p-dev-harness 0.3.1 → 0.4.0

package/workspace-snapshot/files/src/setup/git-askpass-credentials.ts

@@ -0,0 +1,80 @@
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { redactSecretsString } from "../artifacts/redact.js";
+
+export const GIT_ASKPASS_TEMP_PREFIX = "p-dev-git-askpass-";
+
+export interface GitAskpassCredentials {
+  root: string;
+  askpassPath: string;
+  tokenPath: string;
+  env: NodeJS.ProcessEnv;
+  cleanup: () => Promise<void>;
+}
+
+/**
+ * Creates a temporary GIT_ASKPASS helper that reads the token from a 0600 file.
+ * The token is never placed in the remote URL or git command argv.
+ */
+export async function createGitAskpassCredentials(
+  token: string,
+): Promise<GitAskpassCredentials> {
+  const root = await mkdtemp(path.join(tmpdir(), GIT_ASKPASS_TEMP_PREFIX));
+  const tokenPath = path.join(root, "token");
+  const askpassPath = path.join(root, "askpass.sh");
+
+  await writeFile(tokenPath, token, { encoding: "utf8", mode: 0o600 });
+  await chmod(tokenPath, 0o600);
+
+  const script = `#!/bin/sh
+set -eu
+case "$1" in
+  *Username*)
+    printf '%s\\n' "x-access-token"
+    ;;
+  *)
+    cat "$P_DEV_GIT_ASKPASS_TOKEN_FILE"
+    ;;
+esac
+`;
+  await writeFile(askpassPath, script, { encoding: "utf8", mode: 0o700 });
+  await chmod(askpassPath, 0o700);
+
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    GIT_ASKPASS: askpassPath,
+    GIT_TERMINAL_PROMPT: "0",
+    P_DEV_GIT_ASKPASS_TOKEN_FILE: tokenPath,
+  };
+  // Prevent credential helper leakage into logs via nested helpers.
+  delete env.GIT_CONFIG_PARAMETERS;
+
+  return {
+    root,
+    askpassPath,
+    tokenPath,
+    env,
+    cleanup: async () => {
+      await rm(root, { recursive: true, force: true });
+    },
+  };
+}
+
+export function redactGitSubprocessOutput(value: string): string {
+  return redactSecretsString(value);
+}
+
+export function assertNoTokenLeak(input: {
+  token: string;
+  surfaces: Array<string | undefined | null>;
+}): void {
+  for (const surface of input.surfaces) {
+    if (!surface) {
+      continue;
+    }
+    if (surface.includes(input.token)) {
+      throw new Error("Git credential token leaked into a captured surface.");
+    }
+  }
+}

package/workspace-snapshot/files/src/setup/github-dispatch-token.ts

@@ -1,6 +1,8 @@
 import { GitHubApiError, GitHubClient } from "../github/client.js";
 import { resolveHarnessDispatchRepo } from "./harness-dispatch-repo.js";
+import type { HarnessRepoProvisioningSummary } from "./harness-repo-provisioning.js";
 import { inspectGitHubTokenMetadata } from "./service-verification.js";
+import { isPackagedPDevRuntime } from "../p-dev/runtime-mode.js";
 
 export type GitHubDispatchTokenSource =
   | "saved-github-token"
@@ -16,6 +18,9 @@ export interface GitHubDispatchTokenEligibility {
 export async function assessGitHubDispatchTokenEligibility(input: {
   githubToken?: string;
   cwd?: string;
+  harnessProvisioningSummary?: HarnessRepoProvisioningSummary;
+  verifiedDispatchRepo?: string | null;
+  requireVerifiedPackagedDispatchRepo?: boolean;
 }): Promise<GitHubDispatchTokenEligibility> {
   const token = input.githubToken?.trim();
   if (!token) {
@@ -23,17 +28,43 @@ export async function assessGitHubDispatchTokenEligibility(input: {
       eligible: false,
       source: "manual-required",
       message:
-        "Add GITHUB_TOKEN in Step 1 or provide a dispatch token manually in Step 3.",
+        "Add GITHUB_TOKEN in Step 1 with Contents write access to the harness dispatch repository.",
     };
   }
 
