p-dev-harness 0.3.1 → 0.4.0

package/workspace-snapshot/files/tests/setup/vercel-setup-plan.test.ts

@@ -37,9 +37,11 @@ import {
   previewVercelBridgeSetup,
   resolveVercelBridgeEnvValue,
 } from "../../src/setup/vercel-setup-plan.js";
+import { validateVercelProjectName } from "../../src/setup/vercel-project-name.js";
 
 describe("vercel-setup-plan", () => {
   beforeEach(() => {
+    vi.clearAllMocks();
     vi.mocked(listVercelTeams).mockResolvedValue([]);
     vi.mocked(listVercelProjects).mockResolvedValue([
       { id: "proj-1", name: "harness-gui", accountId: "acct-1" },
@@ -94,6 +96,12 @@ describe("vercel-setup-plan", () => {
         generatedLinearWebhookSecret: "generated-secret",
       }),
     ).toBe("generated-secret");
+    expect(
+      resolveVercelBridgeEnvValue({
+        key: "GITHUB_DISPATCH_REPOSITORY",
+        derivedGithubDispatchRepository: "owner/private-harness",
+      }),
+    ).toBe("owner/private-harness");
   });
 
   it("plans derived harness team key and generated webhook secret in preview", async () => {
@@ -102,6 +110,7 @@ describe("vercel-setup-plan", () => {
       projectId: "proj-1",
       derivedHarnessTeamKey: "WES",
       derivedGithubDispatchToken: "ghp_saved",
+      derivedGithubDispatchRepository: "owner/private-harness",
       willGenerateLinearWebhookSecret: true,
       linearApiKey: "lin_api_test",
     });
@@ -123,6 +132,12 @@ describe("vercel-setup-plan", () => {
           action: "create",
           desiredType: "sensitive",
         }),
+        expect.objectContaining({
+          key: "GITHUB_DISPATCH_REPOSITORY",
+          source: "derived",
+          action: "create",
+          desiredType: "plain",
+        }),
         expect.objectContaining({
           key: "LINEAR_WEBHOOK_SECRET",
           source: "generated",
@@ -142,15 +157,58 @@ describe("vercel-setup-plan", () => {
       project: { mode: "create", projectName: "harness-configure-step3-test" },
       derivedHarnessTeamKey: "WES",
       derivedGithubDispatchToken: "ghp_saved",
+      derivedGithubDispatchRepository: "owner/private-harness",
       willGenerateLinearWebhookSecret: true,
     });
 
     expect(preview.validationError).toBeUndefined();
     expect(preview.selectedProject).toBeUndefined();
     expect(preview.deploymentStatus).toBe("project-will-be-created");
+    expect(preview.endpointReachable).toBe(false);
+    expect(preview.webhookUrl).toBeUndefined();
+    expect(preview.githubDispatchSource).toBe("saved-github-token");
+    expect(preview.envWritePlan).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          key: "LINEAR_WEBHOOK_SECRET",
+          action: "create",
+        }),
+        expect.objectContaining({
+          key: "GITHUB_DISPATCH_TOKEN",
+          action: "create",
+        }),
+        expect.objectContaining({
+          key: "GITHUB_DISPATCH_REPOSITORY",
+          action: "create",
+        }),
+      ]),
+    );
     expect(preview.manualSteps.join(" ")).toMatch(/will be created during apply/i);
   });
 
+  it("validates Vercel project names with shared lowercase rules", async () => {
+    expect(validateVercelProjectName("valid.name_123-test")).toMatchObject({
+      valid: true,
+      normalized: "valid.name_123-test",
+    });
+    expect(validateVercelProjectName("InvalidName").valid).toBe(false);
+    expect(validateVercelProjectName("bad/name").valid).toBe(false);
+    expect(validateVercelProjectName("").valid).toBe(false);
+    expect(validateVercelProjectName("a".repeat(101)).valid).toBe(false);
+  });
+
+  it("rejects invalid create-new project names in preview", async () => {
+    const preview = await previewVercelBridgeSetup({
+      vercelToken: "vercel-token",
+      team: { mode: "existing", teamId: "" },
+      project: { mode: "create", projectName: "InvalidName" },
+      derivedHarnessTeamKey: "WES",
+    });
+
+    expect(preview.validationError).toMatch(/lowercase/i);
+    expect(listVercelProjects).not.toHaveBeenCalled();
+  });
+
   it("reports missing deployment for existing projects without production URL", async () => {
     vi.mocked(resolveCanonicalProductionTarget).mockResolvedValue(undefined);
 

