p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/src/setup/mock-target-workflow-finalization.ts

@@ -0,0 +1,445 @@
+import type { RemoteWorkflowStatus } from "./remote-actions.js";
+import {
+  buildTargetWorkflowBranchName,
+} from "./target-workflow-setup.js";
+import { targetRepoSlugFromUrl } from "./harness-secret-setup.js";
+import type {
+  TargetWorkflowFinalizeInput,
+  TargetWorkflowFinalizationResult,
+  WorkflowInstallBlockedCategory,
+  WorkflowInstallLifecycle,
+} from "./target-workflow-finalization-types.js";
+import { blockedCategoryMessage } from "./workflow-install-merge-errors.js";
+
+export interface MockWorkflowFinalizationScenario {
+  prUrl?: string;
+  prNumber?: number;
+  headSha?: string;
+  checks?: "none" | "pending" | "failing" | "success";
+  mergeableState?: "clean" | "behind" | "dirty" | "blocked" | "unknown";
+  mergeResult?: "success" | "permission-denied" | "review-required" | "conflict";
+  unexpectedExtraFile?: boolean;
+  workflowContentMismatch?: boolean;
+  headShaChangesAfterValidation?: boolean;
+  verificationLagSteps?: number;
+  alreadyMerged?: boolean;
+  productionWorkflowAfterMerge?: string | null;
+}
+
+interface MockFinalizationRuntimeState {
+  checksPollCount: number;
+  verificationPollCount: number;
+  mergeAttempts: number;
+  branchUpdateAttempts: number;
+  lastValidatedHeadSha?: string;
+}
+
+const runtimeByKey = new Map<string, MockFinalizationRuntimeState>();
+
+function runtimeKey(targetRepoSlug: string, repoConfigId: string): string {
+  return `${targetRepoSlug}:${repoConfigId}`;
+}
+
+function getRuntime(key: string): MockFinalizationRuntimeState {
+  const existing = runtimeByKey.get(key);
+  if (existing) {
+    return existing;
+  }
+  const created = {
+    checksPollCount: 0,
+    verificationPollCount: 0,
+    mergeAttempts: 0,
+    branchUpdateAttempts: 0,
+  };
+  runtimeByKey.set(key, created);
+  return created;
+}
+
+export function resetMockWorkflowFinalizationRuntime(): void {
+  runtimeByKey.clear();
+}
+
+function baseResult(input: {
+  input: TargetWorkflowFinalizeInput;
+  targetRepoSlug: string;
+  branchName: string;
+  lifecycle: WorkflowInstallLifecycle;
+  workflowStatus: RemoteWorkflowStatus;
+  message: string;
+  prUrl?: string;
+  prNumber?: number;
+  validatedHeadSha?: string;
+  blockedCategory?: WorkflowInstallBlockedCategory;
+  canRetry?: boolean;
+  requiresGitHubIntervention?: boolean;
+  advancedThisRequest?: boolean;
+}): TargetWorkflowFinalizationResult {
+  return {
+    repoConfigId: input.input.repoConfigId,
+    targetRepo: input.input.targetRepo,
+    targetRepoSlug: input.targetRepoSlug,
+    productionBranch: input.input.productionBranch,
+    branchName: input.branchName,
+    lifecycle: input.lifecycle,
+    blockedCategory: input.blockedCategory,
+    message: input.message,
+    prUrl: input.prUrl,
+    prNumber: input.prNumber,
+    validatedHeadSha: input.validatedHeadSha,
+    workflowStatus: input.workflowStatus,
+    canRetry: input.canRetry ?? false,
+    requiresGitHubIntervention: input.requiresGitHubIntervention ?? false,
+    advancedThisRequest: input.advancedThisRequest ?? true,
+    lockContended: false,
+  };
+}
+
+export function advanceMockTargetWorkflowFinalization(input: {
+  finalizeInput: TargetWorkflowFinalizeInput;
+  intendedWorkflowContent: string;
+  existingWorkflowContent?: string | null;
+  scenario?: MockWorkflowFinalizationScenario;
+  onProductionWorkflowUpdate?: (content: string) => void;
+}): TargetWorkflowFinalizationResult {
+  const targetRepoSlug = targetRepoSlugFromUrl(input.finalizeInput.targetRepo);
+  if (!targetRepoSlug) {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug: "<invalid>",
+      branchName: buildTargetWorkflowBranchName(input.finalizeInput.repoConfigId),
+      lifecycle: "blocked",
+      workflowStatus: "unknown",
+      message: "Invalid target repo URL.",
+      blockedCategory: "unexpected-pr-content",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  const branchName =
+    input.finalizeInput.branchName ??
