p-dev-harness 0.3.1 → 0.4.0

package/workspace-snapshot/files/apps/gui/lib/setup-server.ts

@@ -1,7 +1,8 @@
 import "server-only";
 
 import { randomUUID } from "node:crypto";
-import { resolveHarnessRepoRoot } from "@harness/gui/repo-root";
+import path from "node:path";
+import { resolveHarnessWorkspaceDir } from "@harness/gui/repo-root";
 import {
   applyLocalSetupFiles,
   applyConnectServicesEnv,
@@ -32,8 +33,19 @@ import {
 import { createLiveGitHubRemoteSetupProvider } from "@harness/setup/github-remote-setup-live";
 import { createLiveGitHubHarnessProvisioningProvider,
 } from "@harness/setup/github-remote-setup-live";
-import { tryCreateHarnessTestProvisioningProvider } from "@harness/setup/test-only-provisioning-provider";
+import {
+  applyTargetRepoProvisioning,
+  previewTargetRepoProvisioning,
+  type TargetRepoProvisioningApplyInput,
+  type TargetRepoProvisioningApplyResult,
+  type TargetRepoProvisioningPreview,
+  type TargetRepoProvisioningRequest,
+} from "@harness/setup/target-repo-provisioning";
+import { createLiveGitHubTargetRepositoryProvider } from "@harness/setup/github-target-repository-provider-live";
+import { tryCreateTargetRepoTestProvisioningProvider } from "@harness/setup/test-only-target-repo-provisioning-provider";
+import type { GitHubTargetRepositoryProvider } from "@harness/setup/github-target-repository-provider";
 import { tryCreateHarnessTestRemoteSetupProvider } from "@harness/setup/test-only-remote-setup-provider";
+import { tryCreateHarnessTestProvisioningProvider } from "@harness/setup/test-only-provisioning-provider";
 import {
   applyHarnessRepoProvisioning,
   loadHarnessRepoProvisioningSummary,
@@ -42,12 +54,38 @@ import {
   type HarnessRepoProvisioningPreview,
   type HarnessRepoProvisioningSummary,
 } from "@harness/setup/harness-repo-provisioning";
+import {
+  loadHarnessProvisioningDiagnosticReport,
+  type HarnessProvisioningDiagnosticReport,
+} from "@harness/setup/harness-provisioning-progress";
+import { readHarnessProvisioningPendingState } from "@harness/setup/harness-provisioning-pending-state";
+import { loadEmbeddedWorkspaceSnapshot } from "@harness/setup/harness-workspace-snapshot-loader.js";
+import {
+  captureAnalyticsEvent,
+  captureProductError,
+  isAnalyticsCaptureEnabled,
+  registerProvisioningOperationId,
+} from "@harness/observability/facade.js";
+import {
+  deriveConnectedToExistingManagedWorkspace,
+  deriveCreatedSnapshotBackedWorkspace,
+} from "@harness/observability/provisioning-analytics.js";
+import {
+  bucketProvisioningDurationMs,
+  bucketSnapshotFileCount,
+} from "@harness/observability/privacy-schema.js";
+import {
+  mapHarnessProvisioningStateToFailureCategory,
+  productErrorCodeFromProvisioningState,
+  shouldCaptureProvisioningStateAsProductError,
+} from "@harness/observability/product-errors.js";
 import {
   MockGitHubRemoteSetupProvider,
   type GitHubRemoteSetupProvider,
   type GitHubHarnessProvisioningProvider,
 } from "@harness/setup/github-remote-provider";
 import { GitHubClient } from "@harness/github/client";
+import { isPackagedPDevRuntime } from "@harness/p-dev/runtime-mode";
 import type { HarnessSecretOperatorInput } from "@harness/setup/harness-secret-setup";
 import {
   buildManualHarnessSecretCopyValues,
@@ -70,10 +108,36 @@ import type {
   TargetWorkflowFinalizationResult,
 } from "@harness/setup/target-workflow-finalization-types";
 import { collectRemoteSecretInputs } from "@harness/setup/redact-secrets";
-import {
-  loadGithubTokenFromEnvLocal,
+import { loadGithubTokenFromEnvLocal,
