p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/tests/setup/linear-webhook-secret.test.ts

@@ -0,0 +1,256 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+
+vi.mock("../../src/setup/linear-setup-plan.js", () => ({
+  summarizeLinearWebhookReadiness: vi.fn(),
+}));
+
+vi.mock("../../src/setup/linear-setup-client.js", () => ({
+  createLinearSetupClient: vi.fn(),
+  listLinearWebhooks: vi.fn(),
+  createLinearIssueWebhook: vi.fn(),
+  updateLinearIssueWebhook: vi.fn(),
+}));
+
+import {
+  createLinearIssueWebhook,
+  createLinearSetupClient,
+  listLinearWebhooks,
+  updateLinearIssueWebhook,
+} from "../../src/setup/linear-setup-client.js";
+import { summarizeLinearWebhookReadiness } from "../../src/setup/linear-setup-plan.js";
+import {
+  ensureLinearIssueWebhook,
+  generateLinearWebhookSecret,
+  planLinearWebhookSecret,
+  reconcileLinearWebhookUrlForVerification,
+  resolveLinearWebhookCandidateSecret,
+} from "../../src/setup/linear-webhook-secret.js";
+
+describe("linear-webhook-secret", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(createLinearSetupClient).mockReturnValue({} as never);
+    vi.mocked(listLinearWebhooks).mockResolvedValue([]);
+    vi.mocked(summarizeLinearWebhookReadiness).mockResolvedValue({
+      matchingWebhook: undefined,
+      manualSteps: [],
+    });
+  });
+
+  it("generates high-entropy webhook secrets", () => {
+    const secret = generateLinearWebhookSecret();
+    expect(secret).toMatch(/^[0-9a-f]{64}$/);
+    expect(generateLinearWebhookSecret()).not.toBe(secret);
+  });
+
+  it("plans manual-copy when Linear API key is missing without preview secret", async () => {
+    const plan = await planLinearWebhookSecret({
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+    });
+
+    expect(plan.mode).toBe("manual-copy");
+    expect(plan.secret).toBeUndefined();
+    expect(plan.manualSteps.join(" ")).toMatch(/LINEAR_API_KEY/i);
+  });
+
+  it("plans existing-unverified when a matching webhook already exists", async () => {
+    vi.mocked(summarizeLinearWebhookReadiness).mockResolvedValue({
+      matchingWebhook: {
+        id: "wh-1",
+        url: "https://example.vercel.app/api/linear-webhook",
+        enabled: true,
+        resourceTypes: ["Issue"],
+      },
+      manualSteps: [],
+    });
+
+    const plan = await planLinearWebhookSecret({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      linearTeamId: "team-1",
+    });
+
+    expect(plan.mode).toBe("existing-unverified");
+    expect(plan.secret).toBeUndefined();
+    expect(plan.willGenerateOnApply).toBe(true);
+    expect(plan.manualSteps.join(" ")).toMatch(/rotate/i);
+  });
+
+  it("creates a Linear webhook when none exists and returns automated mode", async () => {
+    vi.mocked(createLinearIssueWebhook).mockResolvedValue({
+      id: "wh-new",
+      url: "https://example.vercel.app/api/linear-webhook",
+      enabled: true,
+      resourceTypes: ["Issue"],
+      secret: "generated-secret-from-linear",
+    });
+
+    const result = await ensureLinearIssueWebhook({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      linearTeamId: "team-1",
+      secret: "local-generated-secret",
+    });
+
+    expect(createLinearIssueWebhook).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        url: "https://example.vercel.app/api/linear-webhook",
+        teamId: "team-1",
+        secret: "local-generated-secret",
+      }),
+    );
+    expect(result.mode).toBe("automated");
+    expect(result.secret).toBe("generated-secret-from-linear");
+  });
+
+  it("falls back to manual-copy when webhook creation fails", async () => {
+    vi.mocked(createLinearIssueWebhook).mockRejectedValue(new Error("API unavailable"));
+
+    const result = await ensureLinearIssueWebhook({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      secret: "local-generated-secret",