+    buildTargetWorkflowBranchName(input.finalizeInput.repoConfigId);
+  const scenario = input.scenario ?? {};
+  const runtime = getRuntime(
+    runtimeKey(targetRepoSlug, input.finalizeInput.repoConfigId),
+  );
+
+  const existing = input.existingWorkflowContent;
+  let workflowStatus: RemoteWorkflowStatus = "unknown";
+  if (existing === null || existing === undefined) {
+    workflowStatus = "missing";
+  } else if (existing === input.intendedWorkflowContent) {
+    workflowStatus = "present";
+  } else {
+    workflowStatus = "differs";
+  }
+
+  if (workflowStatus === "present") {
+    runtimeByKey.delete(runtimeKey(targetRepoSlug, input.finalizeInput.repoConfigId));
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "complete",
+      workflowStatus: "present",
+      message: "Workflow installed on the production branch.",
+    });
+  }
+
+  const prUrl =
+    input.finalizeInput.prUrl ??
+    scenario.prUrl ??
+    `https://github.com/${targetRepoSlug}/pull/${scenario.prNumber ?? 1}`;
+  const prNumber = scenario.prNumber ?? 1;
+  const headSha = scenario.headSha ?? "mock-head-sha";
+
+  if (scenario.unexpectedExtraFile) {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "blocked",
+      workflowStatus,
+      message: blockedCategoryMessage("unexpected-pr-content"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "unexpected-pr-content",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  if (scenario.workflowContentMismatch) {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "blocked",
+      workflowStatus,
+      message: blockedCategoryMessage("unexpected-pr-content"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "unexpected-pr-content",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  if (scenario.alreadyMerged) {
+    runtime.verificationPollCount += 1;
+    const lagSteps = scenario.verificationLagSteps ?? 0;
+    if (runtime.verificationPollCount > lagSteps) {
+      input.onProductionWorkflowUpdate?.(input.intendedWorkflowContent);
+      runtimeByKey.delete(runtimeKey(targetRepoSlug, input.finalizeInput.repoConfigId));
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "complete",
+        workflowStatus: "present",
+        message: "Workflow installed on the production branch.",
+        prUrl,
+        prNumber,
+      });
+    }
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "verifying",
+      workflowStatus,
+      message: "Verifying workflow on the production branch.",
+      prUrl,
+      prNumber,
+      canRetry: true,
+    });
+  }
+
+  if (scenario.checks === "failing") {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "blocked",
+      workflowStatus,
+      message: blockedCategoryMessage("checks-failing"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "checks-failing",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  if (scenario.checks === "pending") {
+    runtime.checksPollCount += 1;
+    if (runtime.checksPollCount < 2) {
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "waiting-for-checks",
+        workflowStatus,
+        message: blockedCategoryMessage("checks-pending"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+        blockedCategory: "checks-pending",
+      });
+    }
+  }
+
+  if (scenario.mergeableState === "unknown") {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "waiting-for-checks",
+      workflowStatus,
+      message: blockedCategoryMessage("mergeability-pending"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "mergeability-pending",
+    });
+  }
+
+  if (scenario.mergeableState === "behind") {
+    if (runtime.branchUpdateAttempts === 0) {
+      runtime.branchUpdateAttempts += 1;
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "updating-branch",