   hasGithubTokenConfigured,
 } from "@harness/setup/setup-github-auth";
+import { createLiveRunnerUpgradeProvider } from "@harness/setup/runner-upgrade-provider-live";
+import { tryCreateHarnessTestRunnerUpgradeProvider } from "@harness/setup/test-only-runner-upgrade-provider";
+import {
+  acceptRunnerUpgrade,
+  executeRunnerUpgradeOperation,
+  loadRunnerUpgradeStatus,
+  previewRunnerUpgrade,
+} from "@harness/setup/runner-upgrade";
+import {
+  configureRunnerUpgradeWorker,
+  ensureRunnerUpgradeWorkerStarted,
+} from "@harness/setup/runner-upgrade-worker";
+import {
+  readRunnerUpgradeProgress,
+  type RunnerUpgradeProgressState,
+} from "@harness/setup/runner-upgrade-progress";
+import type {
+  RunnerUpgradeAcceptResult,
+  RunnerUpgradePreviewResult,
+  RunnerUpgradeStatusResult,
+} from "@harness/setup/runner-upgrade-types";
+import { runnerUpgradeStatusLabel } from "@harness/setup/runner-upgrade-types";
+import type { RunnerUpgradeGitHubProvider } from "@harness/setup/runner-upgrade-provider";
+import {
+  RUNNER_UPGRADE_STATUS_PROVIDER_TIMEOUT_MS,
+  RUNNER_UPGRADE_WORKER_PROVIDER_TIMEOUT_MS,
+} from "@harness/setup/runner-upgrade-timeouts";
 import {
   loadControlPlaneReadinessContext,
 } from "@harness/setup/control-plane-readiness-server";
@@ -83,13 +147,36 @@ import {
   type LinearSetupPlanInput,
   type LinearSetupPreview,
 } from "@harness/setup/linear-setup-apply";
+import {
+  loadLinearSetupProgressReport,
+  type LinearSetupProgressReport,
+} from "@harness/setup/linear-setup-progress";
 import { buildLinearSetupSummary } from "@harness/setup/linear-setup-summary";
 import {
   createLinearSetupClient,
+  getLinearOrganizationSummary,
   listLinearProjects,
   listLinearTeams,
 } from "@harness/setup/linear-setup-client";
 import { previewLinearSetup } from "@harness/setup/linear-setup-plan";
+import {
+  applyLinearWorkspace,
+  type LinearWorkspaceApplyResult,
+  type LinearWorkspacePlanInput,
+} from "@harness/setup/linear-workspace-apply";
+import {
+  previewLinearWorkspace,
+  type LinearWorkspacePreview,
+} from "@harness/setup/linear-workspace-plan";
+import { computeLinearAssociationsFingerprint } from "@harness/setup/linear-workspace-migration";
+import { resolveLinearAssociationsFromConfig } from "@harness/config/resolve-linear-workspace";
+import { loadHarnessConfig } from "@harness/config/load-config";
+import {
+  applyLinearWorkspaceMigration,
+  inspectLinearWorkspaceMigration,
+} from "@harness/setup/linear-workspace-migration";
+import { detectConfigControlPlaneDrift } from "@harness/setup/linear-workspace-drift";
+import { readControlPlaneSetupState } from "@harness/setup/control-plane-setup-state";
 import {
   applyVercelBridgeSetup,
   type VercelBridgeApplyResult,
@@ -99,8 +186,11 @@ import {
 import { pollVercelBridgeRedeployVerification } from "@harness/setup/vercel-bridge-redeploy-poll";
 import { buildVercelSetupSummary } from "@harness/setup/vercel-setup-summary";
 import { previewVercelBridgeSetup } from "@harness/setup/vercel-setup-plan";
-import { loadSecretFromEnvLocal } from "@harness/setup/service-verification";
-import { readControlPlaneSetupState } from "@harness/setup/control-plane-setup-state";
+import {
+  loadSecretFromEnvLocal,
+  verifySetupService,
+  type SetupServiceName,
+} from "@harness/setup/service-verification";
 import { assessGitHubDispatchTokenEligibility } from "@harness/setup/github-dispatch-token";
 import {
   loadVercelBridgeOptions,
@@ -128,8 +218,28 @@ export interface RemoteTargetWorkflowFormPayload {
   manualHarnessDispatchRepo?: string;
 }
 