-  const dispatchRepo = await resolveHarnessDispatchRepo({ cwd: input.cwd });
+  const packagedRuntime =
+    input.harnessProvisioningSummary?.runtimeMode === "packaged" ||
+    isPackagedPDevRuntime();
+  const verifiedDispatchRepo =
+    input.verifiedDispatchRepo?.trim() ||
+    (input.harnessProvisioningSummary?.verifiedSavedRepo
+      ? input.harnessProvisioningSummary.harnessDispatchRepo?.trim()
+      : undefined);
+
+  if (
+    packagedRuntime &&
+    input.requireVerifiedPackagedDispatchRepo === true &&
+    !verifiedDispatchRepo
+  ) {
+    return {
+      eligible: false,
+      source: "manual-required",
+      message:
+        "Complete Step 1 to connect a verified harness workspace before configuring the PDev automation bridge.",
+    };
+  }
+
+  const dispatchRepo = await resolveHarnessDispatchRepo({
+    cwd: input.cwd,
+    verifiedProvisioningRepo: verifiedDispatchRepo,
+  });
   if (!dispatchRepo.resolved || !dispatchRepo.repo) {
     return {
       eligible: false,
       source: "manual-required",
       message:
-        "Could not resolve the harness dispatch repository. Set GITHUB_DISPATCH_REPOSITORY or verify git remote origin.",
+        dispatchRepo.detail ??
+        "Could not resolve the harness dispatch repository. Set GITHUB_DISPATCH_REPOSITORY in Step 1.",
     };
   }
 

package/workspace-snapshot/files/src/setup/github-remote-provider.ts

@@ -24,6 +24,8 @@ import {
 } from "./mock-git-repository-store.js";
 import type { GitHubGitCommitAuthor } from "../github/client.js";
 import { GitHubApiError } from "../github/client.js";
+import type { WorkspaceSnapshotManifest } from "../p-dev/workspace-snapshot-types.js";
+import type { HarnessGitTransportTimings } from "./harness-snapshot-git-transport.js";
 
 export interface GitCommitIdentity {
   name: string;
@@ -196,6 +198,36 @@ export interface GitHubHarnessProvisioningProvider {
   writeRepositoryFile(
     input: RepositoryFileWriteInput,
   ): Promise<{ commitSha: string }>;
+  /**
+   * Optional bulk git transport. When present, live provisioning pushes
+   * snapshot+marker commits with one authenticated git push instead of
+   * per-file createGitBlob REST mutations.
+   */
+  pushHarnessSnapshotCommits?(input: {
+    owner: string;
+    repo: string;
+    defaultBranch: string;
+    expectedHeadSha: string;
+    initializedCommitSha: string;
+    snapshotRoot: string;
+    manifest: WorkspaceSnapshotManifest;
+    operationId: string;
+    packageVersion: string;
+    buildMarkerContent: (snapshotCommitSha: string) => string;
+    existingSnapshotCommitSha?: string;
+    timeoutMs?: number;
+    onProgress?: (progress: {
+      phase: "preparing-snapshot" | "workspace-uploading" | "verifying";
+      completed?: number;
+      total?: number;
+    }) => void;
+  }): Promise<{
+    snapshotCommitSha: string;
+    markerCommitSha: string;
+    snapshotGitTreeSha1: string;
+    pushCount: number;
+    timings: HarnessGitTransportTimings;
+  }>;
 }
 
 export interface HarnessSecretWriteRequest {
@@ -208,6 +240,16 @@ export interface HarnessSecretWriteResultEntry {
   status: "created" | "updated";
 }
 
