p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/src/cli/commands/validate-issue.ts

@@ -0,0 +1,72 @@
+import { loadHarnessConfig } from "../../config/load-config.js";
+import { EXIT_CONFIG, EXIT_RUN_FAILURE, EXIT_SUCCESS } from "../exit-codes.js";
+import {
+  resolveValidationExitCode,
+  validateIssue,
+} from "../../validate/issue.js";
+import { formatValidationReport } from "../../validate/report.js";
+import type { IntendedPhase } from "../../validate/types.js";
+
+export interface ValidateIssueCommandOptions {
+  configPath: string;
+  filePath?: string;
+  issueKey?: string;
+  intendedPhase?: string;
+  json?: boolean;
+}
+
+function parseIntendedPhase(value: string | undefined): IntendedPhase | undefined {
+  if (!value) {
+    return undefined;
+  }
+  if (value === "planning" || value === "implementation") {
+    return value;
+  }
+  throw new Error(
+    `Invalid --intended-phase "${value}"; expected planning or implementation`,
+  );
+}
+
+export async function runValidateIssue(
+  options: ValidateIssueCommandOptions,
+): Promise<number> {
+  const hasFile = Boolean(options.filePath);
+  const hasIssue = Boolean(options.issueKey);
+
+  if (hasFile === hasIssue) {
+    console.error("Exactly one of --file or --issue is required");
+    return EXIT_CONFIG;
+  }
+
+  let intendedPhase: IntendedPhase | undefined;
+  try {
+    intendedPhase = parseIntendedPhase(options.intendedPhase);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return EXIT_CONFIG;
+  }
+
+  try {
+    await loadHarnessConfig({ configPath: options.configPath });
+    const result = await validateIssue({
+      configPath: options.configPath,
+      filePath: options.filePath,
+      issueKey: options.issueKey,
+      intendedPhase,
+      linearApiKey: process.env.LINEAR_API_KEY,
+    });
+
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      process.stdout.write(formatValidationReport(result));
+    }
+
+    return resolveValidationExitCode(result) === 0
+      ? EXIT_SUCCESS
+      : EXIT_RUN_FAILURE;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return EXIT_CONFIG;
+  }
+}

package/workspace-snapshot/files/src/cli/exit-codes.ts

@@ -0,0 +1,4 @@
+export const EXIT_SUCCESS = 0;
+export const EXIT_CONFIG = 1;
+export const EXIT_RUN_FAILURE = 2;
+export const EXIT_PLANNING_FAILURE = 3;

package/workspace-snapshot/files/src/cli/finalize-exit.ts

@@ -0,0 +1,9 @@
+/**
+ * Cursor SDK runs can leave active handles after a successful phase chain.
+ * Explicitly exit so GitHub Actions does not hold per-issue concurrency open.
+ */
+export function finalizeCliExit(exitCode: number | string | null | undefined): never {
+  const code =
+    typeof exitCode === "number" && Number.isFinite(exitCode) ? exitCode : 0;
+  process.exit(code);
+}