package/workspace-snapshot/files/tests/setup/workflow-install-branch-recovery-commit.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  buildWorkflowInstallPrMarker,
+  hashWorkflowContentSha256,
+  recoverHarnessInstallBranch,
+  workflowInstallPrBodyContainsMarker,
+} from "../../src/setup/workflow-install-branch-recovery.js";
+import { TARGET_WORKFLOW_PATH } from "../../src/setup/remote-actions.js";
+import { buildTargetWorkflowBranchName } from "../../src/setup/target-workflow-setup.js";
+
+const REPO_CONFIG_ID = "weston-uribe-portfolio";
+const BRANCH_NAME = buildTargetWorkflowBranchName(REPO_CONFIG_ID);
+const WORKFLOW = "name: Trigger harness production sync\n";
+
+describe("recoverHarnessInstallBranch commit-first recovery", () => {
+  it("builds a verified commit before force-updating the reserved branch", async () => {
+    const productionSha = "prod-sha";
+    const commitSha = "commit-sha";
+    let branchHead = "stale-sha";
+
+    const client = {
+      getBranchRef: vi.fn(async (_o: string, _r: string, ref: string) => ({
+        ref: `refs/heads/${ref}`,
+        object: {
+          sha: ref === "main" ? productionSha : branchHead,
+          type: "commit",
+          url: "",
+        },
+      })),
+      getGitCommit: vi.fn(async (_o: string, _r: string, sha: string) => ({
+        sha,
+        tree: { sha: sha === commitSha ? "new-tree" : "prod-tree" },
+        parents: sha === commitSha ? [{ sha: productionSha }] : [],
+      })),
+      createGitBlob: vi.fn(async () => ({ sha: "blob" })),
+      createGitTree: vi.fn(async () => ({ sha: "new-tree", tree: [] })),
+      createGitCommit: vi.fn(async () => ({
+        sha: commitSha,
+        tree: { sha: "new-tree" },
+        parents: [{ sha: productionSha }],
+      })),
+      compareCommits: vi.fn(async () => ({
+        status: "ahead",
+        ahead_by: 1,
+        behind_by: 0,
+        commits: [],
+        files: [{ filename: TARGET_WORKFLOW_PATH }],
+      })),
+      updateGitRef: vi.fn(async (input: { sha: string }) => {
+        branchHead = input.sha;
+        return {
+          ref: `refs/heads/${BRANCH_NAME}`,
+          object: { sha: input.sha, type: "commit", url: "" },
+        };
+      }),
+      createGitRef: vi.fn(),
+      getRepositoryContent: vi.fn(async () => ({
+        content: Buffer.from(WORKFLOW).toString("base64"),
+        encoding: "base64",
+      })),
+      decodeRepositoryContent: (content: { content: string }) =>
+        Buffer.from(content.content, "base64").toString("utf8"),
+    };
+
+    const result = await recoverHarnessInstallBranch({
+      client: client as never,
