p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/tests/setup/generated-instructions.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import {
+  generateCloudValidationInstructions,
+  generateGitHubSecretInstructions,
+  generateHarnessConfigB64Instructions,
+  generateTargetRepoWorkflowInstructions,
+} from "../../src/setup/generated-instructions.js";
+
+describe("generated-instructions", () => {
+  it("includes HARNESS_CONFIG_JSON_B64 encoding guidance", () => {
+    const instructions = generateHarnessConfigB64Instructions();
+
+    expect(instructions.command).toContain("base64 < .harness/config.local.json");
+    expect(instructions.steps.join("\n")).toContain("HARNESS_CONFIG_JSON_B64");
+  });
+
+  it("lists GitHub secret names without printing secret values", () => {
+    const instructions = generateGitHubSecretInstructions({
+      harnessRepo: "owner/agentic-product-development-harness",
+    });
+
+    const joined = instructions.steps.join("\n");
+    expect(joined).toContain("HARNESS_CONFIG_JSON_B64");
+    expect(joined).toContain("LINEAR_API_KEY");
+    expect(joined).toContain("CURSOR_API_KEY");
+    expect(joined).toContain("HARNESS_GITHUB_TOKEN");
+    expect(joined).not.toMatch(/LINEAR_API_KEY=[^ ]+/);
+  });
+
+  it("uses manual placeholder when harness repo is unresolved", () => {
+    const instructions = generateGitHubSecretInstructions();
+    expect(instructions.steps.join("\n")).toContain("<harness-dispatch-repo>");
+  });
+
+  it("uses generic target repo workflow placeholders", () => {
+    const instructions = generateTargetRepoWorkflowInstructions();
+
+    expect(instructions.steps.join("\n")).toContain("target-app");
+    expect(instructions.steps.join("\n")).toContain("owner/example-target-app");
+  });
+
+  it("documents safe cloud validation sequence", () => {
+    const instructions = generateCloudValidationInstructions();
+
+    expect(instructions.steps.join("\n")).toContain("sync_repo=harness");
+    expect(instructions.steps.join("\n")).toContain("sync_dry_run=true");
+  });
+});

package/workspace-snapshot/files/tests/setup/github-dispatch-token.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { GitHubApiError } from "../../src/github/client.js";
+
+vi.mock("../../src/setup/harness-dispatch-repo.js", () => ({
+  resolveHarnessDispatchRepo: vi.fn(),
+}));
+
+vi.mock("../../src/setup/service-verification.js", () => ({
+  inspectGitHubTokenMetadata: vi.fn(),
+}));
+
+vi.mock("../../src/github/client.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../src/github/client.js")>();
+  return {
+    ...actual,
+    GitHubClient: vi.fn(),
+  };
+});
+
+import { GitHubClient } from "../../src/github/client.js";
+import { resolveHarnessDispatchRepo } from "../../src/setup/harness-dispatch-repo.js";
+import { inspectGitHubTokenMetadata } from "../../src/setup/service-verification.js";
+import { assessGitHubDispatchTokenEligibility } from "../../src/setup/github-dispatch-token.js";
+
+describe("github-dispatch-token", () => {
+  beforeEach(() => {
+    vi.mocked(resolveHarnessDispatchRepo).mockResolvedValue({
+      repo: "owner/harness",
+      source: "git-remote-origin",
+      resolved: true,
+      detail: "Resolved from git remote origin.",
+    });
+    vi.mocked(inspectGitHubTokenMetadata).mockResolvedValue({
+      login: "weston-uribe",
+      oauthScopes: ["repo"],
+      tokenType: "classic",
+    });
+    vi.mocked(GitHubClient).mockImplementation(
+      () =>
+        ({
+          getRepository: vi.fn().mockResolvedValue({
+            permissions: { push: true },
+          }),
+        }) as unknown as InstanceType<typeof GitHubClient>,
+    );
+  });
+
+  it("requires a saved GitHub token before dispatch reuse", async () => {
+    const result = await assessGitHubDispatchTokenEligibility({});
+
+    expect(result.eligible).toBe(false);
+    expect(result.source).toBe("manual-required");