+    });
+
+    expect(result.mode).toBe("manual-copy");
+    expect(result.secret).toBe("local-generated-secret");
+    expect(result.manualSteps.join(" ")).toMatch(/Create a Linear Issue webhook/i);
+  });
+
+  it("rotates an existing webhook via updateWebhook instead of creating a duplicate", async () => {
+    vi.mocked(listLinearWebhooks).mockResolvedValue([
+      {
+        id: "wh-1",
+        url: "https://example.vercel.app/api/linear-webhook",
+        enabled: true,
+        resourceTypes: ["Issue"],
+        teamId: "team-1",
+      },
+    ]);
+    vi.mocked(updateLinearIssueWebhook).mockResolvedValue({
+      id: "wh-1",
+      url: "https://example.vercel.app/api/linear-webhook",
+      enabled: true,
+      resourceTypes: ["Issue"],
+      teamId: "team-1",
+    });
+
+    const result = await ensureLinearIssueWebhook({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      linearTeamId: "team-1",
+      secret: "candidate-secret",
+    });
+
+    expect(updateLinearIssueWebhook).toHaveBeenCalled();
+    expect(createLinearIssueWebhook).not.toHaveBeenCalled();
+    expect(result.mode).toBe("automated");
+  });
+
+  it("does not rotate an existing webhook during verify-only retry", async () => {
+    vi.mocked(listLinearWebhooks).mockResolvedValue([
+      {
+        id: "wh-1",
+        url: "https://example.vercel.app/api/linear-webhook",
+        enabled: true,
+        resourceTypes: ["Issue"],
+        teamId: "team-1",
+        secret: "known-secret",
+      },
+    ]);
+
+    const result = await ensureLinearIssueWebhook({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      linearTeamId: "team-1",
+      secret: "known-secret",
+      mutatePolicy: "verify-only",
+    });
+
+    expect(updateLinearIssueWebhook).not.toHaveBeenCalled();
+    expect(createLinearIssueWebhook).not.toHaveBeenCalled();
+    expect(result.mode).toBe("automated");
+    expect(result.secret).toBe("known-secret");
+  });
+
+  it("reuses a readable matching webhook secret instead of generating a new one", async () => {
+    vi.mocked(listLinearWebhooks).mockResolvedValue([
+      {
+        id: "wh-1",
+        url: "https://example.vercel.app/api/linear-webhook",
+        enabled: true,
+        resourceTypes: ["Issue"],
+        teamId: "team-1",
+        secret: "readable-secret",
+      },
+    ]);
+
+    const result = await resolveLinearWebhookCandidateSecret({
+      linearApiKey: "lin_api_test",
+      webhookUrl: "https://example.vercel.app/api/linear-webhook",
+      linearTeamId: "team-1",
+    });
+
+    expect(result.source).toBe("reused-readable");
+    expect(result.secret).toBe("readable-secret");
+    expect(result.matchingWebhook?.secret).toBeUndefined();
+  });
+
+  it("reconciles a stale Linear webhook URL to the canonical URL without changing the secret", async () => {
+    vi.mocked(listLinearWebhooks).mockResolvedValue([
+      {
+        id: "wh-1",
+        url: "https://old-deployment.vercel.app/api/linear-webhook",
+        enabled: true,
+        resourceTypes: ["Issue"],
+        teamId: "team-1",
+      },
+    ]);
+    vi.mocked(updateLinearIssueWebhook).mockResolvedValue({
+      id: "wh-1",
+      url: "https://harness-gui.vercel.app/api/linear-webhook",
+      enabled: true,
+      resourceTypes: ["Issue"],
+      teamId: "team-1",
+    });
+
+    const result = await reconcileLinearWebhookUrlForVerification({
+      linearApiKey: "lin_api_test",
+      linearTeamId: "team-1",
+      previousWebhookUrl:
+        "https://old-deployment.vercel.app/api/linear-webhook",
+      canonicalWebhookUrl: "https://harness-gui.vercel.app/api/linear-webhook",
+      secret: "stable-webhook-secret",
+    });
+
