@brainervirus/workit-core 1.2.1 → 1.3.1

package/src/core/task-contract.ts

@@ -588,6 +588,8 @@ export const decisionSchema = z
         state: z.enum(["reserved", "consumed", "uncertain"]),
         at: utc,
         actionRef: refSchema,
+        /** Historical identifier only; never interpreted as native authority. */
+        historicalActionId: text.optional(),
       })
       .strict()
       .nullable(),
@@ -809,7 +811,10 @@ export const taskSummarySchema = z
   })
   .strict();
 export type TaskSummary = z.infer<typeof taskSummarySchema>;
-export const taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
+export const taskListItemSchema = taskSummarySchema
+  .omit({ policy: true, requirements: true })
+  .extend({ source: provenanceSchema.pick({ host: true, kind: true }) })
+  .strict();
 export type TaskListItem = z.infer<typeof taskListItemSchema>;
 export const exportBundleSchema = z
   .object({
@@ -844,6 +849,7 @@ const taskOperations = {
   list: operation({
     action: z.literal("list"),
     status: z.enum(["open", "closed", "all"]).optional(),
+    query: z.string().trim().min(1).max(200).optional(),
     limit: z.number().int().min(1).max(50).optional(),
   }),
   inspect: operation({
@@ -1134,8 +1140,61 @@ export const OPERATION_SCHEMA_DEPTH = 1;
 /** Provider nesting limit every advertised Workit schema must stay within. */
 export const OPERATION_SCHEMA_MAX_DEPTH = 10;
 
-export const canonicalFieldsDescription = (fields: string[]): string =>
-  `Canonical object fields: ${fields.join(", ")}. Workit validates the complete nested value.`;
+const schemaShapeDescription = (value: unknown, depth = 0): string => {
+  if (!value || typeof value !== "object") return "value";
+  const schema = value as Record<string, unknown>;
+  if (Array.isArray(schema.oneOf) || Array.isArray(schema.anyOf)) {
+    const options = (Array.isArray(schema.oneOf) ? schema.oneOf : schema.anyOf) as unknown[];
+    return `(${options.map((option) => schemaShapeDescription(option, depth)).join("|")})`;
+  }
+  if (schema.const !== undefined) return `=${JSON.stringify(schema.const)}`;
+  if (Array.isArray(schema.enum)) return `[${schema.enum.map(String).join("|")}]`;
+  const type = Array.isArray(schema.type) ? schema.type.join("/") : schema.type;
+  if (type === "array") return `arr<${schemaShapeDescription(schema.items, depth)}>`;
+  if (type === "object" && schema.properties && typeof schema.properties === "object") {
+    if (depth >= 2) return "obj";
+    const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+    const properties = schema.properties as Record<string, unknown>;
+    const fields = Object.entries(properties).map(
+      ([name, child]) =>
+        `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child, depth + 1)}`,
+    );
+    return `obj{${fields.join(",")}}`;
+  }
+  if (typeof type !== "string") return "?";
+  return type
+    .split("/")
+    .map((part) => ({ string: "str", boolean: "bool", number: "num", null: "null" })[part] ?? part)
+    .join("|");
+};
+
+export const canonicalFieldsDescription = (
+  value: string[] | Record<string, unknown> | z.ZodType,
+): string => {
+  if (Array.isArray(value))
+    return `Canonical object fields: ${value.join(", ")}. Workit validates the complete nested value.`;
+  const isZodType = (schema: Record<string, unknown> | z.ZodType): schema is z.ZodType =>
+    "_zod" in schema && typeof schema._zod === "object";
+  const schema = isZodType(value)
+    ? (z.toJSONSchema(value, { target: "draft-2020-12" }) as Record<string, unknown>)
+    : value;
+  if (!schema.properties || typeof schema.properties !== "object") {
+    const variants = Array.isArray(schema.oneOf)
+      ? schema.oneOf
+      : Array.isArray(schema.anyOf)
+        ? schema.anyOf
+        : null;
+    return variants
+      ? `Canonical shapes: ${variants.map((variant) => schemaShapeDescription(variant)).join(" | ")}. Full nested value is validated.`
+      : "Canonical nested value; Workit validates the complete value.";
+  }
+  const properties = schema.properties as Record<string, unknown>;
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const fields = Object.entries(properties).map(
+    ([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child)}`,
+  );
+  return `Fields (! required): ${fields.join(", ")}. Full nested value is validated.`;
+};
 