+export type ServiceConnectionSummaryStatus =
+  | "missing"
+  | "connected"
+  | "failed"
+  | "unknown"
+  | "stale";
+
+export type ServiceConnectionSummary = {
+  status: ServiceConnectionSummaryStatus;
+  message?: string;
+  label?: string;
+  limitation?: string;
+  checkedAt?: string;
+};
+
+export type ServiceConnectionSummaryMap = Record<
+  "LINEAR_API_KEY" | "CURSOR_API_KEY" | "GITHUB_TOKEN" | "VERCEL_TOKEN",
+  ServiceConnectionSummary
+>;
+
 function resolveCwd(): string {
-  return resolveHarnessRepoRoot();
+  return resolveHarnessWorkspaceDir();
 }
 
 async function resolveRemoteProvider(): Promise<
@@ -146,6 +256,134 @@ async function resolveRemoteProvider(): Promise<
   return createLiveGitHubRemoteSetupProvider(token!);
 }
 
+async function resolveRunnerUpgradeProvider(): Promise<
+  RunnerUpgradeGitHubProvider | undefined
+> {
+  const testProvider = await tryCreateHarnessTestRunnerUpgradeProvider();
+  if (testProvider) {
+    return testProvider;
+  }
+  const token = await loadGithubTokenFromEnvLocal({ cwd: resolveCwd() });
+  if (!hasGithubTokenConfigured(token)) {
+    return undefined;
+  }
+  return createLiveRunnerUpgradeProvider(token!, {
+    timeoutMs: RUNNER_UPGRADE_WORKER_PROVIDER_TIMEOUT_MS,
+  });
+}
+
+async function resolveRunnerUpgradeStatusProvider(): Promise<
+  RunnerUpgradeGitHubProvider | undefined
+> {
+  const testProvider = await tryCreateHarnessTestRunnerUpgradeProvider();
+  if (testProvider) {
+    return testProvider;
+  }
+  const token = await loadGithubTokenFromEnvLocal({ cwd: resolveCwd() });
+  if (!hasGithubTokenConfigured(token)) {
+    return undefined;
+  }
+  return createLiveRunnerUpgradeProvider(token!, {
+    timeoutMs: RUNNER_UPGRADE_STATUS_PROVIDER_TIMEOUT_MS,
+  });
+}
+
+export async function loadRunnerUpgradeStatusForGui(options?: {
+  debugTimings?: boolean;
+  testHangAfterStage?: import("@harness/setup/runner-upgrade-timeouts").RunnerUpgradeStatusStage;
+  overallDeadlineMs?: number;
+}): Promise<RunnerUpgradeStatusResult> {
+  // Status must not start or await the upgrade worker. Worker starts on apply
+  // and via instrumentation.ts only.
+  const cwd = resolveCwd();
+  const provider = await resolveRunnerUpgradeStatusProvider();
+  if (!provider) {
+    return {
+      status: "failed",
+      statusLabel: runnerUpgradeStatusLabel("failed"),
+      blockedReason:
+        "GITHUB_TOKEN is required to check or update the managed p-dev runner.",
+      retryAvailable: true,
+    };
+  }
+  return loadRunnerUpgradeStatus(cwd, provider, {
+    debugTimings: options?.debugTimings === true,
+    testHangAfterStage: options?.testHangAfterStage,
+    overallDeadlineMs: options?.overallDeadlineMs,
+    workspaceKey: cwd,
+  });
+}
+
+function ensureRunnerUpgradeGuiWorkerConfigured(): void {
+  configureRunnerUpgradeWorker({
+    resolveProvider: async () => resolveRunnerUpgradeProvider(),
+    execute: async (cwd, provider) =>
+      executeRunnerUpgradeOperation(cwd, provider, {}),
+  });
+  ensureRunnerUpgradeWorkerStarted();
+}
+
+export async function previewRunnerUpgradeForGui(): Promise<RunnerUpgradePreviewResult> {
+  const provider = await resolveRunnerUpgradeProvider();
+  if (!provider) {
+    return {
+      previewFingerprint: "",
+      targetSnapshotContentId: "",
+      phases: [],
+      blocked: true,
+      blockedStatus: "failed",
+      message:
+        "GITHUB_TOKEN is required to preview a managed p-dev runner upgrade.",
+      impact: {
+        replacePathCount: 0,
+        deletePathCount: 0,
+        sampleReplacePaths: [],
+        sampleDeletePaths: [],
+      },
+    };
+  }
+  return previewRunnerUpgrade(resolveCwd(), provider);
+}
+
+export async function applyRunnerUpgradeForGui(options: {
+  confirmed: boolean;
+  previewFingerprint?: string;
+  resume?: boolean;
+}): Promise<{
+  apply: RunnerUpgradeAcceptResult;
+  progress: RunnerUpgradeProgressState;
+  status: RunnerUpgradeStatusResult;
+}> {
+  if (!options.confirmed) {
+    throw new Error("Confirmed apply is required.");
+  }
+  ensureRunnerUpgradeGuiWorkerConfigured();
+  const tokenPresent = await resolveRunnerUpgradeProvider();
+  if (!tokenPresent) {
+    throw new Error(
+      "GITHUB_TOKEN is required to apply a managed p-dev runner upgrade.",
+    );
+  }
+  const accepted = await acceptRunnerUpgrade(resolveCwd(), {
+    previewFingerprint: options.previewFingerprint,
+    resume: options.resume === true,
+  });
+  return {
+    apply: accepted.apply,
+    progress: accepted.progress,
+    status: {
+      status: "updating",
+      statusLabel: runnerUpgradeStatusLabel("updating"),
+      pendingOperationId: accepted.apply.operationId,
+      pendingPhase: accepted.apply.phase,
+    },
+  };
+}
+
+export async function loadRunnerUpgradeProgressForGui(): Promise<RunnerUpgradeProgressState | null> {
+  return readRunnerUpgradeProgress(resolveCwd());
+}
+
 function toOperatorInput(
   payload: RemoteSecretFormPayload,
 ): HarnessSecretOperatorInput {
@@ -202,9 +440,10 @@ export async function loadRemoteSetupSummary(): Promise<RemoteSetupSummary> {
 }
 