+        workflowStatus,
+        message: blockedCategoryMessage("branch-behind"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+      });
+    }
+    scenario.mergeableState = "clean";
+  }
+
+  if (scenario.mergeableState === "dirty") {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "blocked",
+      workflowStatus,
+      message: blockedCategoryMessage("merge-conflict"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "merge-conflict",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  if (scenario.mergeableState === "blocked") {
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "blocked",
+      workflowStatus,
+      message: blockedCategoryMessage("review-required"),
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      blockedCategory: "review-required",
+      requiresGitHubIntervention: true,
+    });
+  }
+
+  runtime.lastValidatedHeadSha = headSha;
+  const mergeHeadSha = scenario.headShaChangesAfterValidation
+    ? "changed-head-sha"
+    : headSha;
+
+  if (runtime.mergeAttempts === 0) {
+    runtime.mergeAttempts += 1;
+    if (scenario.mergeResult === "permission-denied") {
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "blocked",
+        workflowStatus,
+        message: blockedCategoryMessage("permission-denied"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+        blockedCategory: "permission-denied",
+        requiresGitHubIntervention: true,
+      });
+    }
+    if (scenario.mergeResult === "review-required") {
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "blocked",
+        workflowStatus,
+        message: blockedCategoryMessage("review-required"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+        blockedCategory: "review-required",
+        requiresGitHubIntervention: true,
+      });
+    }
+    if (scenario.mergeResult === "conflict") {
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "blocked",
+        workflowStatus,
+        message: blockedCategoryMessage("merge-conflict"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+        blockedCategory: "merge-conflict",
+        requiresGitHubIntervention: true,
+      });
+    }
+    if (scenario.headShaChangesAfterValidation && mergeHeadSha !== headSha) {
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "waiting-for-checks",
+        workflowStatus,
+        message: blockedCategoryMessage("mergeability-pending"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: mergeHeadSha,
+        blockedCategory: "mergeability-pending",
+      });
+    }
+
+    runtime.verificationPollCount += 1;
+    const lagSteps = scenario.verificationLagSteps ?? 0;
+    if (runtime.verificationPollCount > lagSteps) {
+      const mergedContent =
+        scenario.productionWorkflowAfterMerge ?? input.intendedWorkflowContent;
+      input.onProductionWorkflowUpdate?.(mergedContent);
+      if (mergedContent === input.intendedWorkflowContent) {
+        runtimeByKey.delete(runtimeKey(targetRepoSlug, input.finalizeInput.repoConfigId));
+        return baseResult({
+          input: input.finalizeInput,
+          targetRepoSlug,
+          branchName,
+          lifecycle: "complete",
+          workflowStatus: "present",
+          message: "Workflow installed on the production branch.",
+          prUrl,
+          prNumber,
+          validatedHeadSha: headSha,
+        });
+      }
+      return baseResult({
+        input: input.finalizeInput,
+        targetRepoSlug,
+        branchName,
+        lifecycle: "blocked",
+        workflowStatus: "differs",
+        message: blockedCategoryMessage("verification-failed"),
+        prUrl,
+        prNumber,
+        validatedHeadSha: headSha,
+        blockedCategory: "verification-failed",