 /**
  * Provider-safe projection of an operation JSON schema. Objects deeper than
@@ -1172,11 +1231,12 @@ export function boundedOperationJsonSchema(
     if (typeof node !== "object" || node === null) return node;
     const record = node as Record<string, unknown>;
     if (record.properties && typeof record.properties === "object") {
-      const fields = Object.keys(record.properties as Record<string, unknown>);
+      const properties = record.properties as Record<string, unknown>;
+      const fields = Object.keys(properties);
       if (currentDepth >= maxDepth || fields.length === 0) {
         const description = stringifiedObjects
-          ? `${canonicalFieldsDescription(fields)} A JSON-encoded string is also accepted.`
-          : canonicalFieldsDescription(fields);
+          ? `${canonicalFieldsDescription(record)} A JSON-encoded string is also accepted.`
+          : canonicalFieldsDescription(record);
         return tolerate({ type: "object", description });
       }
       return tolerate({

package/src/core/task-engine.ts

@@ -512,6 +512,21 @@ const portableTask = (task: TaskRecord): TaskRecord => {
   };
   for (const entry of clone.assessments)
     demote(entry.data.facts, entry.data.signals, entry.data.consequences);
+  const sourceDecisions = new Map(task.decisions.map((entry) => [entry.id, entry]));
+  for (const entry of clone.decisions) {
+    const consumption = sourceDecisions.get(entry.id)?.data.consumption;
+    if (!consumption) continue;
+    entry.data.consumption = {
+      ...consumption,
+      state: consumption.state === "reserved" ? "uncertain" : consumption.state,
+      actionRef: { kind: "record", collection: "decisions", id: entry.id },
+      ...(consumption.historicalActionId
+        ? { historicalActionId: consumption.historicalActionId }
+        : consumption.actionRef.kind === "host"
+          ? { historicalActionId: consumption.actionRef.handle }
+          : {}),
+    };
+  }
   // Candidate metadata can contain environment-derived paths and digests. The destination
   // must recapture its own candidate instead of receiving source checkout material.
   clone.candidates = [];
@@ -649,7 +664,13 @@ const importedTask = (
             taskId: "",
             workspaceId: destinationWorkspaceId,
           },
-          consumption: null,
+          consumption: data.consumption
+            ? {
+                ...data.consumption,
+                state: data.consumption.state === "reserved" ? "uncertain" : data.consumption.state,
+                actionRef: { kind: "record", collection: "decisions", id: entry.id },
+              }
+            : null,
         },
       };
     }),
@@ -873,7 +894,7 @@ export class WorkitCore {
     if (!parsed.ok) return parsed as Result<never>;
     const input = parsed.data as any;
     if ((this.context.workerId ?? null) !== null) {
-      if (input.action !== "inspect")
+      if (input.action !== "inspect" && input.action !== "list")
         return failure("permission_denied", "helpers cannot control task lifecycle or scope");
     }
     switch (input.action) {
@@ -897,6 +918,7 @@ export class WorkitCore {
         if (!listed.ok) return listed as Result<never>;
         const status = input.status ?? "open";
         const limit = input.limit ?? 20;
+        const query = input.query?.toLowerCase().split(/\s+/);
         const selected = listed.data
           .filter((task) =>
             status === "all"
@@ -905,6 +927,25 @@ export class WorkitCore {
                 ? task.status === "closed"
                 : task.status !== "closed",
           )
+          .filter(
+            (task) =>
+              !query ||
+              query.every((term: string) =>
+                JSON.stringify({
+                  id: task.id,
+                  workspaceId: task.workspaceId,
+                  origin: task.origin,
+                  createdAt: task.createdAt,
+                  updatedAt: task.updatedAt,
+                  source: task.intent.provenance,
+                  objective: task.intent.data.objective,
+                  progress: task.progress,
+                  decisions: task.decisions.map(({ data }) => data),
+                })
+                  .toLowerCase()
+                  .includes(term),
+              ),
+          )
           .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
           .slice(0, limit);
         if (selected.length === 0) return success(null, null, []);
@@ -923,6 +964,10 @@ export class WorkitCore {
           closure: task.closure,
           progress: task.progress,
           writer: task.status === "closed" ? null : workspace.data!.writer,
+          source: {
+            host: task.intent.provenance.host,
+            kind: task.intent.provenance.kind,
+          },
         }));
         return success(null, null, tasks);
       }