 export async function loadFirstRunReadiness(): Promise<FirstRunReadiness> {
-  const [summary, remoteSummary] = await Promise.all([
+  const [summary, remoteSummary, harnessProvisioningSummary] = await Promise.all([
     loadSetupSummary(),
     loadRemoteSetupSummary(),
+    loadHarnessRepoProvisioningSummaryRemote(),
   ]);
   const controlPlaneContext = await loadControlPlaneReadinessContext(
     resolveCwd(),
@@ -215,6 +454,7 @@ export async function loadFirstRunReadiness(): Promise<FirstRunReadiness> {
     remoteSummary,
     staleSmokeDiagnostics: remoteSummary.staleSmokeDiagnostics,
     controlPlaneContext,
+    harnessProvisioningSummary,
   });
 }
 
@@ -229,6 +469,7 @@ export async function loadSetupFormDefaults(): Promise<{
       GITHUB_TOKEN: boolean;
       VERCEL_TOKEN: boolean;
     };
+    serviceConnectionSummaries: ServiceConnectionSummaryMap;
   };
   config: Awaited<ReturnType<typeof loadConfigFormDefaults>>;
 }> {
@@ -236,11 +477,20 @@ export async function loadSetupFormDefaults(): Promise<{
   const paths = resolveLocalFilePaths(cwd);
   const existingEnv = await readExistingEnvFile(paths);
   const config = await loadConfigFormDefaults({ cwd });
-  const gitRemoteOriginUrl = await readGitRemoteOrigin(cwd);
+  const gitRemoteOriginUrl = isPackagedPDevRuntime()
+    ? null
+    : await readGitRemoteOrigin(cwd);
   const suggestedHarnessDispatchRepo = gitRemoteOriginUrl
     ? parseGitHubRepoSlug(gitRemoteOriginUrl) ?? undefined
     : undefined;
 
+  const secretPresence = {
+    LINEAR_API_KEY: existingEnv?.presence.LINEAR_API_KEY ?? false,
+    CURSOR_API_KEY: existingEnv?.presence.CURSOR_API_KEY ?? false,
+    GITHUB_TOKEN: existingEnv?.presence.GITHUB_TOKEN ?? false,
+    VERCEL_TOKEN: existingEnv?.presence.VERCEL_TOKEN ?? false,
+  };
+
   return {
     env: {
       harnessConfigPath:
@@ -248,17 +498,72 @@ export async function loadSetupFormDefaults(): Promise<{
       githubDispatchRepository:
         existingEnv?.values.GITHUB_DISPATCH_REPOSITORY ?? "",
       suggestedHarnessDispatchRepo,
-      secretPresence: {
-        LINEAR_API_KEY: existingEnv?.presence.LINEAR_API_KEY ?? false,
-        CURSOR_API_KEY: existingEnv?.presence.CURSOR_API_KEY ?? false,
-        GITHUB_TOKEN: existingEnv?.presence.GITHUB_TOKEN ?? false,
-        VERCEL_TOKEN: existingEnv?.presence.VERCEL_TOKEN ?? false,
-      },
+      secretPresence,
+      serviceConnectionSummaries: await loadServiceConnectionSummaries(
+        cwd,
+        secretPresence,
+      ),
     },
     config,
   };
 }
 