+    expect(updateLinearIssueWebhook).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        webhookId: "wh-1",
+        url: "https://harness-gui.vercel.app/api/linear-webhook",
+        secret: "stable-webhook-secret",
+      }),
+    );
+    expect(result.reconciled).toBe(true);
+    expect(result.matchingPreviousWebhookFound).toBe(true);
+    expect(result.canonicalWebhookExists).toBe(false);
+  });
+
+  it("does not reconcile when no matching previous Linear webhook exists", async () => {
+    vi.mocked(listLinearWebhooks).mockResolvedValue([]);
+
+    const result = await reconcileLinearWebhookUrlForVerification({
+      linearApiKey: "lin_api_test",
+      previousWebhookUrl:
+        "https://old-deployment.vercel.app/api/linear-webhook",
+      canonicalWebhookUrl: "https://harness-gui.vercel.app/api/linear-webhook",
+      secret: "stable-webhook-secret",
+    });
+
+    expect(updateLinearIssueWebhook).not.toHaveBeenCalled();
+    expect(result.reconciled).toBe(false);
+    expect(result.matchingPreviousWebhookFound).toBe(false);
+    expect(result.manualSteps.join(" ")).toMatch(/No matching Linear Issue webhook/i);
+  });
+});

package/workspace-snapshot/files/tests/setup/live-provisioning-error-preservation.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it, vi } from "vitest";
+import { GitHubApiError, GitHubClient } from "../../src/github/client.js";
+import {
+  LiveGitHubHarnessProvisioningProvider,
+  preserveGitHubSetupError,
+} from "../../src/setup/github-remote-setup-live.js";
+import { isRetryableGitHubError } from "../../src/setup/harness-snapshot-provisioning.js";
+
+describe("preserveGitHubSetupError", () => {
+  it("preserves GitHubApiError status while redacting token-like content", () => {
+    const error = new GitHubApiError(
+      429,
+      "GitHub API 429: token ghp_sentinelGitHubTokenValue leaked",
+    );
+    const preserved = preserveGitHubSetupError(error);
+    expect(preserved).toBeInstanceOf(GitHubApiError);
+    expect((preserved as GitHubApiError).status).toBe(429);
+    expect(preserved.message).not.toContain("ghp_sentinelGitHubTokenValue");
+    expect(preserved.message).toContain("429");
+  });
+
+  it("preserves 422 status for reconciliation paths", () => {
+    const error = new GitHubApiError(422, '{"message":"Repository creation failed."}');
+    const preserved = preserveGitHubSetupError(error);
+    expect(preserved).toBeInstanceOf(GitHubApiError);
+    expect((preserved as GitHubApiError).status).toBe(422);
+  });
+
+  it("preserves rate-limit metadata through sanitization", () => {
+    const error = new GitHubApiError(429, "rate limit exceeded", {
+      retryAfterSeconds: 12,
+      rateLimitRemaining: 0,
+      rateLimitResetEpochSeconds: 1_700_000_000,
+      requestId: "REQ-1",
+    });
+    const preserved = preserveGitHubSetupError(error) as GitHubApiError;
+    expect(preserved.retryAfterSeconds).toBe(12);
+    expect(preserved.rateLimitRemaining).toBe(0);
+    expect(preserved.rateLimitResetEpochSeconds).toBe(1_700_000_000);
+    expect(preserved.requestId).toBe("REQ-1");
+  });
+});
+
+describe("LiveGitHubHarnessProvisioningProvider error preservation", () => {
+  it("rethrows GitHubApiError with status from createGitBlob", async () => {
+    const client = new GitHubClient({ token: "test-token" });
+    vi.spyOn(client, "createGitBlob").mockRejectedValue(
+      new GitHubApiError(429, "rate limit exceeded"),
+    );
+    const provider = new LiveGitHubHarnessProvisioningProvider(client);
+    await expect(
+      provider.createGitBlob({
+        owner: "test-user",
+        repo: "repo",
+        content: Buffer.from("x"),
+      }),
+    ).rejects.toMatchObject({ status: 429, name: "GitHubApiError" });
+  });
+
+  it("rethrows GitHubApiError with status from createUserRepository", async () => {