package/src/core/task-store.ts

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "node:fs";
 import { hostname } from "node:os";
 import path from "node:path";
@@ -76,6 +77,7 @@ export type MetadataLock = {
   processStart: string | null;
   host: string;
   nonce: string;
+  externalAction?: true;
 };
 export type ProcessEvidence = {
   state: "stopped" | "accounted_for";
@@ -100,6 +102,7 @@ const metadataLockSchema = z
     processStart: z.string().nullable(),
     host: z.string().min(1),
     nonce: z.string().min(1),
+    externalAction: z.literal(true).optional(),
   })
   .strict();
 export type RecoveryCandidate = {
@@ -170,7 +173,35 @@ const sameMetadataLock = (left: unknown, right: MetadataLock): boolean => {
   const parsed = metadataLockSchema.safeParse(left);
   return parsed.success && canonicalJson(parsed.data) === canonicalJson(right);
 };
+export const sameDirectoryIdentity = (left: string, right: string): boolean => {
+  if (!path.isAbsolute(left) || !path.isAbsolute(right)) return false;
+  const normalizedLeft = path.resolve(left);
+  const normalizedRight = path.resolve(right);
+  try {
+    const a = fs.statSync(normalizedLeft, { bigint: true });
+    const b = fs.statSync(normalizedRight, { bigint: true });
+    if (!a.isDirectory() || !b.isDirectory()) return false;
+    if (
+      process.platform === "win32"
+        ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+        : normalizedLeft === normalizedRight
+    )
+      return true;
+    const canonicalLeft = fs.realpathSync(normalizedLeft);
+    const canonicalRight = fs.realpathSync(normalizedRight);
+    if (
+      process.platform === "win32"
+        ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase()
+        : canonicalLeft === canonicalRight
+    )
+      return true;
+    return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
+  } catch {
+    return false;
+  }
+};
 type LockSnapshot = { raw: string; data: MetadataLock };
+const externalActionLockRoots = new AsyncLocalStorage<ReadonlySet<string>>();
 