+const SERVICE_SUMMARY_MAP: Record<
+  keyof ServiceConnectionSummaryMap,
+  SetupServiceName
+> = {
+  LINEAR_API_KEY: "linear",
+  CURSOR_API_KEY: "cursor",
+  GITHUB_TOKEN: "github",
+  VERCEL_TOKEN: "vercel",
+};
+
+async function loadServiceConnectionSummaries(
+  cwd: string,
+  presence: Record<keyof ServiceConnectionSummaryMap, boolean>,
+): Promise<ServiceConnectionSummaryMap> {
+  const entries = await Promise.all(
+    (Object.keys(SERVICE_SUMMARY_MAP) as Array<keyof ServiceConnectionSummaryMap>).map(
+      async (key) => {
+        if (!presence[key]) {
+          return [key, { status: "missing" as const }] as const;
+        }
+
+        try {
+          const result = await verifySetupService({
+            cwd,
+            service: SERVICE_SUMMARY_MAP[key],
+          });
+          return [
+            key,
+            {
+              status: result.status,
+              message: result.message,
+              label: result.label,
+              limitation: result.limitation,
+              checkedAt: new Date().toISOString(),
+            },
+          ] as const;
+        } catch (error) {
+          return [
+            key,
+            {
+              status: "unknown" as const,
+              message:
+                error instanceof Error
+                  ? error.message
+                  : "Saved credential could not be verified.",
+              checkedAt: new Date().toISOString(),
+            },
+          ] as const;
+        }
+      },
+    ),
+  );
+
+  return Object.fromEntries(entries) as ServiceConnectionSummaryMap;
+}
+
 export async function previewLocalFiles(
   payload: LocalSetupFormPayload,
 ): Promise<LocalSetupPreviewResult> {
@@ -402,6 +707,7 @@ export async function finalizeTargetWorkflowRemoteAction(
   payload: RemoteTargetWorkflowFormPayload & {
     prUrl?: string;
     branchName?: string;
+    operationId?: string;
   },
 ): Promise<{
   finalization: TargetWorkflowFinalizationResult;
@@ -421,6 +727,7 @@ export async function finalizeTargetWorkflowRemoteAction(
       manualHarnessDispatchRepo: payload.manualHarnessDispatchRepo,
       prUrl: payload.prUrl,
       branchName: payload.branchName,
+      operationId: payload.operationId,
     },
   });
   const summary = await loadRemoteSetupSummary();
@@ -469,9 +776,12 @@ async function enrichVercelBridgePlan(
   const linearApiKey = plan.linearApiKey ?? (await loadLinearApiKey(cwd));
   const githubToken = await loadSecretFromEnvLocal({ cwd, key: "GITHUB_TOKEN" });
   const controlPlane = await readControlPlaneSetupState(cwd);
+  const harnessProvisioningSummary = await loadHarnessRepoProvisioningSummaryRemote();
   const dispatchEligibility = await assessGitHubDispatchTokenEligibility({
     githubToken,
     cwd,
+    harnessProvisioningSummary,
+    requireVerifiedPackagedDispatchRepo: true,
   });
   const savedWebhookSecret = await loadSecretFromEnvLocal({
     cwd,
@@ -493,6 +803,9 @@ async function enrichVercelBridgePlan(
       plan.envInput?.GITHUB_DISPATCH_TOKEN?.trim() || !dispatchEligibility.eligible
         ? undefined
         : githubToken,
+    derivedGithubDispatchRepository: dispatchEligibility.eligible
+      ? dispatchEligibility.repository
+      : undefined,
     willGenerateLinearWebhookSecret: reuseSavedLocalWebhookSecret
       ? true
       : (plan.willGenerateLinearWebhookSecret ?? !hasOperatorWebhookSecret),
@@ -508,6 +821,8 @@ export async function loadLinearSetupSummary() {
 }
 