+export interface HarnessVariableWriteRequest {
+  name: string;
+  value: string;
+}
+
+export interface HarnessVariableWriteResultEntry {
+  name: string;
+  status: "created" | "updated";
+}
+
 export interface TargetWorkflowApplyInput {
   targetRepoSlug: string;
   productionBranch: string;
@@ -250,6 +292,10 @@ export interface GitHubRemoteSetupProvider {
     harnessDispatchRepo: string,
     secrets: HarnessSecretWriteRequest[],
   ): Promise<HarnessSecretWriteResultEntry[]>;
+  writeHarnessVariables?(
+    harnessDispatchRepo: string,
+    variables: HarnessVariableWriteRequest[],
+  ): Promise<HarnessVariableWriteResultEntry[]>;
   applyTargetWorkflowPr(
     input: TargetWorkflowApplyInput,
   ): Promise<TargetWorkflowApplyResult>;
@@ -265,6 +311,7 @@ export interface MockGitHubRemoteSetupProviderState {
   productionBranchSha?: string;
   existingOpenPrUrl?: string;
   writeHarnessSecretsResult?: HarnessSecretWriteResultEntry[];
+  writeHarnessVariablesResult?: HarnessVariableWriteResultEntry[];
   applyTargetWorkflowResult?: TargetWorkflowApplyResult;
   finalizationScenario?: MockWorkflowFinalizationScenario;
   harnessDispatchRepo?: HarnessDispatchRepoResolution;
@@ -405,6 +452,24 @@ export class MockGitHubRemoteSetupProvider implements GitHubRemoteSetupProvider
     );
   }
 
+  async writeHarnessVariables(
+    harnessDispatchRepo: string,
+    variables: HarnessVariableWriteRequest[],
+  ): Promise<HarnessVariableWriteResultEntry[]> {
+    this.calls.push({
+      method: "writeHarnessVariables",
+      args: [harnessDispatchRepo, variables.map((entry) => entry.name)],
+    });
+
+    return (
+      this.state.writeHarnessVariablesResult ??
+      variables.map((variable) => ({
+        name: variable.name,
+        status: "created",
+      }))
+    );
+  }
+
   async applyTargetWorkflowPr(
     input: TargetWorkflowApplyInput,
   ): Promise<TargetWorkflowApplyResult> {
@@ -556,6 +621,13 @@ export class MockGitHubHarnessProvisioningProvider
     this.repositoryMetadataVisibilityAttempts = 0;
   }
 
+  async dispose(): Promise<void> {
+    for (const store of this.gitStores.values()) {
+      await store.destroy();
+    }
+    this.gitStores.clear();
+  }
+
   async getRepositoryMetadata(
     owner: string,
     repo: string,
@@ -735,12 +807,16 @@ export class MockGitHubHarnessProvisioningProvider
     input: CreateUserRepositoryInput,
   ): Promise<CreateUserRepositoryResult> {
     this.calls.push({ method: "createUserRepository", args: [input] });
-    const fullName = `test-user/${input.name}`;
+    const login =
+      this.state.authenticatedUser?.login?.trim() ||
+      this.state.tokenCapabilities?.login?.trim() ||
+      "test-user";
+    const fullName = `${login}/${input.name}`;
     const key = fullName;
     const repositoryId = deterministicMockRepositoryId(key);
     const defaultBranch = this.state.createdRepositoryDefaultBranch ?? "main";
     this.repositories[key] = withRepositoryId(key, {
-      owner: "test-user",
+      owner: login,
       repo: input.name,
       repositoryId,
       description: input.description,

package/workspace-snapshot/files/src/setup/github-remote-setup-live.ts

@@ -34,6 +34,8 @@ import {
   type GitHubTokenCapabilitySummary,
   type HarnessSecretWriteRequest,
   type HarnessSecretWriteResultEntry,
+  type HarnessVariableWriteRequest,
+  type HarnessVariableWriteResultEntry,
   type RepositoryFileWriteInput,
   type TargetWorkflowApplyInput,
   type TargetWorkflowApplyResult,
@@ -43,6 +45,11 @@ import {
   classicPatHasWorkflowScope,
   resolveGitHubTokenType,
 } from "./github-workflow-permissions.js";
+import {
+  buildGitHubHttpsRemoteUrl,
+  pushHarnessSnapshotViaGit,
+} from "./harness-snapshot-git-transport.js";
+import type { WorkspaceSnapshotManifest } from "../p-dev/workspace-snapshot-types.js";
 
 export function parseRepoSlug(slug: string): { owner: string; repo: string } {
   const [owner, repo] = slug.split("/");
@@ -150,6 +157,16 @@ export function preserveGitHubSetupError(error: unknown): Error {
       },
     );
   }
+  // Preserve typed provisioning errors (timeouts, FF conflicts, tree mismatch).
+  if (
+    error &&
+    typeof error === "object" &&
+    "code" in error &&
+    "recoverable" in error &&
+    error instanceof Error
+  ) {
+    return error;
+  }
   return new Error(sanitizeGitHubSetupError(error));
 }
 