+      targetRepoSlug: "weston-uribe/weston-uribe-portfolio",
+      productionBranch: "main",
+      branchName: BRANCH_NAME,
+      workflowPath: TARGET_WORKFLOW_PATH,
+      workflowContent: WORKFLOW,
+      expectedReservedBranchHeadSha: "stale-sha",
+    });
+
+    expect(result.recovered).toBe(true);
+    if (result.recovered) {
+      expect(result.headSha).toBe(commitSha);
+      expect(result.headSha).not.toBe(productionSha);
+    }
+    expect(client.createGitCommit).toHaveBeenCalled();
+    expect(client.updateGitRef).toHaveBeenCalledWith(
+      expect.objectContaining({ sha: commitSha, force: true }),
+    );
+  });
+
+  it("reconciles instead of overwriting when reserved branch head changes", async () => {
+    const client = {
+      getBranchRef: vi
+        .fn()
+        .mockResolvedValueOnce({
+          object: { sha: "prod", type: "commit", url: "" },
+        })
+        .mockResolvedValueOnce({
+          object: { sha: "changed-by-other-tab", type: "commit", url: "" },
+        }),
+      getGitCommit: vi.fn(async () => ({
+        sha: "prod",
+        tree: { sha: "tree" },
+        parents: [],
+      })),
+      createGitBlob: vi.fn(async () => ({ sha: "blob" })),
+      createGitTree: vi.fn(async () => ({ sha: "tree2", tree: [] })),
+      createGitCommit: vi.fn(async () => ({
+        sha: "commit",
+        tree: { sha: "tree2" },
+        parents: [{ sha: "prod" }],
+      })),
+      compareCommits: vi.fn(async () => ({
+        status: "ahead",
+        ahead_by: 1,
+        behind_by: 0,
+        commits: [],
+        files: [{ filename: TARGET_WORKFLOW_PATH }],
+      })),
+      updateGitRef: vi.fn(),
+      createGitRef: vi.fn(),
+    };
+
+    const result = await recoverHarnessInstallBranch({
+      client: client as never,
+      targetRepoSlug: "weston-uribe/weston-uribe-portfolio",
+      productionBranch: "main",
+      branchName: BRANCH_NAME,
+      workflowPath: TARGET_WORKFLOW_PATH,
+      workflowContent: WORKFLOW,
+      expectedReservedBranchHeadSha: "stale-sha",
+    });
+
+    expect(result.recovered).toBe(false);
+    if (!result.recovered) {
+      expect(result.needsReconciliation).toBe(true);
+    }
+    expect(client.updateGitRef).not.toHaveBeenCalled();
+  });
+
+  it("embeds and matches the durable workflow-install PR marker", () => {
+    const marker = buildWorkflowInstallPrMarker(REPO_CONFIG_ID);
+    expect(marker).toBe("<!-- p-dev-workflow-install:weston-uribe-portfolio -->");
+    expect(
+      workflowInstallPrBodyContainsMarker(`body\n${marker}\n`, REPO_CONFIG_ID),
+    ).toBe(true);
+    expect(hashWorkflowContentSha256(WORKFLOW)).toHaveLength(64);
+  });
+});