+    expect(result.message).toMatch(/Add GITHUB_TOKEN/i);
+  });
+
+  it("marks saved Step 1 token eligible when contents write is available", async () => {
+    const result = await assessGitHubDispatchTokenEligibility({
+      githubToken: "ghp_saved-token",
+    });
+
+    expect(result.eligible).toBe(true);
+    expect(result.source).toBe("saved-github-token");
+    expect(result.repository).toBe("owner/harness");
+    expect(result.message).toMatch(/can dispatch/i);
+  });
+
+  it("requires manual override when saved token lacks contents write", async () => {
+    vi.mocked(GitHubClient).mockImplementation(
+      () =>
+        ({
+          getRepository: vi.fn().mockResolvedValue({
+            permissions: { pull: true, push: false },
+          }),
+        }) as unknown as InstanceType<typeof GitHubClient>,
+    );
+
+    const result = await assessGitHubDispatchTokenEligibility({
+      githubToken: "ghp_read-only",
+    });
+
+    expect(result.eligible).toBe(false);
+    expect(result.source).toBe("manual-required");
+    expect(result.message).toMatch(/Contents write access/i);
+  });
+
+  it("does not return the token value in eligibility metadata", async () => {
+    const token = "ghp_super-secret-dispatch-token";
+    const result = await assessGitHubDispatchTokenEligibility({
+      githubToken: token,
+    });
+    const serialized = JSON.stringify(result);
+
+    expect(serialized).not.toContain(token);
+  });
+
+  it("surfaces GitHub API failures as manual-required eligibility", async () => {
+    vi.mocked(GitHubClient).mockImplementation(
+      () =>
+        ({
+          getRepository: vi.fn().mockRejectedValue(new GitHubApiError("Forbidden", 403)),
+        }) as unknown as InstanceType<typeof GitHubClient>,
+    );
+
+    const result = await assessGitHubDispatchTokenEligibility({
+      githubToken: "ghp_rejected",
+    });
+
+    expect(result.eligible).toBe(false);
+    expect(result.message).toMatch(/rejected dispatch token eligibility/i);
+  });
+});

package/workspace-snapshot/files/tests/setup/github-remote-provider.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import {
+  MockGitHubRemoteSetupProvider,
+  mapGitHubAccessErrorToStatus,
+  mapGitHubSecretMetadataToStatus,
+} from "../../src/setup/github-remote-provider.js";
+import { HARNESS_ACTIONS_SECRET_NAMES } from "../../src/setup/remote-actions.js";
+import { generateTargetWorkflowYaml } from "../../src/setup/target-workflow-setup.js";
+
+describe("github-remote-provider", () => {
+  it("maps GitHub secret metadata to present or missing only", () => {
+    const statuses = mapGitHubSecretMetadataToStatus(
+      ["LINEAR_API_KEY", "CURSOR_API_KEY"],
+      HARNESS_ACTIONS_SECRET_NAMES,
+    );
+
+    expect(statuses).toEqual([
+      { name: "HARNESS_CONFIG_JSON_B64", status: "missing" },
+      { name: "LINEAR_API_KEY", status: "present" },
+      { name: "CURSOR_API_KEY", status: "present" },
+      { name: "HARNESS_GITHUB_TOKEN", status: "missing" },
+    ]);
+  });
+
+  it("maps auth errors to denied access status", () => {
+    expect(mapGitHubAccessErrorToStatus(401)).toBe("denied");
+    expect(mapGitHubAccessErrorToStatus(403)).toBe("denied");
+    expect(mapGitHubAccessErrorToStatus(500)).toBe("unknown");
+  });
+
+  it("uses mocked provider without performing real remote writes", async () => {
+    const provider = new MockGitHubRemoteSetupProvider({
+      harnessRepoAccess: "available",
+      harnessSecretStatuses: {
+        LINEAR_API_KEY: "present",
+      },
+      targetRepoAccess: "available",
+      existingWorkflowContent: null,
+    });
+
+    const harnessAccess = await provider.checkHarnessRepoAccess("owner/harness");
+    const secretStatuses = await provider.listHarnessSecretStatuses(
+      "owner/harness",
+    );
+    const workflow = generateTargetWorkflowYaml({
+      harnessDispatchRepo: "owner/harness",
+      repoConfigId: "target-app",