@@ -257,6 +274,24 @@ export class LiveGitHubRemoteSetupProvider implements GitHubRemoteSetupProvider
     return results;
   }
 
+  async writeHarnessVariables(
+    harnessDispatchRepo: string,
+    variables: HarnessVariableWriteRequest[],
+  ): Promise<HarnessVariableWriteResultEntry[]> {
+    const { owner, repo } = parseRepoSlug(harnessDispatchRepo);
+    const results: HarnessVariableWriteResultEntry[] = [];
+    for (const variable of variables) {
+      const status = await this.client.upsertActionsVariable(
+        owner,
+        repo,
+        variable.name,
+        variable.value,
+      );
+      results.push({ name: variable.name, status });
+    }
+    return results;
+  }
+
   async checkTargetWorkflowStatus(input: {
     targetRepoSlug: string;
     workflowPath: string;
@@ -391,13 +426,7 @@ export class LiveGitHubRemoteSetupProvider implements GitHubRemoteSetupProvider
       hashWorkflowContent(existingContent) ===
         hashWorkflowContent(input.workflowContent)
     ) {
-      const openPr = await this.findOpenInstallPullRequest(input);
-      return {
-        outcome: openPr ? "pr-updated" : "branch-updated",
-        branchName: input.branchName,
-        prUrl: openPr?.html_url,
-        directProductionBranchWrite: false,
-      };
+      return this.resolveInstallPullRequestOutcome(input);
     }
 
     await this.client.createOrUpdateRepositoryFile({
@@ -410,6 +439,12 @@ export class LiveGitHubRemoteSetupProvider implements GitHubRemoteSetupProvider
       sha: existingSha,
     });
 
+    return this.resolveInstallPullRequestOutcome(input);
+  }
+
+  private async resolveInstallPullRequestOutcome(
+    input: TargetWorkflowApplyInput,
+  ): Promise<TargetWorkflowApplyResult> {
     const openPr = await this.findOpenInstallPullRequest(input);
     if (openPr) {
       return {
@@ -420,6 +455,7 @@ export class LiveGitHubRemoteSetupProvider implements GitHubRemoteSetupProvider
       };
     }
 
+    const { owner, repo } = parseRepoSlug(input.targetRepoSlug);
     const created = await this.client.createPullRequest({
       owner,
       repo,
@@ -458,12 +494,17 @@ export class LiveGitHubHarnessProvisioningProvider
   implements GitHubHarnessProvisioningProvider
 {
   private readonly client: GitHubClient;
+  private readonly token: string;
 
   constructor(options: GitHubClientOptions | GitHubClient) {
-    this.client =
-      options instanceof GitHubClient
-        ? options
-        : new GitHubClient(options);
+    if (options instanceof GitHubClient) {
+      this.client = options;
+      // Token is private on GitHubClient; live push requires explicit token options.
+      this.token = "";
+    } else {
+      this.client = new GitHubClient(options);
+      this.token = options.token;
+    }
   }
 