+        canRetry: true,
+        requiresGitHubIntervention: true,
+      });
+    }
+
+    return baseResult({
+      input: input.finalizeInput,
+      targetRepoSlug,
+      branchName,
+      lifecycle: "verifying",
+      workflowStatus,
+      message: "Verifying workflow on the production branch.",
+      prUrl,
+      prNumber,
+      validatedHeadSha: headSha,
+      canRetry: true,
+    });
+  }
+
+  return baseResult({
+    input: input.finalizeInput,
+    targetRepoSlug,
+    branchName,
+    lifecycle: "merging",
+    workflowStatus,
+    message: "Waiting for workflow install PR merge to complete.",
+    prUrl,
+    prNumber,
+    validatedHeadSha: headSha,
+    advancedThisRequest: false,
+  });
+}

package/workspace-snapshot/files/src/setup/model-settings.ts

@@ -0,0 +1,73 @@
+import type { HarnessConfig } from "../config/types.js";
+import { DEFAULT_MODEL_ID } from "../config/defaults.js";
+import {
+  resolveModel,
+  resolveModelId,
+  STANDARD_MODEL_PARAMS,
+} from "../cursor/model.js";
+
+export type CursorModelConfigSource =
+  | "agentProvider.model.id"
+  | "defaultModel.id"
+  | "code-default";
+
+export interface CursorModelSettingsSummary {
+  providerId: "cursor";
+  resolvedModelId: string;
+  configuredModelId?: string;
+  source: CursorModelConfigSource;
+  pinnedParams: ReadonlyArray<{ id: string; value: string }>;
+  paramsControlledInCode: boolean;
+  policyNote: string;
+}
+
+export function summarizeCursorModelSettings(
+  config?: HarnessConfig,
+): CursorModelSettingsSummary {
+  const resolvedConfig = config ?? emptyConfig();
+  const resolvedModelId = resolveModelId(resolvedConfig);
+  const resolvedModel = resolveModel(resolvedConfig);
+
+  let source: CursorModelConfigSource = "code-default";
+  let configuredModelId: string | undefined;
+
+  if (resolvedConfig.agentProvider?.model?.id) {
+    source = "agentProvider.model.id";
+    configuredModelId = resolvedConfig.agentProvider.model.id;
+  } else if (resolvedConfig.defaultModel?.id) {
+    source = "defaultModel.id";
+    configuredModelId = resolvedConfig.defaultModel.id;
+  }
+
+  return {
+    providerId: "cursor",
+    resolvedModelId,
+    configuredModelId,
+    source,
+    pinnedParams: resolvedModel.params ?? [...STANDARD_MODEL_PARAMS],
+    paramsControlledInCode: true,
+    policyNote:
+      "Model ids are Cursor cloud agent selections. fast:false is pinned in code for cost control and is not user-editable in config.",
+  };
+}
+
+export function defaultCursorModelIdForSetup(): string {
+  return DEFAULT_MODEL_ID;
+}
+
+function emptyConfig(): HarnessConfig {
+  return {
+    version: 1,
+    orchestratorMarker: "harness-orchestrator-v1",
+    logDirectory: "runs",
+    repos: [
+      {
+        id: "target-app",
+        targetRepo: "https://github.com/owner/example-target-app",
+        baseBranch: "main",
+        productionBranch: "main",
+      },
+    ],
+    allowedTargetRepos: ["https://github.com/owner/example-target-app"],
+  };
+}

package/workspace-snapshot/files/src/setup/permission-model.ts

@@ -0,0 +1,79 @@
+export type SetupPermissionScope =
+  | "read-only"
+  | "local-file-write"
+  | "remote-read"
+  | "remote-secret-write"
+  | "remote-repo-write"
+  | "cloud-workflow-trigger"
+  | "linear-write";
+
+export type SetupConfirmationLevel =
+  | "none"
+  | "standard"
+  | "strong"
+  | "high-risk";
+
+export interface SetupPermission {
+  scope: SetupPermissionScope;
+  confirmation: SetupConfirmationLevel;
+  manualAlternative: boolean;
+}
+
+export const SETUP_PERMISSIONS = {
+  readOnly: {
+    scope: "read-only",
+    confirmation: "none",
+    manualAlternative: false,
+  },
+  localFileWrite: {
+    scope: "local-file-write",