 export class TaskStore {
   readonly root: string;
@@ -230,7 +261,11 @@ export class TaskStore {
   readWorkspace(): Result<WorkspaceRecord | null> {
     const item = this.readRecord<WorkspaceRecord>(this.workspacePath, workspaceRecordSchema);
     if (!item.exists) return success(null, null, null);
-    if (item.result.ok && item.result.data.root !== this.root)
+    if (
+      item.result.ok &&
+      item.result.data.root !== this.root &&
+      !sameDirectoryIdentity(item.result.data.root, this.root)
+    )
       return failure("recovery_required", "workspace root binding is invalid", {
         path: this.workspacePath,
       });
@@ -355,6 +390,37 @@ export class TaskStore {
     return this.withLock<TaskRecord>(() => {
       const current = this.readWorkspace();
       if (!current.ok) return current;
+      const origin = input.task.origin;
+      if (current.data && origin) {
+        if (origin.workspaceId === current.data.id) {
+          const source = this.readTask(origin.taskId);
+          if (source.ok) return success(source.data.revision, current.data.revision, source.data);
+          if (source.code !== "not_found") return source as Result<never>;
+          return failure("not_found", "source task is not present in this shared workspace");
+        }
+        const tasks = this.listTasks();
+        if (!tasks.ok) return tasks as Result<never>;
+        const prior = tasks.data.filter(
+          (task) =>
+            task.origin?.workspaceId === origin.workspaceId &&
+            task.origin?.taskId === origin.taskId,
+        );
+        if (prior.length > 1)
+          return failure(
+            "recovery_required",
+            `source task has multiple imported mappings: ${prior.map((task) => task.id).join(", ")}`,
+          );
+        if (prior.length === 1) {
+          const existing = prior[0]!;
+          if (existing.origin!.exportDigest !== origin.exportDigest)
+            return failure(
+              "revision_conflict",
+              "source task export changed; reconcile the mapped destination task before importing",
+              { taskId: existing.id },
+            );
+          return success(existing.revision, current.data.revision, existing);
+        }
+      }
       if (
         current.data
           ? input.expectedWorkspaceRevision !== current.data.revision
@@ -822,6 +888,90 @@ export class TaskStore {
     };
   }
 
+  private externalActionLockOptions(): FileLockSyncAcquireOptions<MetadataLock> {
+    const options = this.metadataLockOptions();
+    return { ...options, payload: () => ({ ...options.payload(), externalAction: true }) };
+  }
+
+  /** Hold the workspace metadata lock across a managed effect in this checkout. */
+  async withExternalActionLock<T>(
+    operation: () => Promise<Result<T>>,
+    reentrant = false,
+  ): Promise<Result<T>> {
+    const activeRoots = externalActionLockRoots.getStore();
+    if (
+      activeRoots &&
+      [...activeRoots].some((root) => root === this.root || sameDirectoryIdentity(root, this.root))
+    )
+      return operation();
+    try {
+      this.initializeMutationStorage();
+    } catch (error) {
+      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
+        path: this.workitDir,
+      });
+    }
+    let handle: FileLockSyncHandle;
+    try {
+      handle = acquireFileLockSync(this.workspacePath, this.externalActionLockOptions());
+    } catch (error) {
+      return this.lockFailure(error);
+    }
+    let result: Result<T>;
+    try {
+      if (!handle.verifyStillHeld())
+        result = failure("recovery_required", "metadata lock was compromised", {
+          path: this.lockPath,
+        });
+      else {
+        try {
+          const run = () => operation();
+          result = await (reentrant
+            ? externalActionLockRoots.run(new Set([...(activeRoots ?? []), this.root]), run)
+            : run());
+        } catch {
+          result = failure("external_outcome_unknown", "external action outcome is unknown", {
+            outcome: "unknown",
+          });
+        }
+        try {
+          if (!handle.verifyStillHeld())
+            result = failure("external_outcome_unknown", "metadata lock was compromised", {
+              outcome: "unknown",
+              path: this.lockPath,
+            });
+        } catch {
+          result = failure("external_outcome_unknown", "metadata lock could not be verified", {
+            outcome: "unknown",
+            path: this.lockPath,
+          });
+        }
+      }
+    } catch {
+      result = failure("external_outcome_unknown", "external action lock operation failed", {
+        outcome: "unknown",
+        path: this.lockPath,
+      });
+    }
+    try {
+      handle.release();
+    } catch (error) {
+      const released = this.lockFailure(error);
+      const releaseError = released.ok ? "metadata lock release failed" : released.error;
+      return result.ok
+        ? failure(
+            "external_outcome_unknown",
+            "external action metadata lock release is uncertain",
+            {
+              outcome: "unknown",
+              path: this.lockPath,
+            },
+          )
+        : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
+    }
+    return result;
+  }
+
   private recoveryLockOptions(
     observed: LockSnapshot | null,
     evidence: ProcessEvidence,
@@ -912,6 +1062,14 @@ export class TaskStore {
   private lockFailure(error: unknown): Result<never> {
     const value = error as { code?: unknown; message?: unknown };
     const code = typeof value?.code === "string" ? value.code : "";
+    if (code === "EEXIST" || code === "file_lock_timeout") {
+      const lock = this.readLockSnapshot();
+      if (lock.ok && lock.data?.data.externalAction)
+        return failure("writer_conflict", "workspace is reserved by a managed external action", {
+          outcome: "not_started",
+          path: this.lockPath,
+        });
+    }
     const recovery =
       code === "EEXIST" ||
       code === "file_lock_timeout" ||