   private mapRepositoryToMetadata(
@@ -766,6 +807,67 @@ export class LiveGitHubHarnessProvisioningProvider
       throw preserveGitHubSetupError(error);
     }
   }
+
+  async pushHarnessSnapshotCommits(input: {
+    owner: string;
+    repo: string;
+    defaultBranch: string;
+    expectedHeadSha: string;
+    initializedCommitSha: string;
+    snapshotRoot: string;
+    manifest: WorkspaceSnapshotManifest;
+    operationId: string;
+    packageVersion: string;
+    buildMarkerContent: (snapshotCommitSha: string) => string;
+    existingSnapshotCommitSha?: string;
+    timeoutMs?: number;
+    onProgress?: (progress: {
+      phase: "preparing-snapshot" | "workspace-uploading" | "verifying";
+      completed?: number;
+      total?: number;
+    }) => void;
+  }): Promise<{
+    snapshotCommitSha: string;
+    markerCommitSha: string;
+    snapshotGitTreeSha1: string;
+    pushCount: number;
+    timings: import("./harness-snapshot-git-transport.js").HarnessGitTransportTimings;
+  }> {
+    if (!this.token) {
+      throw new Error(
+        "Live GitHub provisioning provider is missing a token for authenticated git push.",
+      );
+    }
+    try {
+      const result = await pushHarnessSnapshotViaGit({
+        auth: {
+          remoteUrl: buildGitHubHttpsRemoteUrl(input.owner, input.repo),
+          token: this.token,
+        },
+        owner: input.owner,
+        repo: input.repo,
+        defaultBranch: input.defaultBranch,
+        expectedHeadSha: input.expectedHeadSha,
+        initializedCommitSha: input.initializedCommitSha,
+        snapshotRoot: input.snapshotRoot,
+        manifest: input.manifest,
+        operationId: input.operationId,
+        buildMarkerContent: input.buildMarkerContent,
+        existingSnapshotCommitSha: input.existingSnapshotCommitSha,
+        timeoutMs: input.timeoutMs,
+        onProgress: input.onProgress,
+      });
+      return {
+        snapshotCommitSha: result.snapshotCommitSha,
+        markerCommitSha: result.markerCommitSha,
+        snapshotGitTreeSha1: result.snapshotGitTreeSha1,
+        pushCount: result.pushCount,
+        timings: result.timings,
+      };
+    } catch (error) {
+      throw preserveGitHubSetupError(error);
+    }
+  }
 }
 
 export function createLiveGitHubHarnessProvisioningProvider(

package/workspace-snapshot/files/src/setup/github-repository-name.ts

@@ -0,0 +1,63 @@
+const GITHUB_REPOSITORY_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
+
+const RESERVED_REPOSITORY_NAMES = new Set([
+  "settings",
+  "admin",
+  "root",
+  "api",
+  "www",
+  "mail",
+  "support",
+  "help",
+  "status",
+  "security",
+]);
+
+export function normalizeGitHubRepositoryName(name: string): string {
+  return name.trim();
+}
+
+export function validateGitHubRepositoryName(
+  name: string,
+): { ok: true; normalized: string } | { ok: false; reason: string } {
+  const normalized = normalizeGitHubRepositoryName(name);
+  if (!normalized) {
+    return { ok: false, reason: "Repository name is required." };
+  }
+  if (normalized.length > 100) {
+    return { ok: false, reason: "Repository name must be 100 characters or fewer." };
+  }
+  if (!GITHUB_REPOSITORY_NAME_PATTERN.test(normalized)) {
+    return {
+      ok: false,
+      reason:
+        "Repository name may only contain letters, numbers, dots, underscores, and hyphens.",
+    };
+  }
+  if (normalized.startsWith(".") || normalized.endsWith(".")) {
+    return {
+      ok: false,
+      reason: "Repository name cannot start or end with a dot.",
+    };
+  }
+  if (normalized.includes("..")) {
+    return { ok: false, reason: "Repository name cannot contain consecutive dots." };
+  }
+  if (RESERVED_REPOSITORY_NAMES.has(normalized.toLowerCase())) {
+    return { ok: false, reason: "Repository name is reserved." };
+  }
+  return { ok: true, normalized };
+}
+
+export function validateRepositoryOwnerMatchesActor(
+  owner: string,
+  actorLogin: string,
+): { ok: true } | { ok: false; reason: string } {
+  if (owner.trim().toLowerCase() !== actorLogin.trim().toLowerCase()) {
+    return {
+      ok: false,
+      reason: "Repository owner must match the authenticated GitHub user.",
+    };
+  }
+  return { ok: true };
+}