 export async function loadLinearWorkspaceOptions(): Promise<{
+  workspaceId: string;
+  workspaceName: string;
   teams: Awaited<ReturnType<typeof listLinearTeams>>;
   projects: Awaited<ReturnType<typeof listLinearProjects>>;
 }> {
@@ -517,11 +832,17 @@ export async function loadLinearWorkspaceOptions(): Promise<{
     throw new Error("LINEAR_API_KEY is required to load Linear workspace options.");
   }
   const client = createLinearSetupClient(linearApiKey);
-  const [teams, projects] = await Promise.all([
+  const [organization, teams, projects] = await Promise.all([
+    getLinearOrganizationSummary(client),
     listLinearTeams(client),
     listLinearProjects(client),
   ]);
-  return { teams, projects };
+  return {
+    workspaceId: organization.id,
+    workspaceName: organization.name,
+    teams,
+    projects,
+  };
 }
 
 export async function loadVercelSetupSummary() {
@@ -563,17 +884,141 @@ export async function applyLinearSetupRemote(options: {
   return { apply, summary };
 }
 
+export async function loadLinearSetupProgressRemote(): Promise<LinearSetupProgressReport> {
+  return loadLinearSetupProgressReport(resolveCwd());
+}
+
+export async function ensureLinearWorkspaceMigrated(cwd = resolveCwd()) {
+  const inspection = await inspectLinearWorkspaceMigration({ cwd });
+  if (inspection.status !== "nothing_to_migrate") {
+    return inspection;
+  }
+
+  const linearApiKey = (await loadLinearApiKey(cwd)) ?? "";
+  if (!linearApiKey) {
+    return inspection;
+  }
+
+  const controlPlane = await readControlPlaneSetupState(cwd);
+  if (!controlPlane?.linear?.teamId) {
+    return inspection;
+  }
+
+  const client = createLinearSetupClient(linearApiKey);
+  const organization = await getLinearOrganizationSummary(client);
+  const candidateInspection = await inspectLinearWorkspaceMigration({
+    cwd,
+    workspaceId: organization.id,
+    workspaceName: organization.name,
+  });
+  if (candidateInspection.status !== "candidate") {
+    return candidateInspection;
+  }
+
+  return applyLinearWorkspaceMigration({
+    cwd,
+    workspaceId: organization.id,
+    workspaceName: organization.name,
+    candidate: candidateInspection.candidate,
+  });
+}
+
+export async function loadLinearWorkspaceEditorState(cwd = resolveCwd()) {
+  await ensureLinearWorkspaceMigrated(cwd);
+  const summary = await buildLinearSetupSummary(cwd);
+  const loaded = await loadHarnessConfig({ baseDir: cwd });
+  const controlPlane = await readControlPlaneSetupState(cwd);
+  const associations = resolveLinearAssociationsFromConfig(loaded.config);
+  const expectedCommittedFingerprint = computeLinearAssociationsFingerprint(
+    loaded.config,
+  );
+  const evidence = summary.controlPlane?.linearWorkspace;
+  const driftWarnings = detectConfigControlPlaneDrift({
+    config: loaded.config,
+    controlPlane,
+  });
+  return {
+    summary,
+    associations,
+    repos: loaded.config.repos.map((repo) => ({
+      id: repo.id,
+      targetRepo: repo.targetRepo,
+    })),
+    expectedCommittedFingerprint,
+    workspaceId:
+      loaded.config.linear?.workspaceId ?? evidence?.workspaceId ?? "",
+    workspaceName: evidence?.workspaceName ?? "Linear workspace",
+    driftWarnings,
+  };
+}
+
+export async function previewLinearWorkspaceRemote(
+  payload: Omit<
+    LinearWorkspacePlanInput,
+    "linearApiKey" | "expectedCommittedFingerprint"
+  > & {
+    linearApiKey?: string;
+    expectedCommittedFingerprint: string;
+  },
+): Promise<LinearWorkspacePreview> {
+  const cwd = resolveCwd();
+  const linearApiKey =
+    payload.linearApiKey ?? (await loadLinearApiKey(cwd)) ?? "";
+  return previewLinearWorkspace({
+    ...payload,
+    linearApiKey,
+    cwd,
+  });
+}
+
+export async function applyLinearWorkspaceRemote(options: {
+  plan: Omit<
+    LinearWorkspacePlanInput,
+    "linearApiKey" | "expectedCommittedFingerprint"
+  > & {
+    linearApiKey?: string;
+    expectedCommittedFingerprint: string;
+  };
+  confirmed: boolean;
+  fingerprint?: string;
+}): Promise<{
+  apply: LinearWorkspaceApplyResult;
+  summary: Awaited<ReturnType<typeof buildLinearSetupSummary>>;
+  expectedCommittedFingerprint: string;
+}> {
+  const cwd = resolveCwd();
+  const linearApiKey =
+    options.plan.linearApiKey ?? (await loadLinearApiKey(cwd)) ?? "";
+  const apply = await applyLinearWorkspace({
+    plan: { ...options.plan, linearApiKey, cwd },
+    confirmed: options.confirmed,
+    fingerprint: options.fingerprint,
+    cwd,
+  });
+  const summary = await buildLinearSetupSummary(cwd);
+  const loaded = await loadHarnessConfig({ baseDir: cwd });
+  return {
+    apply,
+    summary,
+    expectedCommittedFingerprint: computeLinearAssociationsFingerprint(
+      loaded.config,
+    ),
+  };
+}
+
 export async function loadVercelBridgeOptionsRemote(input?: {
   teamId?: string;
 }) {
   const cwd = resolveCwd();
   const vercelToken = (await loadVercelToken(cwd)) ?? "";
   const githubToken = await loadSecretFromEnvLocal({ cwd, key: "GITHUB_TOKEN" });
+  const harnessProvisioningSummary = await loadHarnessRepoProvisioningSummaryRemote();
   return loadVercelBridgeOptions({
     vercelToken,
     githubToken,
     cwd,
     teamId: input?.teamId,
+    harnessProvisioningSummary,
   });
 }
 