package/workspace-snapshot/files/tests/setup/workflow-install-branch-recovery.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  isStaleHarnessInstallBranch,
+  validateInstallBranchRecoveryProof,
+} from "../../src/setup/workflow-install-branch-recovery.js";
+import { buildTargetWorkflowBranchName } from "../../src/setup/target-workflow-setup.js";
+import { TARGET_WORKFLOW_PATH } from "../../src/setup/remote-actions.js";
+
+const REPO_CONFIG_ID = "weston-uribe-portfolio";
+const TARGET_REPO_SLUG = "weston-uribe/weston-uribe-portfolio";
+const BRANCH_NAME = buildTargetWorkflowBranchName(REPO_CONFIG_ID);
+
+describe("workflow-install-branch-recovery", () => {
+  describe("validateInstallBranchRecoveryProof", () => {
+    it("accepts a harness-owned install branch that matches all proof gates", () => {
+      const result = validateInstallBranchRecoveryProof({
+        configuredTargetRepoSlug: TARGET_REPO_SLUG,
+        observedTargetRepoSlug: TARGET_REPO_SLUG,
+        configuredRepoConfigId: REPO_CONFIG_ID,
+        reservedBranchName: BRANCH_NAME,
+        observedBranchName: BRANCH_NAME,
+        configuredProductionBranch: "main",
+        observedProductionBranch: "main",
+        configuredWorkflowPath: TARGET_WORKFLOW_PATH,
+        pullRequestOwner: "weston-uribe",
+        pullRequestRepo: "weston-uribe-portfolio",
+        openPullRequestsOnBranch: 1,
+      });
+      expect(result).toEqual({ ok: true });
+    });
+
+    it("rejects recovery when multiple open PRs use the reserved branch", () => {
+      const result = validateInstallBranchRecoveryProof({
+        configuredTargetRepoSlug: TARGET_REPO_SLUG,
+        observedTargetRepoSlug: TARGET_REPO_SLUG,
+        configuredRepoConfigId: REPO_CONFIG_ID,
+        reservedBranchName: BRANCH_NAME,
+        observedBranchName: BRANCH_NAME,
+        configuredProductionBranch: "main",
+        observedProductionBranch: "main",
+        configuredWorkflowPath: TARGET_WORKFLOW_PATH,
+        pullRequestOwner: "weston-uribe",
+        pullRequestRepo: "weston-uribe-portfolio",
+        openPullRequestsOnBranch: 2,
+      });
+      expect(result.ok).toBe(false);
+    });
+
+    it("rejects recovery when PR head branch does not match reserved namespace", () => {
+      const result = validateInstallBranchRecoveryProof({
+        configuredTargetRepoSlug: TARGET_REPO_SLUG,
+        observedTargetRepoSlug: TARGET_REPO_SLUG,
+        configuredRepoConfigId: REPO_CONFIG_ID,
+        reservedBranchName: BRANCH_NAME,
+        observedBranchName: "feature/unrelated",
+        configuredProductionBranch: "main",
+        observedProductionBranch: "main",
+        configuredWorkflowPath: TARGET_WORKFLOW_PATH,
+        pullRequestOwner: "weston-uribe",
+        pullRequestRepo: "weston-uribe-portfolio",
+        openPullRequestsOnBranch: 1,
+      });
+      expect(result.ok).toBe(false);
+    });
+  });
+
+  describe("isStaleHarnessInstallBranch", () => {
+    it("does not treat an empty changed-files list alone as stale", () => {
+      expect(
+        isStaleHarnessInstallBranch({
+          changedFiles: [],
+          workflowPath: TARGET_WORKFLOW_PATH,
+          mergeableState: "clean",
+          compareStatus: "identical",
+          headWorkflowMatchesIntended: true,
+          filesValidationPassed: false,
+        }),
+      ).toBe(false);
+    });
+
+    it("treats behind merge state with invalid files as stale", () => {
+      expect(
+        isStaleHarnessInstallBranch({
+          changedFiles: [],
+          workflowPath: TARGET_WORKFLOW_PATH,
+          mergeableState: "behind",
+          compareStatus: "behind",
+          headWorkflowMatchesIntended: true,
+          filesValidationPassed: false,
+        }),
+      ).toBe(true);
+    });
+
+    it("treats diverged compare status as stale even when files list is empty", () => {
+      expect(
+        isStaleHarnessInstallBranch({
+          changedFiles: [],
+          workflowPath: TARGET_WORKFLOW_PATH,
+          mergeableState: "clean",
+          compareStatus: "diverged",
+          headWorkflowMatchesIntended: true,
+          filesValidationPassed: false,
+        }),
+      ).toBe(true);
+    });
+
+    it("treats mismatched head workflow content as stale", () => {
+      expect(
+        isStaleHarnessInstallBranch({
+          changedFiles: [{ path: TARGET_WORKFLOW_PATH }],
+          workflowPath: TARGET_WORKFLOW_PATH,
+          mergeableState: "clean",
+          compareStatus: "ahead",
+          headWorkflowMatchesIntended: false,
+          filesValidationPassed: true,
+        }),
+      ).toBe(true);
+    });
+
+    it("is not stale when file validation already passed", () => {
+      expect(
+        isStaleHarnessInstallBranch({
+          changedFiles: [{ path: TARGET_WORKFLOW_PATH }],
+          workflowPath: TARGET_WORKFLOW_PATH,
+          mergeableState: "clean",
+          compareStatus: "ahead",
+          headWorkflowMatchesIntended: true,
+          filesValidationPassed: true,
+        }),
+      ).toBe(false);
+    });
+  });
+});