+      targetRepoSlug: "owner/example-target-app",
+      productionBranch: "main",
+    });
+    const workflowStatus = await provider.checkTargetWorkflowStatus({
+      targetRepoSlug: "owner/example-target-app",
+      workflowPath: ".github/workflows/trigger-harness-production-sync.yml",
+      intendedWorkflowContent: workflow,
+      productionBranch: "main",
+    });
+
+    expect(harnessAccess).toBe("available");
+    expect(secretStatuses.find((entry) => entry.name === "LINEAR_API_KEY")).toEqual(
+      { name: "LINEAR_API_KEY", status: "present" },
+    );
+    expect(workflowStatus.workflowStatus).toBe("missing");
+    expect(provider.calls).toHaveLength(3);
+    expect(JSON.stringify(provider.calls)).not.toContain("encrypted");
+  });
+});

package/workspace-snapshot/files/tests/setup/github-remote-setup-live.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { GitHubApiError } from "../../src/github/client.js";
+import { GITHUB_STEP5_WORKFLOW_PERMISSION_FALLBACK_PREFIX } from "../../src/setup/github-workflow-permissions.js";
+import {
+  formatGitHubApiErrorMessage,
+  sanitizeGitHubSetupError,
+  sanitizeGitHubWorkflowSetupError,
+} from "../../src/setup/github-remote-setup-live.js";
+
+describe("github-remote-setup-live", () => {
+  it("sanitizes GitHub API error bodies before surfacing messages", () => {
+    const error = new GitHubApiError(
+      401,
+      "GitHub API 401: token ghp_sentinelGitHubTokenValue leaked in body",
+    );
+
+    const message = sanitizeGitHubSetupError(error);
+    expect(message).not.toContain("ghp_sentinelGitHubTokenValue");
+    expect(message).toContain("401");
+  });
+
+  it("formats JSON GitHub API errors as readable messages", () => {
+    const message = formatGitHubApiErrorMessage(
+      404,
+      '{"message":"Not Found","documentation_url":"https://docs.github.com/rest","status":"404"}',
+    );
+
+    expect(message).toBe("GitHub API 404: Not Found");
+    expect(message).not.toContain("documentation_url");
+  });
+
+  it("maps workflow scope 403 errors to setup guidance", () => {
+    const message = sanitizeGitHubWorkflowSetupError(
+      new GitHubApiError(
+        403,
+        '{"message":"refusing to allow an OAuth App to create or update workflow `.github/workflows/trigger-harness-production-sync.yml` without `workflow` scope","documentation_url":"https://docs.github.com/rest","status":"403"}',
+      ),
+    );
+
+    expect(message).toContain("workflow scope");
+    expect(message).toContain("GITHUB_TOKEN");
+    expect(message).toContain(GITHUB_STEP5_WORKFLOW_PERMISSION_FALLBACK_PREFIX);
+    expect(message).not.toContain("OAuth App");
+  });
+
+  it("maps misleading workflow 404 errors to setup guidance", () => {
+    const message = sanitizeGitHubWorkflowSetupError(
+      new GitHubApiError(
+        404,
+        '{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#create-or-update-file-contents","status":"404"}',
+      ),
+    );
+
+    expect(message).toContain("workflow scope");
+    expect(message).toContain("HTTP 404");
+    expect(message).toContain(GITHUB_STEP5_WORKFLOW_PERMISSION_FALLBACK_PREFIX);
+    expect(message).not.toContain('{"message"');
+  });
+});

package/workspace-snapshot/files/tests/setup/github-workflow-permissions.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+import {
+  assessClassicPatGuidedCapabilities,
+  classicPatHasWorkflowScope,
+  parseOAuthScopes,
+  resolveGitHubTokenType,
+  type GitHubTokenMetadata,
+} from "../../src/setup/github-workflow-permissions.js";
+
+function classicMetadata(
+  scopes: string[],
+  overrides?: Partial<GitHubTokenMetadata>,
+): GitHubTokenMetadata {
+  return {
+    login: "weston-uribe",
+    tokenType: "classic",
+    oauthScopes: scopes,
+    hasWorkflowScope: scopes.includes("workflow"),
+    hasRepoScope: scopes.includes("repo") || scopes.includes("public_repo"),
+    ...overrides,
+  };
+}
+
+describe("github-workflow-permissions", () => {