package/workspace-snapshot/files/src/cli/program.ts

@@ -0,0 +1,200 @@
+import { Command } from "commander";
+import {
+  DISPATCH_PHASE_CLI_DESCRIPTION,
+  RUN_PHASE_CLI_DESCRIPTION,
+} from "../runner/phase-args.js";
+import { runDoctor } from "./commands/doctor.js";
+import { runInspect } from "./commands/inspect.js";
+import { runRunCommand } from "./commands/run.js";
+import { runValidateIssue } from "./commands/validate-issue.js";
+import { runSyncProductionCommand } from "./commands/sync-production.js";
+import { runResolveRouteCommand } from "./commands/resolve-route.js";
+import { runRedactOutputCommand } from "./commands/redact-output.js";
+import { runDiagnoseVercelBridgeCommand } from "./commands/diagnose-vercel-bridge.js";
+import { runOperatorInit } from "./commands/operator-init.js";
+
+export function createProgram(): Command {
+  const program = new Command();
+
+  program
+    .name("harness")
+    .description("Agentic product development harness runner")
+    .option(
+      "--config <path>",
+      "Path to harness.config.json (explicit flag overrides HARNESS_CONFIG_* env)",
+      "harness.config.json",
+    );
+
+  program
+    .command("doctor")
+    .description("Validate config, allowlist, and optional Linear auth")
+    .option(
+      "--profile <profile>",
+      "Validation profile: full (default) or merge (GitHub/Linear only)",
+      "full",
+    )
+    .action(async (options: { profile?: string }) => {
+      const configPath = program.opts<{ config: string }>().config;
+      const profile = options.profile === "merge" ? "merge" : "full";
+      const exitCode = await runDoctor({ configPath, profile });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("run")
+    .description("Run harness against a Linear issue")
+    .requiredOption("--issue <key>", "Linear issue key, e.g. WES-11")
+    .option("--dry-run", "Parse and resolve without side effects", false)
+    .option(
+      "--phase <phase>",
+      `Run phase: ${RUN_PHASE_CLI_DESCRIPTION} (default: auto for live runs)`,
+      "auto",
+    )
+    .option("--force", "Re-run planning even when idempotency markers exist", false)
+    .option("--fixture <path>", "Load issue description from a local markdown fixture")
+    .option("--json", "Print manifest JSON to stdout", false)
+    .action(async (opts) => {
+      const configPath = program.opts<{ config: string }>().config;
+      const exitCode = await runRunCommand({
+        issueKey: opts.issue,
+        configPath,
+        dryRun: opts.dryRun,
+        fixturePath: opts.fixture,
+        json: opts.json,
+        phase: opts.phase,
+        force: opts.force,
+      });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("inspect")
+    .description("Inspect a prior harness run directory")
+    .requiredOption("--run <path>", "Path to run directory under runs/")
+    .action(async (opts) => {
+      const exitCode = await runInspect({ runPath: opts.run });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("validate-issue")
+    .description("Validate a Linear issue description without side effects")
+    .option("--file <path>", "Path to issue markdown file")
+    .option("--issue <key>", "Linear issue key, e.g. WES-11")
+    .option(
+      "--intended-phase <phase>",
+      "Route-specific validation: planning or implementation",
+    )
+    .option("--json", "Print validation result JSON to stdout", false)
+    .action(async (opts) => {
+      const configPath = program.opts<{ config: string }>().config;
+      const exitCode = await runValidateIssue({
+        configPath,
+        filePath: opts.file,
+        issueKey: opts.issue,
+        intendedPhase: opts.intendedPhase,
+        json: opts.json,
+      });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("resolve-route")
+    .description("Resolve harness phase and target repo for workflow routing")
+    .requiredOption("--issue <key>", "Linear issue key, e.g. WES-11")
+    .option(
+      "--phase <phase>",
+      `Phase override: ${DISPATCH_PHASE_CLI_DESCRIPTION}`,
+      "auto",
+    )
+    .option("--json", "Print route JSON to stdout", false)
+    .option(
+      "--github-output",
+      "Append route fields to GITHUB_OUTPUT for Actions",
+      false,
+    )
+    .action(async (opts) => {
+      const configPath = program.opts<{ config: string }>().config;
+      const exitCode = await runResolveRouteCommand({
+        issueKey: opts.issue,
+        configPath,
+        phase: opts.phase,
+        json: opts.json,
+        githubOutput: opts.githubOutput,
+      });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("sync-production")
+    .description("Sync Linear issues from Merged to Dev to Merged / Deployed when promoted")
+    .option("--repo <id>", "Repo config id, e.g. target-app")
+    .option("--issue <key>", "Single Linear issue key, e.g. WES-11")
+    .option(
+      "--source-repo <slug>",
+      "Dispatch sourceRepo slug, e.g. owner/example-target-app",
+    )
+    .option(
+      "--production-branch <branch>",
+      "Dispatch productionBranch, e.g. main",
+    )
+    .option("--ref <ref>", "Dispatch git ref, e.g. refs/heads/main")
+    .option("--dry-run", "Inspect without Linear writes", false)
+    .option("--force", "Re-run even when markers exist", false)
+    .option("--json", "Print sync summary JSON to stdout", false)
+    .action(async (opts) => {
+      const configPath = program.opts<{ config: string }>().config;
+      const exitCode = await runSyncProductionCommand({
+        configPath,
+        repo: opts.repo,
+        issue: opts.issue,
+        sourceRepo: opts.sourceRepo,
+        productionBranch: opts.productionBranch,
+        ref: opts.ref,
+        dryRun: opts.dryRun,
+        force: opts.force,
+        json: opts.json,
+      });
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("redact-output")
+    .description("Read stdin and write redacted JSON or text to stdout")
+    .action(async () => {
+      const exitCode = await runRedactOutputCommand();
+      process.exitCode = exitCode;
+    });
+
+  program
+    .command("diagnose-vercel-bridge")
+    .description(
+      "Print a redacted JSON diagnostic report for Configure Step 3 Vercel bridge verification",
+    )
+    .option(
+      "--live-probe",
+      "Send a fresh signed webhook probe (default is read-only diagnostics only)",
+      false,
+    )
+    .action(async (opts: { liveProbe?: boolean }) => {
+      const exitCode = await runDiagnoseVercelBridgeCommand({
+        liveProbe: opts.liveProbe === true,
+      });
+      process.exitCode = exitCode;
+    });
+
+  const operator = program
+    .command("operator")
+    .description("Operator setup helpers");
+
+  operator
+    .command("init")
+    .description("Create local .env.local and .harness/config.local.json from examples")
+    .option("--force", "Overwrite existing local files", false)
+    .action(async (opts: { force?: boolean }) => {
+      const exitCode = await runOperatorInit({ force: opts.force ?? false });
+      process.exitCode = exitCode;
+    });
+
+  return program;
+}

