts;
+`npm run authenticated -- dry-run --target live` previews scoped live cases.
+
 Three layers, each with a different scope, speed, and cost profile.
 
 ## Setup (once)

website-tests/.env.example

@@ -0,0 +1,39 @@
+# Private authenticated test settings. Copy to .env; never commit the populated file.
+# Also copy config.example.json to .env.authenticated.json.
+WBTEST_CONFIG=.env.authenticated.json
+WBTEST_TARGET=fixtures
+WBTEST_SITES=
+WBTEST_SCENARIOS=
+WBTEST_LIVE_MUTATIONS=false
+WBTEST_ALLOWED_ACTIONS=
+WBTEST_ARTIFACTS=artifacts
+WBTEST_MAX_RUNS=90
+WBTEST_TIMEOUT_MS=180000
+WBTEST_REPETITIONS=1
+
+# A performs the task. Choose local or cloud explicitly.
+WBTEST_ACTOR_BACKEND=local
+WBTEST_ACTOR_PROFILE=
+WBTEST_ACTOR_CDP_URL=
+WBTEST_ACTOR_EXECUTABLE=
+WBTEST_ACTOR_EXTENSION_PATH=
+WBTEST_ACTOR_EXTENSION_ID=
+WBTEST_ACTOR_HEADLESS=false
+WBTEST_ACTOR_PROVIDER=
+WBTEST_ACTOR_MODEL=
+WBTEST_ACTOR_EXPECTED_VERSION=
+# Local build pin means the reported four-file runtime SHA-256, not a Git SHA.
+WBTEST_ACTOR_EXPECTED_BUILD=
+WEBBRAIN_BASE_URL=https://webbrain.cloud
+WEBBRAIN_API_KEY=
+WBTEST_ACTOR_SESSION_ID=
+
+# B receives/verifies independently. A local observer needs no WebBrain/provider.
+WBTEST_OBSERVER_BACKEND=local
+WBTEST_OBSERVER_PROFILE=
+WBTEST_OBSERVER_CDP_URL=
+WBTEST_OBSERVER_EXECUTABLE=
+WBTEST_OBSERVER_HEADLESS=false
+WEBBRAIN_OBSERVER_BASE_URL=https://webbrain.cloud
+WEBBRAIN_OBSERVER_API_KEY=
+WBTEST_OBSERVER_SESSION_ID=

website-tests/.gitignore

@@ -0,0 +1,7 @@
+.env
+.env.*
+!.env.example
+artifacts/
+profiles/
+node_modules/
+*.private.json