p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/src/setup/env-merge.ts

@@ -0,0 +1,266 @@
+import { readFile, stat } from "node:fs/promises";
+import { access } from "node:fs/promises";
+import {
+  collectEnvInputSecrets,
+  redactSecretEnvContent,
+} from "./redact-secrets.js";
+import {
+  DEFAULT_HARNESS_CONFIG_PATH,
+  type LocalFilePaths,
+  type SetupEnvInput,
+} from "./setup-state.js";
+
+const SECRET_KEYS = [
+  "LINEAR_API_KEY",
+  "CURSOR_API_KEY",
+  "GITHUB_TOKEN",
+  "VERCEL_TOKEN",
+] as const;
+
+const MANAGED_KEYS = [
+  "HARNESS_CONFIG_PATH",
+  "GITHUB_DISPATCH_REPOSITORY",
+  "GITHUB_DISPATCH_REPOSITORY_ID",
+  ...SECRET_KEYS,
+] as const;
+
+type ManagedKey = (typeof MANAGED_KEYS)[number];
+
+export interface EnvKeyPresence {
+  HARNESS_CONFIG_PATH: boolean;
+  GITHUB_DISPATCH_REPOSITORY: boolean;
+  GITHUB_DISPATCH_REPOSITORY_ID: boolean;
+  LINEAR_API_KEY: boolean;
+  CURSOR_API_KEY: boolean;
+  GITHUB_TOKEN: boolean;
+  VERCEL_TOKEN: boolean;
+}
+
+export interface ParsedEnvFile {
+  values: Record<string, string>;
+  presence: EnvKeyPresence;
+}
+
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isManagedKey(key: string): key is ManagedKey {
+  return (MANAGED_KEYS as readonly string[]).includes(key);
+}
+
+export function parseEnvFileContent(content: string): ParsedEnvFile {
+  const values: Record<string, string> = {};
+  const presence: EnvKeyPresence = {
+    HARNESS_CONFIG_PATH: false,
+    GITHUB_DISPATCH_REPOSITORY: false,
+    GITHUB_DISPATCH_REPOSITORY_ID: false,
+    LINEAR_API_KEY: false,
+    CURSOR_API_KEY: false,
+    GITHUB_TOKEN: false,
+    VERCEL_TOKEN: false,
+  };
+
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) {
+      continue;
+    }
+    const key = trimmed.slice(0, separator).trim();
+    const value = trimmed.slice(separator + 1).trim();
+    if (key in presence) {
+      values[key] = value;
+      if (value.length > 0) {
+        presence[key as keyof EnvKeyPresence] = true;
+      }
+    } else if (key === "LINEAR_WEBHOOK_SECRET") {
+      values[key] = value;
+    }
+  }
+
+  return { values, presence };
+}
+
+export async function readExistingEnvFileContent(
+  paths: LocalFilePaths,
+): Promise<string | null> {
+  if (!(await fileExists(paths.envLocal))) {
+    return null;
+  }
+  return readFile(paths.envLocal, "utf8");
+}
+
+export async function readExistingEnvFile(
+  paths: LocalFilePaths,
+): Promise<ParsedEnvFile | null> {
+  const content = await readExistingEnvFileContent(paths);
+  if (content === null) {
+    return null;
+  }
+  return parseEnvFileContent(content);
+}
+
+export function mergeEnvInput(
+  existing: ParsedEnvFile | null,
+  input: SetupEnvInput,
+): SetupEnvInput {
+  const merged: SetupEnvInput = {
+    harnessConfigPath:
+      input.harnessConfigPath?.trim() ||
+      existing?.values.HARNESS_CONFIG_PATH ||
+      DEFAULT_HARNESS_CONFIG_PATH,
+    githubDispatchRepository:
+      input.githubDispatchRepository?.trim() ||
+      existing?.values.GITHUB_DISPATCH_REPOSITORY ||
+      undefined,
+    githubDispatchRepositoryId:
+      input.githubDispatchRepositoryId?.trim() ||
+      existing?.values.GITHUB_DISPATCH_REPOSITORY_ID ||
+      undefined,
