feat(gateway): add headless invoke command by aidandaly24 · Pull Request #1967 · aws/agentcore-cli

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

aidandaly24 · 2026-08-10T21:49:05Z

Summary

add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
redact path, payload, application-header, and bearer-token values from command debug logs
preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
share the streaming response writer with Runtime invoke while preserving Runtime behavior
keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

bun test: 1,087 passed, 0 failed on current refactor
bun run typecheck
bun run lint:check
bun run format:check
bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
Outbound API key: successful API Gateway MCP target invocation
Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

codecov-commenter · 2026-08-10T21:56:49Z

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #1967 +/- ##
============================================
+ Coverage 96.91% 96.94% +0.02% 
============================================
Files 356 360 +4 Lines 20136 20596 +460 ============================================
+ Hits 19515 19966 +451 - Misses 621 630 +9

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nborges-aws

LGTM thanks for fixes!

tejaskash

👍

github-actionsBot added the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 10, 2026

aidandaly24 force-pushed the feat/gateway-invoke branch from 70955f5 to be653e2Compare August 10, 2026 21:53

github-actionsBot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 10, 2026

aidandaly24 marked this pull request as ready for review August 11, 2026 14:27

aidandaly24 force-pushed the feat/gateway-invoke branch from 884a63b to 9b136d4Compare August 11, 2026 23:15

aidandaly24 mentioned this pull request Aug 11, 2026
feat(gateway): add interactive invoke console #1978
Merged

aidandaly24 requested review from jariy17 and nborges-aws August 12, 2026 14:18

tejaskash previously approved these changes Aug 12, 2026
View reviewed changes

nborges-aws reviewed Aug 13, 2026
View reviewed changes

Comment threadsrc/io/streamingResponse.ts

aidandaly24 dismissed tejaskash’s stale review via 30eeb82August 13, 2026 16:33

aidandaly24 force-pushed the feat/gateway-invoke branch from 9b136d4 to 30eeb82Compare August 13, 2026 16:33

tejaskash previously approved these changes Aug 13, 2026
View reviewed changes

nborges-aws previously approved these changes Aug 13, 2026
View reviewed changes

aidandaly24 added 8 commits August 13, 2026 19:34

feat(gateway): add headless invoke command
d2b99a7

fix(gateway): preserve responses and redact paths
fa2ad49

fix(gateway): sign authenticate-only invocations
26cff61

test(gateway): update client construction after rebase
45dd7ec

fix(gateway): allow empty no-content responses on TTY
c612118

test(gateway): update mutation helper dependencies
fb647c3

fix(gateway): preserve raw query values for SigV4
b48c5d9

fix(gateway): remove rebase conflict markers
d40be7e

aidandaly24 dismissed stale reviews from nborges-aws and tejaskash via d40be7eAugust 13, 2026 19:41

aidandaly24 force-pushed the feat/gateway-invoke branch from 30eeb82 to d40be7eCompare August 13, 2026 19:41

aidandaly24 requested review from nborges-aws and tejaskash August 13, 2026 19:42

tejaskash approved these changes Aug 13, 2026
View reviewed changes

nborges-aws approved these changes Aug 13, 2026
View reviewed changes

aidandaly24 merged commit 2d79b36 into refactorAug 13, 2026
13 checks passed

aidandaly24 deleted the feat/gateway-invoke branch August 13, 2026 19:43