package/src/core/tracker-issues.ts

@@ -1,12 +1,9 @@
-import fs from "node:fs";
 import { spawnSync } from "node:child_process";
-import { vcsConfig } from "./vcs-config";
-import { hostingCliAvailable, parseGhIssue } from "./pr-create";
+import { hostingCliAvailable, parseGhIssue, pushRemote } from "./pr-create";
+import { hostingApiHostMatches, vcsConfig } from "./vcs-config";
 
 // Read-only issue fetches for context.read (GitHub + GitLab), mirroring the
-// YouTrack triple shape. CLI-first: the native gh/glab CLI serves the read
-// when installed (per-directory identity comes free); token files are the
-// fallback and fail closed without one. No writes, no new secret files.
+// YouTrack triple shape. Authenticated gh/glab serves the read in the target checkout.
 
 export type TrackerIssueBody = {
   id: string;
@@ -20,22 +17,6 @@ export type TrackerIssueFailure = {
   kind: "creds" | "request" | "input";
 };
 
-export type TrackerRequest = (
-  url: string,
-  init: { method: string; headers: Record<string, string> },
-) => Promise<{ status: number; stdout: string; stderr: string }>;
-
-export const trackerRequest: TrackerRequest = async (url, init) => {
-  try {
-    const res = await fetch(url, { method: init.method, headers: init.headers });
-    const text = await res.text();
-    if (!res.ok) return { status: res.status, stdout: "", stderr: text.slice(0, 200) };
-    return { status: 0, stdout: text, stderr: "" };
-  } catch (err) {
-    return { status: 1, stdout: "", stderr: err instanceof Error ? err.message : "network error" };
-  }
-};
-
 /** Full repo path from an origin URL (scp-style, https, or bare); subgroups kept. */
 export const repoPathFromRemote = (remote: string): string | null => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
@@ -57,17 +38,20 @@ export type TrackerCli = (
 ) => Promise<{ status: number; stdout: string; stderr: string }> | null;
 
 export type TrackerDeps = {
-  creds?: (root: string) => TrackerCreds;
-  request?: TrackerRequest;
   remote?: (root: string) => string | null;
   cli?: TrackerCli;
+  host?: string;
 };
 
 /** Native CLI runner (gh/glab) when installed; null when absent. */
 const defaultCli = (bin: string, available: boolean): TrackerCli | null => {
   if (!available) return null;
   return (args, root) => {
-    const out = spawnSync(bin, args, { cwd: root, encoding: "utf8" });
+    const out = spawnSync(bin, args, {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, PATH: process.env.PATH ?? "" },
+    });
     return Promise.resolve({
       status: out.status ?? 1,
       stdout: out.stdout ?? "",
@@ -78,55 +62,34 @@ const defaultCli = (bin: string, available: boolean): TrackerCli | null => {
 