@@ -658,6 +1103,12 @@ export async function loadHarnessRepoProvisioningSummaryRemote(): Promise<Harnes
   });
 }
 
+export async function loadHarnessProvisioningDiagnosticRemote(): Promise<HarnessProvisioningDiagnosticReport> {
+  const cwd = resolveCwd();
+  const pending = await readHarnessProvisioningPendingState(cwd);
+  return loadHarnessProvisioningDiagnosticReport({ cwd, pending });
+}
+
 export async function previewHarnessRepoProvisioningRemote(options?: {
   operationId?: string;
 }): Promise<HarnessRepoProvisioningPreview> {
@@ -718,6 +1169,24 @@ export async function applyHarnessRepoProvisioningRemote(options: {
     provider,
     operationId: options.operationId,
   });
+
+  registerProvisioningOperationId(options.operationId);
+
+  let snapshotFileCountBucket = "unknown";
+  if (isAnalyticsCaptureEnabled()) {
+    const snapshotPreview = await loadEmbeddedWorkspaceSnapshot(import.meta.url);
+    snapshotFileCountBucket = snapshotPreview.ok
+      ? bucketSnapshotFileCount(snapshotPreview.manifest.fileCount)
+      : "unknown";
+
+    captureAnalyticsEvent({
+      type: "p_dev_workspace_provision_started",
+      snapshotFileCountBucket,
+      resumedFromDurablePendingState: provisioning.resumedFromPending,
+    });
+  }
+
+  const startedAt = Date.now();
   const apply = await applyHarnessRepoProvisioning({
     cwd: resolveCwd(),
     provider,
@@ -725,6 +1194,63 @@ export async function applyHarnessRepoProvisioningRemote(options: {
     fingerprint: options.fingerprint,
     operationId: options.operationId,
   });
+
+  if (isAnalyticsCaptureEnabled()) {
+    const durationBucket = bucketProvisioningDurationMs(Date.now() - startedAt);
+
+    if (apply.persisted) {
+      captureAnalyticsEvent({
+        type: "p_dev_workspace_provision_completed",
+        snapshotFileCountBucket,
+        durationBucket,
+        retryCountBucket: "unknown",
+        rateLimitPauseCountBucket: "unknown",
+        outcome: "success",
+        resumedFromDurablePendingState: provisioning.resumedFromPending,
+        connectedToExistingLegacyWorkspace:
+          deriveConnectedToExistingManagedWorkspace({
+            persisted: apply.persisted,
+            previewState: provisioning.state,
+          }),
+        createdSnapshotBackedWorkspace: deriveCreatedSnapshotBackedWorkspace({
+          persisted: apply.persisted,
+          applyState: apply.state,
+          preview: provisioning,
+        }),
+      });
+    } else {
+      const failureCategory = mapHarnessProvisioningStateToFailureCategory(
+        apply.state,
+      );
+      captureAnalyticsEvent({
+        type: "p_dev_workspace_provision_failed",
+        snapshotFileCountBucket,
+        durationBucket,
+        retryCountBucket: "unknown",
+        rateLimitPauseCountBucket: "unknown",
+        failureCategory,
+        resumedFromDurablePendingState: provisioning.resumedFromPending,
+        recoveryStateRemainedAfterFailure: apply.recoverable,
+      });
+      if (shouldCaptureProvisioningStateAsProductError(apply.state)) {
+        captureProductError({
+          lifecyclePhase: "provisioning",
+          productErrorCode: productErrorCodeFromProvisioningState(apply.state),
+          errorCategory: failureCategory,
+        });
+      }
+    }
+  } else if (shouldCaptureProvisioningStateAsProductError(apply.state)) {
+    const failureCategory = mapHarnessProvisioningStateToFailureCategory(
+      apply.state,
+    );
+    captureProductError({
+      lifecyclePhase: "provisioning",
+      productErrorCode: productErrorCodeFromProvisioningState(apply.state),
+      errorCategory: failureCategory,
+    });
+  }
+
   const summary = await getSetupStateSummary({ cwd: resolveCwd() });
   return { apply, summary, provisioning };
 }
@@ -817,6 +1343,66 @@ export async function applyConnectServicesRemote(options: {
   return { summary };
 }
 