+  };
+
+  const secretMap = {
+    linearApiKey: "LINEAR_API_KEY",
+    cursorApiKey: "CURSOR_API_KEY",
+    githubToken: "GITHUB_TOKEN",
+    vercelToken: "VERCEL_TOKEN",
+  } as const;
+
+  for (const [inputKey, envKey] of Object.entries(secretMap)) {
+    const submitted = input[inputKey as keyof typeof secretMap]?.trim();
+    if (submitted) {
+      merged[inputKey as keyof typeof secretMap] = submitted;
+    } else if (existing?.values[envKey]) {
+      merged[inputKey as keyof typeof secretMap] = existing.values[envKey];
+    }
+  }
+
+  return merged;
+}
+
+function managedValuesFromMerged(merged: SetupEnvInput): Record<ManagedKey, string> {
+  return {
+    HARNESS_CONFIG_PATH:
+      merged.harnessConfigPath ?? DEFAULT_HARNESS_CONFIG_PATH,
+    GITHUB_DISPATCH_REPOSITORY: merged.githubDispatchRepository ?? "",
+    GITHUB_DISPATCH_REPOSITORY_ID: merged.githubDispatchRepositoryId ?? "",
+    LINEAR_API_KEY: merged.linearApiKey ?? "",
+    CURSOR_API_KEY: merged.cursorApiKey ?? "",
+    GITHUB_TOKEN: merged.githubToken ?? "",
+    VERCEL_TOKEN: merged.vercelToken ?? "",
+  };
+}
+
+function generateNewEnvFileContent(merged: SetupEnvInput): string {
+  const values = managedValuesFromMerged(merged);
+  return `# Operator local setup — generated by harness setup core
+# Do not commit .env.local (gitignored).
+
+# --- Harness managed keys ---
+HARNESS_CONFIG_PATH=${values.HARNESS_CONFIG_PATH}
+GITHUB_DISPATCH_REPOSITORY=${values.GITHUB_DISPATCH_REPOSITORY}
+GITHUB_DISPATCH_REPOSITORY_ID=${values.GITHUB_DISPATCH_REPOSITORY_ID}
+LINEAR_API_KEY=${values.LINEAR_API_KEY}
+CURSOR_API_KEY=${values.CURSOR_API_KEY}
+GITHUB_TOKEN=${values.GITHUB_TOKEN}
+VERCEL_TOKEN=${values.VERCEL_TOKEN}
+`;
+}
+
+export function mergeEnvFileContent(
+  existingContent: string | null,
+  merged: SetupEnvInput,
+): string {
+  if (existingContent === null) {
+    return generateNewEnvFileContent(merged);
+  }
+
+  const values = managedValuesFromMerged(merged);
+  const lines = existingContent.split("\n");
+  const seenManaged = new Set<ManagedKey>();
+  const outputLines: string[] = [];
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      outputLines.push(line);
+      continue;
+    }
+
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) {
+      outputLines.push(line);
+      continue;
+    }
+
+    const key = trimmed.slice(0, separator).trim();
+    if (!isManagedKey(key)) {
+      outputLines.push(line);
+      continue;
+    }
+
+    seenManaged.add(key);
+    outputLines.push(`${key}=${values[key]}`);
+  }
+
+  const missingManaged = MANAGED_KEYS.filter((key) => !seenManaged.has(key));
+  if (missingManaged.length > 0) {
+    if (outputLines.length > 0 && outputLines[outputLines.length - 1] !== "") {
+      outputLines.push("");
+    }
+    outputLines.push("# --- Harness managed keys ---");
+    for (const key of missingManaged) {
+      outputLines.push(`${key}=${values[key]}`);
+    }
+  }
+
+  let result = outputLines.join("\n");
+  if (existingContent.endsWith("\n") && !result.endsWith("\n")) {
+    result += "\n";
+  }
+  return result;
+}
+
+export function redactEnvContent(content: string): string {
+  return redactSecretEnvContent(content);
+}