package/workspace-snapshot/files/tests/setup/workflow-install-merge-errors.test.ts

@@ -14,14 +14,79 @@ describe("workflow-install-merge-errors", () => {
     expect(result.waiting).toBe(false);
   });
 
-  it("classifies pending checks as waiting", () => {
+  it("does not classify blocked merge state alone as review-required", () => {
+    const result = classifyWorkflowInstallMergeRejection({
+      error: new GitHubApiError(422, "Repository rule violations found"),
+      mergeableState: "blocked",
+    });
+    expect(result.category).not.toBe("review-required");
+    expect(result.category).toBe("merge-api-failure");
+  });
+
+  it("classifies explicit review requirement from API wording", () => {
+    const result = classifyWorkflowInstallMergeRejection({
+      error: new GitHubApiError(
+        422,
+        "Pull request is not mergeable: approving review is required",
+      ),
+    });
+    expect(result.category).toBe("review-required");
+    expect(result.waiting).toBe(false);
+  });
+
+  it("prefers structured check policy over loose API message for checks", () => {
     const result = classifyWorkflowInstallMergeRejection({
       error: new GitHubApiError(422, "Required status check is pending"),
+      checkPolicy: {
+        decision: "allow",
+        classification: null,
+        reason: "Pending checks present; proceeding per allowPendingChecks",
+        warnings: [],
+      },
+    });
+    expect(result.category).not.toBe("checks-pending");
+    expect(result.category).toBe("merge-api-failure");
+  });
+
+  it("classifies failing checks from structured check policy", () => {
+    const result = classifyWorkflowInstallMergeRejection({
+      error: new GitHubApiError(422, "Merge blocked"),
+      checkPolicy: {
+        decision: "block",
+        classification: "checks_failing",
+        reason: "Failing checks: ci",
+        warnings: [],
+      },
+    });
+    expect(result.category).toBe("checks-failing");
+    expect(result.waiting).toBe(false);
+  });
+
+  it("classifies pending checks from structured check policy", () => {
+    const result = classifyWorkflowInstallMergeRejection({
+      error: new GitHubApiError(422, "Merge blocked"),
+      checkPolicy: {
+        decision: "block",
+        classification: "checks_unknown",
+        reason: "No GitHub check runs reported for the PR head commit",
+        warnings: [],
+      },
     });
     expect(result.category).toBe("checks-pending");
     expect(result.waiting).toBe(true);
   });
 
+  it("classifies deployment requirement as merge-api-failure", () => {
+    const result = classifyWorkflowInstallMergeRejection({
+      error: new GitHubApiError(
+        422,
+        "Required deployment environment protection rules are not satisfied",
+      ),
+    });
+    expect(result.category).toBe("merge-api-failure");
+    expect(result.message).toContain("deployment");
+  });
+
   it("classifies merge conflict", () => {
     const result = classifyWorkflowInstallMergeRejection({
       error: new GitHubApiError(409, "Head branch was modified"),

package/workspace-snapshot/files/tests/setup/workflow-install-merge-gate.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { shouldAttemptMerge } from "../../src/setup/workflow-install-merge-gate.js";
+
+describe("workflow-install-merge-gate", () => {
+  it("attempts merge when mergeable_state is blocked but mergeable is true", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "blocked",
+        mergeable: true,
+      }),
+    ).toBe(true);
+  });
+
+  it("attempts merge when mergeable_state is clean and mergeable is true", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "clean",
+        mergeable: true,
+      }),
+    ).toBe(true);
+  });
+
+  it("does not attempt merge when mergeable is false", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "clean",
+        mergeable: false,
+      }),
+    ).toBe(false);
+  });
+
+  it("does not attempt merge when mergeable_state is dirty", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "dirty",
+        mergeable: true,
+      }),
+    ).toBe(false);
+  });
+
+  it("does not attempt merge when mergeability is unknown", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "unknown",
+        mergeable: null,
+      }),
+    ).toBe(false);
+  });
+
+  it("does not attempt merge when branch is behind", () => {
+    expect(
+      shouldAttemptMerge({
+        mergeableState: "behind",
+        mergeable: true,
+      }),
+    ).toBe(false);
+  });
+});