+  it("parses OAuth scope headers", () => {
+    expect(parseOAuthScopes("repo, workflow, read:user")).toEqual([
+      "repo",
+      "workflow",
+      "read:user",
+    ]);
+    expect(parseOAuthScopes(null)).toEqual([]);
+  });
+
+  it("resolves classic vs fine-grained token types", () => {
+    expect(resolveGitHubTokenType("fine-grained", [])).toBe("fine-grained");
+    expect(resolveGitHubTokenType("classic", ["repo"])).toBe("classic");
+    expect(resolveGitHubTokenType(null, ["repo"])).toBe("classic");
+    expect(resolveGitHubTokenType(null, [])).toBe("unknown");
+  });
+
+  it("detects missing workflow scope on classic PATs", () => {
+    expect(classicPatHasWorkflowScope(["repo"])).toBe(false);
+    expect(classicPatHasWorkflowScope(["repo", "workflow"])).toBe(true);
+  });
+
+  it("fails classic PAT guided assessment when workflow scope is missing", () => {
+    const result = assessClassicPatGuidedCapabilities(classicMetadata(["repo"]));
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.message).toContain("missing workflow access");
+      expect(result.message).toContain("How do I get a GitHub token?");
+    }
+  });
+
+  it("passes classic PAT guided assessment when repo and workflow scopes are present", () => {
+    const result = assessClassicPatGuidedCapabilities(
+      classicMetadata(["repo", "workflow"]),
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  it("defers fine-grained workflow proof to Step 2", () => {
+    const result = assessClassicPatGuidedCapabilities(
+      classicMetadata([], { tokenType: "fine-grained" }),
+    );
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.limitation).toContain("Step 2");
+    }
+  });
+});

package/workspace-snapshot/files/tests/setup/gui-remote-storage.test.ts

@@ -0,0 +1,43 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../..",
+);
+
+const REMOTE_GUI_COMPONENTS = [
+  "apps/gui/components/custom/remote-setup-section.tsx",
+  "apps/gui/components/custom/remote-secret-form.tsx",
+  "apps/gui/components/custom/remote-action-preview.tsx",
+  "apps/gui/components/custom/remote-action-confirmation.tsx",
+  "apps/gui/components/custom/target-workflow-pr-card.tsx",
+  "apps/gui/components/custom/guided-cloud-secrets-card.tsx",
+  "apps/gui/components/custom/guided-target-workflow-card.tsx",
+  "apps/gui/components/custom/review-cloud-secrets-disclosure.tsx",
+  "apps/gui/components/custom/configure-experience.tsx",
+  "apps/gui/components/custom/first-run-stepper.tsx",
+  "apps/gui/components/custom/readiness-banner.tsx",
+  "apps/gui/components/custom/setup-dashboard.tsx",
+  "apps/gui/components/custom/setup-readonly-sections.tsx",
+];
+
+const FORBIDDEN_STORAGE_PATTERNS = [
+  /localStorage/,
+  /sessionStorage/,
+  /indexedDB/i,
+  /document\.cookie/,
+];
+
+describe("remote setup GUI storage boundary", () => {
+  for (const relativePath of REMOTE_GUI_COMPONENTS) {
+    it(`${relativePath} does not persist secrets in browser storage`, () => {
+      const source = readFileSync(path.join(repoRoot, relativePath), "utf8");
+      for (const pattern of FORBIDDEN_STORAGE_PATTERNS) {
+        expect(source).not.toMatch(pattern);
+      }
+    });
+  }
+});

package/workspace-snapshot/files/tests/setup/gui-view-model.test.ts

@@ -0,0 +1,251 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  collectLocalDoctorChecks,
+  getSetupStateSummary,
+  summarizeEnvKeyPresence,
+} from "../../src/setup/gui-view-model.js";
+
+function buildConfigExample(repoId: string): string {
+  return JSON.stringify(
+    {
+      version: 1,
+      orchestratorMarker: "harness-orchestrator-v1",
+      logDirectory: "runs",
+      repos: [
+        {
+          id: repoId,
+          linearProjects: ["Example Target App"],
+          targetRepo: "https://github.com/owner/example-target-app",
+          baseBranch: "dev",
+          productionBranch: "main",
+        },
+      ],