package/workspace-snapshot/files/src/config/defaults.ts

@@ -0,0 +1,33 @@
+export const DEFAULT_ORCHESTRATOR_MARKER = "harness-orchestrator-v1";
+export const DEFAULT_LOG_DIRECTORY = "runs";
+/** Written to manifest.milestone; tracks harness release-prep phase, not M-number docs. */
+export const RELEASE_PHASE = "v0.3-prep";
+/** @deprecated Use RELEASE_PHASE. Kept for existing imports. */
+export const MILESTONE = RELEASE_PHASE;
+// Standard/basic Composer 2.5. Intentionally NOT the Fast variant
+// (`composer-2.5-fast`) and never combined with Max mode — see
+// `src/cursor/model.ts` for the cost-control rationale.
+export const DEFAULT_MODEL_ID = "composer-2.5";
+export const PLANNING_PROMPT_VERSION = "planning@1";
+export const IMPLEMENTATION_PROMPT_VERSION = "implementation@1";
+export const HANDOFF_PROMPT_VERSION = "handoff@1";
+export const REVISION_PROMPT_VERSION = "revision@1";
+export const MERGE_PROMPT_VERSION = "merge@1";
+export const INTEGRATION_REPAIR_PROMPT_VERSION = "integration-repair@1";
+export const PRODUCTION_SYNC_PROMPT_VERSION = "production-sync@1";
+export const DEFAULT_PLANNING_TIMEOUT_SECONDS = 1800;
+export const DEFAULT_IMPLEMENTATION_TIMEOUT_SECONDS = 3600;
+export const DEFAULT_IMPLEMENTATION_BRANCH_PREFIX = "cursor";
+export const DEFAULT_PREVIEW_POLL_TIMEOUT_SECONDS = 300;
+export const DEFAULT_PREVIEW_POLL_INTERVAL_SECONDS = 15;
+export const DEFAULT_HANDOFF_ALLOW_PM_REVIEW_WITHOUT_PREVIEW = true;
+export const DEFAULT_REVISION_TIMEOUT_SECONDS = 3600;
+export const DEFAULT_MERGE_METHOD = "squash";
+export const DEFAULT_MERGE_DELETE_BRANCH = false;
+export const DEFAULT_MERGE_ALLOW_PENDING_CHECKS = false;
+export const DEFAULT_MERGE_ALLOW_UNKNOWN_CHECKS = false;
+export const DEFAULT_MERGE_ALLOW_NEUTRAL_CHECKS = true;
+export const DEFAULT_MERGE_DEPLOYMENT_REQUIRED = false;
+export const DEFAULT_MERGE_DEPLOYMENT_POLL_TIMEOUT_SECONDS = 300;
+export const DEFAULT_MERGE_DEPLOYMENT_POLL_INTERVAL_SECONDS = 15;
+export const DEFAULT_MERGE_CHECK_POLL_TIMEOUT_SECONDS = 120;