+    const client = new GitHubClient({ token: "test-token" });
+    vi.spyOn(client, "createUserRepository").mockRejectedValue(
+      new GitHubApiError(422, '{"message":"name already exists"}'),
+    );
+    const provider = new LiveGitHubHarnessProvisioningProvider(client);
+    await expect(
+      provider.createUserRepository({
+        name: "repo",
+        description: "test",
+        private: true,
+        autoInit: true,
+      }),
+    ).rejects.toMatchObject({ status: 422, name: "GitHubApiError" });
+  });
+});
+
+describe("isRetryableGitHubError", () => {
+  it("retries preserved 429 errors", () => {
+    const error = preserveGitHubSetupError(
+      new GitHubApiError(429, "secondary rate limit"),
+    );
+    expect(isRetryableGitHubError(error)).toBe(true);
+  });
+
+  it("does not retry preserved 422 errors", () => {
+    const error = preserveGitHubSetupError(
+      new GitHubApiError(422, '{"message":"validation failed"}'),
+    );
+    expect(isRetryableGitHubError(error)).toBe(false);
+  });
+
+  it("does not retry preserved permission 403 errors", () => {
+    const error = preserveGitHubSetupError(
+      new GitHubApiError(403, "Resource not accessible by integration"),
+    );
+    expect(isRetryableGitHubError(error)).toBe(false);
+  });
+});

package/workspace-snapshot/files/tests/setup/local-apply-actions.test.ts

@@ -0,0 +1,352 @@
+import { access, mkdtemp, readFile, rm, writeFile, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  applyLocalSetupFiles,
+  computeLocalSetupFingerprint,
+  getLocalFileBaselines,
+  previewLocalSetupFiles,
+} from "../../src/setup/local-apply-actions.js";
+import { redactEnvContent } from "../../src/setup/env-merge.js";
+import { resolveLocalFilePaths } from "../../src/setup/setup-state.js";
+
+const FAKE_SECRETS = {
+  linearApiKey: "fake-linear-secret-value",
+  cursorApiKey: "fake-cursor-secret-value",
+  githubToken: "fake-github-secret-value",
+};
+
+function buildPayload(secrets = FAKE_SECRETS) {
+  return {
+    env: {
+      harnessConfigPath: ".harness/config.local.json",
+      linearApiKey: secrets.linearApiKey,
+      cursorApiKey: secrets.cursorApiKey,
+      githubToken: secrets.githubToken,
+    },
+    config: {
+      linearTeamKey: "WES",
+      modelId: "composer-2.5",
+      repos: [
+        {
+          id: "target-app",
+          targetRepo: "https://github.com/owner/example-target-app",
+          linearProjects: "Example Target App",
+          baseBranch: "dev",
+          productionBranch: "main",
+          previewProvider: "vercel",
+          validationCommands: "npm run lint\nnpm run build",
+        },
+      ],
+    },
+  };
+}
+
+function collectText(value: unknown): string {
+  return JSON.stringify(value);
+}
+
+describe("local-apply-actions", () => {
+  let tempRoot = "";
+
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(path.join(tmpdir(), "harness-local-apply-"));
+    await writeFile(
+      path.join(tempRoot, ".env.example"),
+      "HARNESS_CONFIG_PATH=.harness/config.local.json\n",
+      "utf8",
+    );
+    const harnessDir = path.join(tempRoot, ".harness");
+    await mkdir(harnessDir, { recursive: true });
+    await writeFile(
+      path.join(harnessDir, "config.example.json"),
+      JSON.stringify(
+        {
+          version: 1,
+          repos: [
+            {
+              id: "target-app",
+              targetRepo: "https://github.com/owner/example-target-app",
+            },
+          ],
+          allowedTargetRepos: ["https://github.com/owner/example-target-app"],
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    );
+  });
+
+  afterEach(async () => {
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  it("preview does not write local files and redacts secrets", async () => {