+      allowedTargetRepos: ["https://github.com/owner/example-target-app"],
+    },
+    null,
+    2,
+  );
+}
+
+const CONFIG_EXAMPLE = buildConfigExample("target-app");
+
+describe("gui-view-model", () => {
+  let tempRoot = "";
+
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(path.join(tmpdir(), "harness-gui-summary-"));
+    await writeFile(
+      path.join(tempRoot, "harness.config.json"),
+      CONFIG_EXAMPLE,
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".env.example"),
+      "HARNESS_CONFIG_PATH=.harness/config.local.json\nLINEAR_API_KEY=\n",
+      "utf8",
+    );
+    const harnessDir = path.join(tempRoot, ".harness");
+    await mkdir(harnessDir, { recursive: true });
+    await writeFile(
+      path.join(harnessDir, "config.example.json"),
+      CONFIG_EXAMPLE,
+      "utf8",
+    );
+  });
+
+  afterEach(async () => {
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  it("summarizes env key presence without reading secret values into output", async () => {
+    const envPath = path.join(tempRoot, ".env.local");
+    await writeFile(
+      envPath,
+      [
+        "HARNESS_CONFIG_PATH=.harness/config.local.json",
+        "LINEAR_API_KEY=super-secret-linear",
+        "CURSOR_API_KEY=",
+      ].join("\n"),
+      "utf8",
+    );
+
+    const presence = await summarizeEnvKeyPresence(envPath);
+
+    expect(presence.HARNESS_CONFIG_PATH).toBe(true);
+    expect(presence.LINEAR_API_KEY).toBe(true);
+    expect(presence.CURSOR_API_KEY).toBe(false);
+    expect(JSON.stringify(presence)).not.toContain("super-secret-linear");
+  });
+
+  it("builds a setup summary without writing local files", async () => {
+    const summary = await getSetupStateSummary({ cwd: tempRoot });
+    const serialized = JSON.stringify(summary);
+
+    expect(summary.localFiles.some((file) => file.label === ".env.local")).toBe(
+      true,
+    );
+    expect(summary.overview.configResolved).toBe(true);
+    expect(summary.overview.operatorConfigResolved).toBe(false);
+    expect(summary.missingSteps.length).toBeGreaterThan(0);
+    expect(summary.generatedPreviews.envLocal).toContain("HARNESS_CONFIG_PATH=");
+    expect(serialized).not.toContain("super-secret");
+    expect(serialized).not.toMatch(/LINEAR_API_KEY=[A-Za-z0-9_-]{8,}/);
+  });
+
+  it("collects local doctor checks without creating runs/", async () => {
+    const checks = await collectLocalDoctorChecks({
+      cwd: tempRoot,
+      config: JSON.parse(CONFIG_EXAMPLE),
+      envLocalExists: false,
+      configLocalExists: false,
+    });
+
+    expect(checks.some((check) => check.label === ".env.local present")).toBe(
+      true,
+    );
+    expect(
+      checks.some(
+        (check) =>
+          check.skipped &&
+          check.label === "LINEAR_API_KEY set",
+      ),
+    ).toBe(true);
+    await expect(
+      import("node:fs/promises").then((fs) =>
+        fs.access(path.join(tempRoot, "runs")),
+      ),
+    ).rejects.toThrow();
+  });
+
+  it("uses HARNESS_CONFIG_PATH from .env.local over committed harness.config.json", async () => {
+    await writeFile(
+      path.join(tempRoot, "harness.config.json"),
+      buildConfigExample("committed-target"),
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".env.local"),
+      "HARNESS_CONFIG_PATH=.harness/config.local.json\n",
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".harness", "config.local.json"),
+      buildConfigExample("private-target"),
+      "utf8",
+    );
+
+    const summary = await getSetupStateSummary({ cwd: tempRoot });
+
+    expect(summary.configSource.kind).toBe("HARNESS_CONFIG_PATH");
+    expect(summary.configSource.label).toContain("config.local.json");
+    expect(summary.overview.operatorConfigResolved).toBe(true);
+    expect(summary.configSummary?.repos[0]?.id).toBe("private-target");
+    expect(summary.configSummary?.repos[0]?.id).not.toBe("committed-target");
+  });
+
+  it("surfaces a safe parse error without leaking raw file contents or secrets", async () => {