package/workspace-snapshot/files/src/config/load-config.ts

@@ -0,0 +1,80 @@
+import path from "node:path";
+import { readFile } from "node:fs/promises";
+import { harnessConfigSchema, type HarnessConfig } from "./schema.js";
+import { normalizeRepoUrl } from "../resolver/normalize-repo.js";
+import {
+  readConfigRaw,
+  resolveConfigSource,
+  type ResolvedConfigSource,
+} from "./resolve-config.js";
+
+export class ConfigError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ConfigError";
+  }
+}
+
+export interface LoadedHarnessConfig {
+  config: HarnessConfig;
+  source: ResolvedConfigSource;
+}
+
+function parseConfigRaw(raw: string, sourceLabel: string): HarnessConfig {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new ConfigError(`Config is not valid JSON: ${sourceLabel}`);
+  }
+
+  const result = harnessConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const details = result.error.issues
+      .map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+      .join("; ");
+    throw new ConfigError(`Invalid harness config: ${details}`);
+  }
+
+  validateRepoClosure(result.data);
+  return result.data;
+}
+
+export async function loadHarnessConfig(options?: {
+  baseDir?: string;
+  configPath?: string;
+}): Promise<LoadedHarnessConfig> {
+  const source = resolveConfigSource(options);
+  const raw = await readConfigRaw(source);
+  const config = parseConfigRaw(raw, source.label);
+  return { config, source };
+}
+
+/** Load config from an explicit file path (tests and direct file reads). */
+export async function loadConfig(configPath: string): Promise<HarnessConfig> {
+  const absolutePath = path.resolve(configPath);
+  let raw: string;
+
+  try {
+    raw = await readFile(absolutePath, "utf8");
+  } catch {
+    throw new ConfigError(`Config file not found: ${absolutePath}`);
+  }
+
+  return parseConfigRaw(raw, absolutePath);
+}
+
+export function validateRepoClosure(config: HarnessConfig): void {
+  const allowed = new Set(
+    config.allowedTargetRepos.map((url) => normalizeRepoUrl(url)),
+  );
+
+  for (const repo of config.repos) {
+    const normalized = normalizeRepoUrl(repo.targetRepo);
+    if (!allowed.has(normalized)) {
+      throw new ConfigError(
+        `repos[].targetRepo "${repo.targetRepo}" is not listed in allowedTargetRepos`,
+      );
+    }
+  }
+}

package/workspace-snapshot/files/src/config/load-dotenv.ts

@@ -0,0 +1,11 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import dotenv from "dotenv";
+
+export function loadHarnessDotenv(cwd = process.cwd()): void {
+  dotenv.config({ path: path.join(cwd, ".env") });
+  const localPath = path.join(cwd, ".env.local");
+  if (existsSync(localPath)) {
+    dotenv.config({ path: localPath, override: true });
+  }
+}