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+    const paths = resolveLocalFilePaths(tempRoot);
+    const serialized = collectText(preview);
+
+    expect(preview.validationError).toBeUndefined();
+    expect(preview.envPreview).toContain("LINEAR_API_KEY=<redacted>");
+    expect(serialized).not.toContain(FAKE_SECRETS.linearApiKey);
+    await expect(access(paths.envLocal)).rejects.toThrow();
+    await expect(access(paths.configLocal)).rejects.toThrow();
+  });
+
+  it("preview output matches apply output when redacted", async () => {
+    const paths = resolveLocalFilePaths(tempRoot);
+    await writeFile(
+      paths.envLocal,
+      [
+        "# local note",
+        "",
+        "MY_CUSTOM_TOOL=keep-me",
+        `LINEAR_API_KEY=${FAKE_SECRETS.linearApiKey}`,
+      ].join("\n"),
+      "utf8",
+    );
+
+    const payload = buildPayload({
+      linearApiKey: "",
+      cursorApiKey: FAKE_SECRETS.cursorApiKey,
+      githubToken: FAKE_SECRETS.githubToken,
+    });
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await applyLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+      confirmed: true,
+      fingerprint: preview.fingerprint,
+    });
+
+    const envLocal = await readFile(paths.envLocal, "utf8");
+    expect(redactEnvContent(envLocal)).toBe(preview.envPreview);
+    expect(envLocal).toContain("MY_CUSTOM_TOOL=keep-me");
+    expect(envLocal).toContain("# local note");
+  });
+
+  it("apply requires confirmation", async () => {
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await expect(
+      applyLocalSetupFiles({
+        cwd: tempRoot,
+        payload,
+        confirmed: false,
+        fingerprint: preview.fingerprint,
+      }),
+    ).rejects.toThrow(/explicit confirmation/);
+  });
+
+  it("apply rejects stale fingerprint when payload changes", async () => {
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await expect(
+      applyLocalSetupFiles({
+        cwd: tempRoot,
+        payload: {
+          ...payload,
+          env: { ...payload.env, linearApiKey: "changed-secret" },
+        },
+        confirmed: true,
+        fingerprint: preview.fingerprint,
+      }),
+    ).rejects.toThrow(/stale/);
+  });
+
+  it("apply rejects when .env.local changes between preview and apply", async () => {
+    const paths = resolveLocalFilePaths(tempRoot);
+    await writeFile(
+      paths.envLocal,
+      `LINEAR_API_KEY=${FAKE_SECRETS.linearApiKey}\n`,
+      "utf8",
+    );
+
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await writeFile(
+      paths.envLocal,
+      `LINEAR_API_KEY=${FAKE_SECRETS.linearApiKey}\nMY_CUSTOM_TOOL=tampered\n`,
+      "utf8",
+    );
+
+    await expect(
+      applyLocalSetupFiles({
+        cwd: tempRoot,
+        payload,
+        confirmed: true,
+        fingerprint: preview.fingerprint,
+      }),
+    ).rejects.toThrow(/stale/);
+  });
+
+  it("apply rejects when .harness/config.local.json changes between preview and apply", async () => {
+    const paths = resolveLocalFilePaths(tempRoot);
+    await writeFile(
+      paths.configLocal,
+      JSON.stringify({ version: 1, repos: [], allowedTargetRepos: [] }),
+      "utf8",
+    );
+
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await writeFile(
+      paths.configLocal,
+      JSON.stringify({ version: 1, repos: [], allowedTargetRepos: [], tampered: true }),
+      "utf8",
+    );
+
+    await expect(
+      applyLocalSetupFiles({
+        cwd: tempRoot,
+        payload,
+        confirmed: true,
+        fingerprint: preview.fingerprint,
+      }),
+    ).rejects.toThrow(/stale/);
+  });
+
+  it("apply writes only local env and config files", async () => {
+    const payload = buildPayload();
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+    const result = await applyLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+      confirmed: true,