+    confirmation: "standard",
+    manualAlternative: true,
+  },
+  remoteRead: {
+    scope: "remote-read",
+    confirmation: "standard",
+    manualAlternative: true,
+  },
+  remoteSecretWrite: {
+    scope: "remote-secret-write",
+    confirmation: "strong",
+    manualAlternative: true,
+  },
+  remoteRepoWrite: {
+    scope: "remote-repo-write",
+    confirmation: "strong",
+    manualAlternative: true,
+  },
+  cloudWorkflowTrigger: {
+    scope: "cloud-workflow-trigger",
+    confirmation: "strong",
+    manualAlternative: true,
+  },
+  linearWrite: {
+    scope: "linear-write",
+    confirmation: "high-risk",
+    manualAlternative: true,
+  },
+} as const satisfies Record<string, SetupPermission>;
+
+export function classifySetupPermission(
+  scope: SetupPermissionScope,
+): SetupPermission {
+  switch (scope) {
+    case "read-only":
+      return SETUP_PERMISSIONS.readOnly;
+    case "local-file-write":
+      return SETUP_PERMISSIONS.localFileWrite;
+    case "remote-read":
+      return SETUP_PERMISSIONS.remoteRead;
+    case "remote-secret-write":
+      return SETUP_PERMISSIONS.remoteSecretWrite;
+    case "remote-repo-write":
+      return SETUP_PERMISSIONS.remoteRepoWrite;
+    case "cloud-workflow-trigger":
+      return SETUP_PERMISSIONS.cloudWorkflowTrigger;
+    case "linear-write":
+      return SETUP_PERMISSIONS.linearWrite;
+  }
+}

package/workspace-snapshot/files/src/setup/redact-secrets.ts

@@ -0,0 +1,85 @@
+import type { SetupActionResult } from "./setup-actions.js";
+
+const SECRET_ENV_KEYS = [
+  "LINEAR_API_KEY",
+  "CURSOR_API_KEY",
+  "GITHUB_TOKEN",
+  "VERCEL_TOKEN",
+  "HARNESS_GITHUB_TOKEN",
+  "HARNESS_CONFIG_JSON_B64",
+  "LINEAR_WEBHOOK_SECRET",
+  "GITHUB_DISPATCH_TOKEN",
+] as const;
+
+const SECRET_ASSIGNMENT_PATTERN = new RegExp(
+  `^(${SECRET_ENV_KEYS.join("|")})=(.*)$`,
+  "gm",
+);
+
+export function redactSecretEnvContent(content: string): string {
+  return content.replace(
+    SECRET_ASSIGNMENT_PATTERN,
+    (_match, key: string, value: string) =>
+      value.length > 0 ? `${key}=<redacted>` : `${key}=`,
+  );
+}
+
+export function redactKnownSecretValues(
+  text: string,
+  secrets: readonly string[],
+): string {
+  let redacted = text;
+  for (const secret of secrets) {
+    if (!secret) {
+      continue;
+    }
+    redacted = redacted.split(secret).join("<redacted>");
+  }
+  return redacted;
+}
+
+export function collectEnvInputSecrets(input?: {
+  linearApiKey?: string;
+  cursorApiKey?: string;
+  githubToken?: string;
+  vercelToken?: string;
+}): string[] {
+  return [
+    input?.linearApiKey,
+    input?.cursorApiKey,
+    input?.githubToken,
+    input?.vercelToken,
+  ].filter((value): value is string => Boolean(value));
+}
+
+export function collectRemoteSecretInputs(input?: {
+  linearApiKey?: string;
+  cursorApiKey?: string;
+  githubToken?: string;
+  harnessConfigJsonB64?: string;
+}): string[] {
+  return [
+    input?.linearApiKey,
+    input?.cursorApiKey,
+    input?.githubToken,
+    input?.harnessConfigJsonB64,
+  ].filter((value): value is string => Boolean(value));
+}
+
+export function sanitizeSetupActionResult(
+  result: SetupActionResult,
+  knownSecrets: readonly string[] = [],
+): SetupActionResult {
+  const redactText = (text: string): string =>
+    redactKnownSecretValues(redactSecretEnvContent(text), knownSecrets);
+
+  return {
+    ...result,
+    content: result.content ? redactText(result.content) : undefined,
+    reason: result.reason ? redactText(result.reason) : undefined,
+    logMessage: result.logMessage ? redactText(result.logMessage) : undefined,
+    manualInstructions: result.manualInstructions?.map((step) =>
+      redactText(step),
+    ),
+  };
+}