+
+export function collectMergedSecrets(merged: SetupEnvInput): string[] {
+  return collectEnvInputSecrets(merged);
+}
+
+export function summarizeManagedKeyPresence(
+  merged: SetupEnvInput,
+): EnvKeyPresence {
+  return {
+    HARNESS_CONFIG_PATH: Boolean(merged.harnessConfigPath?.trim()),
+    GITHUB_DISPATCH_REPOSITORY: Boolean(merged.githubDispatchRepository?.trim()),
+    GITHUB_DISPATCH_REPOSITORY_ID: Boolean(
+      merged.githubDispatchRepositoryId?.trim(),
+    ),
+    LINEAR_API_KEY: Boolean(merged.linearApiKey?.trim()),
+    CURSOR_API_KEY: Boolean(merged.cursorApiKey?.trim()),
+    GITHUB_TOKEN: Boolean(merged.githubToken?.trim()),
+    VERCEL_TOKEN: Boolean(merged.vercelToken?.trim()),
+  };
+}
+
+export async function getLocalFileBaseline(filePath: string): Promise<string> {
+  try {
+    const fileStat = await stat(filePath);
+    return `${fileStat.size}:${fileStat.mtimeMs}`;
+  } catch {
+    return "missing";
+  }
+}
+
+export { MANAGED_KEYS };

package/workspace-snapshot/files/src/setup/env-writer.ts

@@ -0,0 +1,179 @@
+import { access, copyFile, readFile, writeFile } from "node:fs/promises";
+import { SETUP_PERMISSIONS } from "./permission-model.js";
+import {
+  collectEnvInputSecrets,
+  sanitizeSetupActionResult,
+} from "./redact-secrets.js";
+import type { SetupActionResult } from "./setup-actions.js";
+import {
+  DEFAULT_HARNESS_CONFIG_PATH,
+  ENV_LOCAL,
+  type LocalFilePaths,
+  type SetupEnvInput,
+  type SetupExecutionMode,
+} from "./setup-state.js";
+
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export interface WriteEnvLocalOptions {
+  paths: LocalFilePaths;
+  force?: boolean;
+  mode?: SetupExecutionMode;
+  input?: SetupEnvInput;
+  content?: string;
+}
+
+function generateEnvWriteContent(input?: SetupEnvInput): string {
+  const harnessConfigPath =
+    input?.harnessConfigPath ?? DEFAULT_HARNESS_CONFIG_PATH;
+  const linearApiKey = input?.linearApiKey ?? "";
+  const cursorApiKey = input?.cursorApiKey ?? "";
+  const githubToken = input?.githubToken ?? "";
+
+  return `# Operator local setup — generated by harness setup core
+# Do not commit .env.local (gitignored).
+
+# --- Local private harness config (local only) ---
+# Points at your structured target-repo config file.
+# Edit .harness/config.local.json after init; keep this path unchanged.
+HARNESS_CONFIG_PATH=${harnessConfigPath}
+
+# --- GitHub Actions only (cloud runs) — do NOT put in .env.local ---
+# HARNESS_CONFIG_JSON_B64 replaces the whole harness config for that run.
+# It is NOT an overlay with committed harness.config.json.
+# Base64-encode your full .harness/config.local.json and set it as a
+# GitHub Actions secret on the harness repo. Include every repo you want
+# the harness to manage in repos[] and allowedTargetRepos[].
+
+# --- Live automation API keys (local CLI) ---
+# Fill these in .env.local for local doctor and harness runs.
+LINEAR_API_KEY=${linearApiKey}
+CURSOR_API_KEY=${cursorApiKey}
+
+# Local CLI name for GitHub API access (doctor merge profile, handoff, merge).
+# In GitHub Actions the secret is named HARNESS_GITHUB_TOKEN (workflow maps it
+# to runtime GITHUB_TOKEN). Do not use HARNESS_GITHUB_TOKEN in .env.local.