+    const secret = "LOCAL_CONFIG_FILE_SECRET_VALUE_99";
+    await writeFile(
+      path.join(tempRoot, ".env.local"),
+      "HARNESS_CONFIG_PATH=.harness/config.local.json\n",
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".harness", "config.local.json"),
+      `{"version":1,"secret":"${secret}","repos":[]}`,
+      "utf8",
+    );
+
+    const summary = await getSetupStateSummary({ cwd: tempRoot });
+    const serialized = JSON.stringify(summary);
+
+    expect(summary.configSource.resolved).toBe(false);
+    expect(summary.configSource.parseError).toBeTruthy();
+    expect(summary.configSource.parseError).not.toContain(secret);
+    expect(serialized).not.toContain(secret);
+  });
+});
+
+describe("gui-view-model inline config sources", () => {
+  let tempRoot = "";
+  const savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(async () => {
+    savedEnv.HARNESS_CONFIG_JSON = process.env.HARNESS_CONFIG_JSON;
+    savedEnv.HARNESS_CONFIG_JSON_B64 = process.env.HARNESS_CONFIG_JSON_B64;
+    savedEnv.HARNESS_CONFIG_PATH = process.env.HARNESS_CONFIG_PATH;
+    delete process.env.HARNESS_CONFIG_JSON;
+    delete process.env.HARNESS_CONFIG_JSON_B64;
+    delete process.env.HARNESS_CONFIG_PATH;
+
+    tempRoot = await mkdtemp(path.join(tmpdir(), "harness-gui-inline-"));
+    await writeFile(
+      path.join(tempRoot, "harness.config.json"),
+      buildConfigExample("committed-target"),
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".env.example"),
+      "HARNESS_CONFIG_PATH=.harness/config.local.json\nLINEAR_API_KEY=\n",
+      "utf8",
+    );
+    const harnessDir = path.join(tempRoot, ".harness");
+    await mkdir(harnessDir, { recursive: true });
+    await writeFile(
+      path.join(harnessDir, "config.example.json"),
+      buildConfigExample("committed-target"),
+      "utf8",
+    );
+  });
+
+  afterEach(async () => {
+    if (savedEnv.HARNESS_CONFIG_JSON === undefined) {
+      delete process.env.HARNESS_CONFIG_JSON;
+    } else {
+      process.env.HARNESS_CONFIG_JSON = savedEnv.HARNESS_CONFIG_JSON;
+    }
+    if (savedEnv.HARNESS_CONFIG_JSON_B64 === undefined) {
+      delete process.env.HARNESS_CONFIG_JSON_B64;
+    } else {
+      process.env.HARNESS_CONFIG_JSON_B64 = savedEnv.HARNESS_CONFIG_JSON_B64;
+    }
+    if (savedEnv.HARNESS_CONFIG_PATH === undefined) {
+      delete process.env.HARNESS_CONFIG_PATH;
+    } else {
+      process.env.HARNESS_CONFIG_PATH = savedEnv.HARNESS_CONFIG_PATH;
+    }
+
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  it("resolves HARNESS_CONFIG_JSON without exposing the raw JSON string", async () => {
+    const rawJson = JSON.stringify(JSON.parse(buildConfigExample("inline-json-target")));
+    process.env.HARNESS_CONFIG_JSON = rawJson;
+
+    const summary = await getSetupStateSummary({ cwd: tempRoot });
+    const serialized = JSON.stringify(summary);
+
+    expect(summary.configSource.kind).toBe("HARNESS_CONFIG_JSON");
+    expect(summary.configSource.label).toBe("HARNESS_CONFIG_JSON");
+    expect(summary.configSummary?.repos[0]?.id).toBe("inline-json-target");
+    expect(serialized).not.toContain(rawJson);
+  });
+
+  it("resolves HARNESS_CONFIG_JSON_B64 without exposing raw or decoded payloads", async () => {
+    const rawJson = JSON.stringify(JSON.parse(buildConfigExample("inline-b64-target")));
+    const rawB64 = Buffer.from(rawJson, "utf8").toString("base64");
+    process.env.HARNESS_CONFIG_JSON_B64 = rawB64;
+
+    const summary = await getSetupStateSummary({ cwd: tempRoot });
+    const serialized = JSON.stringify(summary);
+
+    expect(summary.configSource.kind).toBe("HARNESS_CONFIG_JSON_B64");
+    expect(summary.configSource.label).toBe("HARNESS_CONFIG_JSON_B64");
+    expect(summary.configSummary?.repos[0]?.id).toBe("inline-b64-target");
+    expect(serialized).not.toContain(rawB64);
+    expect(serialized).not.toContain(rawJson);
+  });
+});