+      fingerprint: preview.fingerprint,
+    });
+    const paths = resolveLocalFilePaths(tempRoot);
+    const envLocal = await readFile(paths.envLocal, "utf8");
+    const configLocal = await readFile(paths.configLocal, "utf8");
+    const serialized = collectText(result);
+
+    expect(result.envResult.outcome).toBe("changed");
+    expect(result.configResult.outcome).toBe("changed");
+    expect(envLocal).toContain(`LINEAR_API_KEY=${FAKE_SECRETS.linearApiKey}`);
+    expect(configLocal).toContain('"id": "target-app"');
+    expect(serialized).not.toContain(FAKE_SECRETS.linearApiKey);
+    await expect(access(path.join(tempRoot, "runs"))).rejects.toThrow();
+  });
+
+  it("preserves existing secrets and unrelated env lines when apply receives blank secret fields", async () => {
+    const paths = resolveLocalFilePaths(tempRoot);
+    const existingLinear = "preserved-linear-secret-123";
+    await writeFile(
+      paths.envLocal,
+      [
+        "# keep me",
+        "MY_CUSTOM_TOOL=local-only",
+        `HARNESS_CONFIG_PATH=.harness/config.local.json`,
+        `LINEAR_API_KEY=${existingLinear}`,
+      ].join("\n"),
+      "utf8",
+    );
+
+    const payload = buildPayload({
+      linearApiKey: "",
+      cursorApiKey: FAKE_SECRETS.cursorApiKey,
+      githubToken: FAKE_SECRETS.githubToken,
+    });
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    await applyLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+      confirmed: true,
+      fingerprint: preview.fingerprint,
+    });
+
+    const envLocal = await readFile(paths.envLocal, "utf8");
+    expect(envLocal).toContain("# keep me");
+    expect(envLocal).toContain("MY_CUSTOM_TOOL=local-only");
+    expect(envLocal).toContain(`LINEAR_API_KEY=${existingLinear}`);
+    expect(envLocal).toContain(`CURSOR_API_KEY=${FAKE_SECRETS.cursorApiKey}`);
+    expect(collectText(preview)).not.toContain(existingLinear);
+  });
+
+  it("fingerprint is stable for identical payloads and baselines", async () => {
+    const payload = buildPayload();
+    const paths = resolveLocalFilePaths(tempRoot);
+    const baselines = await getLocalFileBaselines(paths);
+    const a = computeLocalSetupFingerprint(payload, baselines, tempRoot);
+    const b = computeLocalSetupFingerprint(payload, baselines, tempRoot);
+    expect(a).toBe(b);
+  });
+
+  it("preview and apply support multiple guided target repos", async () => {
+    const payload = {
+      ...buildPayload(),
+      config: {
+        repos: [
+          {
+            id: "target-app",
+            targetRepo: "https://github.com/owner/example-target-app",
+            baseBranch: "dev",
+            productionBranch: "main",
+          },
+          {
+            id: "second-app",
+            targetRepo: "https://github.com/owner/second-target-app",
+            baseBranch: "dev",
+            productionBranch: "main",
+          },
+        ],
+      },
+    };
+
+    const preview = await previewLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+    });
+
+    expect(preview.validationError).toBeUndefined();
+    expect(preview.configPreview).toContain('"id": "target-app"');
+    expect(preview.configPreview).toContain('"id": "second-app"');
+    expect(collectText(preview)).not.toContain(FAKE_SECRETS.linearApiKey);
+
+    const apply = await applyLocalSetupFiles({
+      cwd: tempRoot,
+      payload,
+      confirmed: true,
+      fingerprint: preview.fingerprint,
+    });
+
+    const paths = resolveLocalFilePaths(tempRoot);
+    const configLocal = await readFile(paths.configLocal, "utf8");
+    expect(apply.configResult.outcome).toBe("changed");
+    expect(configLocal).toContain('"id": "target-app"');
+    expect(configLocal).toContain('"id": "second-app"');
+  });
+});