+GITHUB_TOKEN=${githubToken}
+`;
+}
+
+function presentEnvActionResult(
+  result: SetupActionResult,
+  knownSecrets: readonly string[] = [],
+): SetupActionResult {
+  return sanitizeSetupActionResult(result, knownSecrets);
+}
+
+export async function readEnvExampleContent(
+  paths: LocalFilePaths,
+): Promise<string> {
+  if (!(await fileExists(paths.envExample))) {
+    throw new Error(`Missing source file: ${paths.envExample}`);
+  }
+  return readFile(paths.envExample, "utf8");
+}
+
+export async function scaffoldEnvFromExample(options: {
+  paths: LocalFilePaths;
+  force?: boolean;
+  mode?: SetupExecutionMode;
+}): Promise<SetupActionResult> {
+  const { paths, force = false, mode = "apply" } = options;
+  const label = ENV_LOCAL;
+  const destExists = await fileExists(paths.envLocal);
+
+  if (destExists && !force) {
+    return presentEnvActionResult({
+      actionId: "scaffold-env-local",
+      outcome: "skipped",
+      targetPath: paths.envLocal,
+      permission: SETUP_PERMISSIONS.localFileWrite,
+      reason: "already exists",
+      logMessage: `skipped ${label} (already exists)`,
+    });
+  }
+
+  const writeContent = await readEnvExampleContent(paths);
+
+  if (mode === "dry-run") {
+    return presentEnvActionResult({
+      actionId: "scaffold-env-local",
+      outcome: destExists ? "wouldChange" : "preview",
+      targetPath: paths.envLocal,
+      content: writeContent,
+      permission: SETUP_PERMISSIONS.localFileWrite,
+      reason: destExists ? "would overwrite with --force" : "would create",
+      logMessage: destExists ? `would overwrite ${label}` : `would create ${label}`,
+    });
+  }
+
+  await copyFile(paths.envExample, paths.envLocal);
+  return presentEnvActionResult({
+    actionId: "scaffold-env-local",
+    outcome: "changed",
+    targetPath: paths.envLocal,
+    content: writeContent,
+    permission: SETUP_PERMISSIONS.localFileWrite,
+    reason: destExists ? "overwrote existing file" : "created new file",
+    logMessage: `${destExists ? "overwrote" : "created"} ${label}`,
+  });
+}
+
+export async function writeEnvLocal(
+  options: WriteEnvLocalOptions,
+): Promise<SetupActionResult> {
+  const { paths, force = false, mode = "apply" } = options;
+  const label = ENV_LOCAL;
+  const destExists = await fileExists(paths.envLocal);
+  const knownSecrets = collectEnvInputSecrets(options.input);
+
+  if (destExists && !force) {
+    return presentEnvActionResult({
+      actionId: "write-env-local",
+      outcome: "skipped",
+      targetPath: paths.envLocal,
+      permission: SETUP_PERMISSIONS.localFileWrite,
+      reason: "already exists",
+      logMessage: `skipped ${label} (already exists)`,
+    });
+  }
+
+  const writeContent =
+    options.content ?? generateEnvWriteContent(options.input);
+
+  if (mode === "dry-run") {
+    return presentEnvActionResult(
+      {
+        actionId: "write-env-local",
+        outcome: destExists ? "wouldChange" : "preview",
+        targetPath: paths.envLocal,
+        content: writeContent,
+        permission: SETUP_PERMISSIONS.localFileWrite,
+        reason: destExists ? "would overwrite with --force" : "would create",
+        logMessage: destExists ? `would overwrite ${label}` : `would create ${label}`,
+      },
+      knownSecrets,
+    );
+  }
+
+  await writeFile(paths.envLocal, writeContent, "utf8");
+  return presentEnvActionResult(
+    {
+      actionId: "write-env-local",
+      outcome: "changed",
+      targetPath: paths.envLocal,
+      content: writeContent,
+      permission: SETUP_PERMISSIONS.localFileWrite,
+      reason: destExists ? "overwrote existing file" : "created new file",
+      logMessage: `${destExists ? "overwrote" : "created"} ${label}`,
+    },
+    knownSecrets,
+  );
+}