package/workspace-snapshot/files/tests/setup/workflow-model-save-queue.test.ts

@@ -0,0 +1,139 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { MockGitHubRemoteSetupProvider } from "../../src/setup/github-remote-provider.js";
+import {
+  enqueueWorkflowModelSave,
+  resetWorkflowModelSaveQueueForTests,
+} from "../../src/setup/workflow-model-save-queue.js";
+import { WorkflowModelSyncError } from "../../src/setup/workflow-model-sync.js";
+import { readWorkflowConfigSnapshot } from "../../src/setup/workflow-config-snapshot.js";
+
+const BASE_CONFIG = {
+  version: 1,
+  orchestratorMarker: "harness-orchestrator-v1",
+  logDirectory: "runs",
+  repos: [
+    {
+      id: "target-app",
+      targetRepo: "https://github.com/owner/example-target-app",
+      baseBranch: "main",
+      productionBranch: "main",
+    },
+  ],
+  allowedTargetRepos: ["https://github.com/owner/example-target-app"],
+  roleModels: {
+    planner: { id: "composer-2.5", params: [{ id: "fast", value: "false" }] },
+    builder: { id: "composer-2.5", params: [{ id: "fast", value: "false" }] },
+  },
+};
+
+describe("enqueueWorkflowModelSave", () => {
+  let tempRoot = "";
+
+  beforeEach(async () => {
+    resetWorkflowModelSaveQueueForTests();
+    tempRoot = await mkdtemp(path.join(tmpdir(), "workflow-model-save-queue-"));
+    await mkdir(path.join(tempRoot, ".harness"), { recursive: true });
+    await writeFile(
+      path.join(tempRoot, ".env.local"),
+      [
+        "LINEAR_API_KEY=linear-test-key",
+        "CURSOR_API_KEY=cursor-test-key",
+        "GITHUB_TOKEN=github-test-token",
+        "GITHUB_DISPATCH_REPOSITORY=owner/harness-repo",
+      ].join("\n"),
+      "utf8",
+    );
+    await writeFile(
+      path.join(tempRoot, ".harness", "config.local.json"),
+      `${JSON.stringify(BASE_CONFIG, null, 2)}\n`,
+      "utf8",
+    );
+  });
+
+  afterEach(async () => {
+    resetWorkflowModelSaveQueueForTests();
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  it("serializes saves and rebases coalesced requests from the same queue", async () => {
+    const provider = new MockGitHubRemoteSetupProvider({
+      harnessDispatchRepo: {
+        resolved: true,
+        repo: "owner/harness-repo",
+        source: "explicit-config",
+      },
+    });
+    const { fingerprint } = await readWorkflowConfigSnapshot(tempRoot);
+
+    const first = enqueueWorkflowModelSave({
+      cwd: tempRoot,
+      provider,
+      request: {
+        role: "planner",
+        modelId: "planner-a",
+        params: [{ id: "fast", value: "false" }],
+        expectedConfigFingerprint: fingerprint,
+      },
+    });
+    const second = enqueueWorkflowModelSave({
+      cwd: tempRoot,
+      provider,
+      request: {
+        role: "planner",
+        modelId: "planner-b",
+        params: [{ id: "fast", value: "false" }],
+        expectedConfigFingerprint: fingerprint,
+      },
+    });
+
+    const [firstOutcome, secondOutcome] = await Promise.all([first, second]);
+    expect(firstOutcome.kind).toBe("superseded");
+    expect(secondOutcome.kind).toBe("committed");
+    expect(secondOutcome.result.modelSelection.id).toBe("planner-b");
+
+    const config = JSON.parse(
+      await readFile(path.join(tempRoot, ".harness", "config.local.json"), "utf8"),
+    ) as { roleModels?: { planner?: { id: string } } };
+    expect(config.roleModels?.planner?.id).toBe("planner-b");
+  });
+
+  it("rejects external concurrent edits instead of blind rebase", async () => {
+    const provider = new MockGitHubRemoteSetupProvider({
+      harnessDispatchRepo: {
+        resolved: true,
+        repo: "owner/harness-repo",
+        source: "explicit-config",
+      },
+    });
+    const { fingerprint } = await readWorkflowConfigSnapshot(tempRoot);
+
+    await writeFile(
+      path.join(tempRoot, ".harness", "config.local.json"),
+      `${JSON.stringify(
+        {
+          ...BASE_CONFIG,
+          logDirectory: "external-edit",
+        },
+        null,
+        2,
+      )}\n`,
+      "utf8",
+    );
+
+    await expect(
+      enqueueWorkflowModelSave({
+        cwd: tempRoot,
+        provider,
+        request: {
+          role: "builder",
+          modelId: "builder-external",
+          params: [{ id: "fast", value: "false" }],
+          expectedConfigFingerprint: fingerprint,
+        },
+      }),
+    ).rejects.toBeInstanceOf(WorkflowModelSyncError);
+  });
+});