package/workspace-snapshot/files/src/config/resolve-config.ts

@@ -0,0 +1,127 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { ConfigError } from "./load-config.js";
+
+export type ConfigSourceKind =
+  | "cli-config"
+  | "HARNESS_CONFIG_JSON_B64"
+  | "HARNESS_CONFIG_JSON"
+  | "HARNESS_CONFIG_PATH"
+  | "default-file";
+
+export interface ResolvedConfigSource {
+  kind: ConfigSourceKind;
+  label: string;
+  raw: string;
+}
+
+const DEFAULT_CONFIG_PATH = "harness.config.json";
+
+function readExplicitCliConfigPath(): string | null {
+  const argv = process.argv;
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+
+    if (arg === "--config") {
+      const nextArg = argv[index + 1];
+      if (nextArg === undefined || nextArg.startsWith("-")) {
+        throw new ConfigError("--config requires a path argument");
+      }
+      return nextArg;
+    }
+
+    if (arg.startsWith("--config=")) {
+      const value = arg.slice("--config=".length);
+      if (!value) {
+        throw new ConfigError("--config requires a path argument");
+      }
+      return value;
+    }
+  }
+
+  return null;
+}
+
+function decodeBase64Config(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed || !/^[A-Za-z0-9+/]+={0,2}$/.test(trimmed)) {
+    throw new ConfigError("Invalid HARNESS_CONFIG_JSON_B64: not valid base64");
+  }
+
+  try {
+    return Buffer.from(trimmed, "base64").toString("utf8");
+  } catch {
+    throw new ConfigError("Invalid HARNESS_CONFIG_JSON_B64: not valid base64");
+  }
+}
+
+function resolvePathAgainstBase(baseDir: string, targetPath: string): string {
+  return path.isAbsolute(targetPath)
+    ? path.resolve(targetPath)
+    : path.resolve(baseDir, targetPath);
+}
+
+export function resolveConfigSource(options?: {
+  baseDir?: string;
+  configPath?: string;
+}): ResolvedConfigSource {
+  const baseDir = options?.baseDir?.trim() || process.cwd();
+  const explicitCliPath = readExplicitCliConfigPath();
+  if (explicitCliPath) {
+    const absolutePath = resolvePathAgainstBase(baseDir, explicitCliPath);
+    return {
+      kind: "cli-config",
+      label: absolutePath,
+      raw: "",
+    };
+  }
+
+  const b64 = process.env.HARNESS_CONFIG_JSON_B64?.trim();
+  if (b64) {
+    return {
+      kind: "HARNESS_CONFIG_JSON_B64",
+      label: "HARNESS_CONFIG_JSON_B64",
+      raw: decodeBase64Config(b64),
+    };
+  }
+
+  const inlineJson = process.env.HARNESS_CONFIG_JSON?.trim();
+  if (inlineJson) {
+    return {
+      kind: "HARNESS_CONFIG_JSON",
+      label: "HARNESS_CONFIG_JSON",
+      raw: inlineJson,
+    };
+  }
+
+  const envPath = process.env.HARNESS_CONFIG_PATH?.trim();
+  if (envPath) {
+    const absolutePath = resolvePathAgainstBase(baseDir, envPath);
+    return {
+      kind: "HARNESS_CONFIG_PATH",
+      label: absolutePath,
+      raw: "",
+    };
+  }
+
+  const fallbackPath = options?.configPath?.trim() || DEFAULT_CONFIG_PATH;
+  const absolutePath = resolvePathAgainstBase(baseDir, fallbackPath);
+  return {
+    kind: "default-file",
+    label: absolutePath,
+    raw: "",
+  };
+}
+
+export async function readConfigRaw(source: ResolvedConfigSource): Promise<string> {
+  if (source.raw) {
+    return source.raw;
+  }
+
+  try {
+    return await readFile(source.label, "utf8");
+  } catch {
+    throw new ConfigError(`Config file not found: ${source.label}`);
+  }
+}