+async function resolveTargetRepoProvisioningProvider(): Promise<
+  GitHubTargetRepositoryProvider | undefined
+> {
+  const testProvider = tryCreateTargetRepoTestProvisioningProvider();
+  if (testProvider) {
+    return testProvider;
+  }
+  const token = await loadGithubTokenFromEnvLocal({ cwd: resolveCwd() });
+  if (!hasGithubTokenConfigured(token)) {
+    return undefined;
+  }
+  return createLiveGitHubTargetRepositoryProvider(token!);
+}
+
+export async function previewTargetRepoProvisioningRemote(
+  request: TargetRepoProvisioningRequest,
+): Promise<TargetRepoProvisioningPreview> {
+  const provider = await resolveTargetRepoProvisioningProvider();
+  if (!provider) {
+    return {
+      state: "invalid-input",
+      fingerprint: "",
+      operationId: request.operationId ?? "",
+      creationActionId: request.creationActionId ?? "",
+      createdAt: request.createdAt ?? "",
+      owner: request.owner,
+      repositoryName: request.name,
+      repositoryFullName: `${request.owner}/${request.name}`,
+      visibility: request.visibility ?? "private",
+      description: request.description ?? "",
+      initialBranches: ["main", "dev"],
+      initialFilePaths: ["README.md", ".p-dev/product.json"],
+      resultingTargetRepoConfigId: `target-${request.name}`,
+      actionsWillPerform: [],
+      actionsWillNotPerform: [],
+      message: "GITHUB_TOKEN is required before creating a product repository.",
+      resumedFromPending: false,
+    };
+  }
+  return previewTargetRepoProvisioning({
+    request,
+    provider,
+    cwd: resolveCwd(),
+  });
+}
+
+export async function applyTargetRepoProvisioningRemote(
+  apply: TargetRepoProvisioningApplyInput,
+): Promise<TargetRepoProvisioningApplyResult> {
+  const provider = await resolveTargetRepoProvisioningProvider();
+  if (!provider) {
+    throw new Error("GITHUB_TOKEN is required before creating a product repository.");
+  }
+  return applyTargetRepoProvisioning({
+    apply,
+    provider,
+    cwd: resolveCwd(),
+  });
+}
+
 export type {
   SetupGuiViewModel,
   LocalSetupFormPayload,
@@ -832,5 +1418,10 @@ export type {
   LinearSetupApplyResult,
   VercelBridgePreview,
   VercelBridgeApplyResult,
+  TargetRepoProvisioningPreview,
+  TargetRepoProvisioningApplyResult,
+  TargetRepoProvisioningRequest,
+  TargetRepoProvisioningApplyInput,
+  HarnessRepoProvisioningSummary,
 };