package/workspace-snapshot/files/src/config/schema.ts

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import {
+  DEFAULT_IMPLEMENTATION_BRANCH_PREFIX,
+  DEFAULT_LOG_DIRECTORY,
+  DEFAULT_ORCHESTRATOR_MARKER,
+} from "./defaults.js";
+
+const githubRepoUrl = z
+  .string()
+  .regex(
+    /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/?$/,
+    "must be a https://github.com/<owner>/<repo> URL",
+  );
+
+const repoMappingSchema = z.object({
+  id: z.string().min(1),
+  linearProjects: z.array(z.string()).optional(),
+  linearTeams: z.array(z.string()).optional(),
+  targetRepo: githubRepoUrl,
+  baseBranch: z.string().min(1).default("main"),
+  productionBranch: z.string().min(1).default("main"),
+  previewProvider: z.string().optional(),
+  integrationPreviewUrl: z.string().url().optional(),
+  productionUrl: z.string().url().optional(),
+  integrationSuccessStatus: z.string().min(1).optional(),
+  productionSuccessStatus: z.string().min(1).optional(),
+  validation: z
+    .object({
+      commands: z.array(z.string()).optional(),
+    })
+    .optional(),
+});
+
+const linearConfigSchema = z.object({
+  teamKey: z.string().optional(),
+  eligibleStatuses: z
+    .object({
+      planning: z.array(z.string()).optional(),
+      implementation: z.array(z.string()).optional(),
+      handoff: z.array(z.string()).optional(),
+      revision: z.array(z.string()).optional(),
+      merge: z.array(z.string()).optional(),
+    })
+    .optional(),
+  transitionalStatuses: z
+    .object({
+      planningInProgress: z.string().optional(),
+      buildingInProgress: z.string().optional(),
+      prOpen: z.string().optional(),
+      pmReview: z.string().optional(),
+      blocked: z.string().optional(),
+      readyForBuild: z.string().optional(),
+      needsRevision: z.string().optional(),
+      revisingInProgress: z.string().optional(),
+      readyToMerge: z.string().optional(),
+      mergingInProgress: z.string().optional(),
+      mergedToDev: z.string().optional(),
+      mergedDeployed: z.string().optional(),
+    })
+    .optional(),
+});
+
+const planningConfigSchema = z.object({
+  timeoutSeconds: z.number().positive().optional(),
+});
+
+const implementationConfigSchema = z.object({
+  timeoutSeconds: z.number().positive().optional(),
+  branchPrefix: z.string().min(1).default(DEFAULT_IMPLEMENTATION_BRANCH_PREFIX),
+});
+
+const handoffConfigSchema = z.object({
+  allowPmReviewWithoutPreview: z.boolean().optional(),
+  previewRequiredForSuccess: z.boolean().optional(),
+});
+
+const revisionConfigSchema = z.object({
+  timeoutSeconds: z.number().positive().optional(),
+});
+
+const mergeConfigSchema = z.object({
+  mergeMethod: z.enum(["squash", "merge", "rebase"]).optional(),
+  deleteBranchAfterMerge: z.boolean().optional(),
+  allowPendingChecks: z.boolean().optional(),
+  allowUnknownChecks: z.boolean().optional(),
+  allowNeutralChecks: z.boolean().optional(),
+  deploymentRequiredForSuccess: z.boolean().optional(),
+  deploymentPollTimeoutSeconds: z.number().positive().optional(),
+  deploymentPollIntervalSeconds: z.number().positive().optional(),
+  checkPollTimeoutSeconds: z.number().positive().optional(),
+});
+
+const agentProviderSchema = z.object({
+  id: z.literal("cursor"),
+  model: z.object({ id: z.string() }).optional(),
+});
+
+export const harnessConfigSchema = z
+  .object({
+    version: z.literal(1),
+    orchestratorMarker: z.string().default(DEFAULT_ORCHESTRATOR_MARKER),
+    logDirectory: z.string().default(DEFAULT_LOG_DIRECTORY),
+    agentProvider: agentProviderSchema.optional(),
+    defaultModel: z.object({ id: z.string() }).optional(),
+    linear: linearConfigSchema.optional(),
+    planning: planningConfigSchema.optional(),
+    implementation: implementationConfigSchema.optional(),
+    handoff: handoffConfigSchema.optional(),
+    revision: revisionConfigSchema.optional(),
+    merge: mergeConfigSchema.optional(),
+    watch: z
+      .object({
+        pollIntervalSeconds: z.number().positive().optional(),
+        maxConcurrentRuns: z.number().positive().optional(),
+      })
+      .optional(),
+    preview: z
+      .object({
+        pollTimeoutSeconds: z.number().positive().optional(),
+        pollIntervalSeconds: z.number().positive().optional(),
+      })
+      .optional(),
+    repos: z.array(repoMappingSchema).min(1),
+    allowedTargetRepos: z.array(githubRepoUrl).min(1),
+  })
+  .strict();
+
+export type HarnessConfig = z.infer<typeof harnessConfigSchema>;
+export type RepoMapping = z.infer<typeof repoMappingSchema>;