 const tryCliTriple = async (
   cli: TrackerCli | null | undefined,
+  name: string,
   args: string[],
   root: string,
   id: string,
   idKeys: string[],
   bodyKeys: string[],
-): Promise<TrackerIssueBody | null> => {
-  if (!cli) return null;
+): Promise<{ data: TrackerIssueBody } | TrackerIssueFailure> => {
+  if (!cli) return { error: `${name} CLI is unavailable`, kind: "creds" };
   const run = cli(args, root);
-  if (!run) return null;
+  if (!run) return { error: `${name} CLI is unavailable`, kind: "creds" };
   const out = await run;
-  if (out.status !== 0) return null;
+  if (out.status !== 0)
+    return { error: `${name} CLI is not authenticated or the issue is unavailable`, kind: "creds" };
   try {
-    return parseTriple(JSON.parse(out.stdout) as Record<string, unknown>, id, idKeys, bodyKeys);
+    const triple = parseTriple(
+      JSON.parse(out.stdout) as Record<string, unknown>,
+      id,
+      idKeys,
+      bodyKeys,
+    );
+    return triple
+      ? { data: triple }
+      : { error: `unexpected ${name} issue response`, kind: "request" };
   } catch {
-    return null;
+    return { error: `invalid ${name} issue response`, kind: "request" };
   }
 };
 
-const originRemote = (root: string): string | null => {
-  const out = spawnSync("git", ["remote", "get-url", "origin"], { cwd: root, encoding: "utf8" });
-  return out.status === 0 ? (out.stdout ?? "").trim() || null : null;
-};
-
-type TrackerCreds = { token: string; api: string } | { error: string };
-
-const trackerCreds = (root: string, provider: "github" | "gitlab"): TrackerCreds => {
-  const cfg = vcsConfig("load", root) as Record<string, unknown>;
-  if (!cfg || cfg.provider !== provider || typeof cfg.tokenPath !== "string" || !cfg.tokenPath)
-    return { error: `unconfigured ${provider} provider` };
-  let token = "";
-  try {
-    token = fs.readFileSync(cfg.tokenPath, "utf8").trim();
-  } catch {
-    return { error: `missing ${provider} token` };
-  }
-  if (!token) return { error: `empty ${provider} token file` };
-  if (provider === "gitlab") {
-    const gitlab = cfg.gitlab as Record<string, unknown> | undefined;
-    const apiUrl = String(gitlab?.apiUrl ?? "https://gitlab.com/api/v4").replace(/\/+$/, "");
-    return { token, api: apiUrl };
-  }
-  const github = cfg.github as Record<string, unknown> | undefined;
-  const host = String(github?.host ?? "github.com").toLowerCase();
-  return {
-    token,
-    api: host === "github.com" ? "https://api.github.com" : `https://${host}/api/v3`,
-  };
-};
-
 const parseTriple = (
   parsed: Record<string, unknown>,
   id: string,
@@ -148,7 +111,7 @@ const parseTriple = (
   return { id: foundId, title, body: pick(bodyKeys), state };
 };
 
-/** Fetch a GitHub issue triple for context.read: gh CLI first, token fallback (fail-closed). */
+/** Fetch a GitHub issue triple for context.read through the authenticated CLI. */
 export const fetchGitHubIssueBody = async (
   ref: string,
   root: string,
@@ -156,46 +119,30 @@ export const fetchGitHubIssueBody = async (
 ): Promise<{ data: TrackerIssueBody } | TrackerIssueFailure> => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id)) return { error: `invalid GitHub issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo) return { error: "no origin remote to resolve the repository", kind: "input" };
-  const viaCli = await tryCliTriple(
+  const cfg = vcsConfig("load", root);
+  const host = (
+    deps.host ??
+    (cfg.ok && cfg.provider === "github" ? cfg.github?.host : null) ??
+    "github.com"
+  ).toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "github.com" ? repo : `${host}/${repo}`;
+  return tryCliTriple(
     deps.cli ?? defaultCli("gh", hostingCliAvailable("github")),
-    ["issue", "view", id, "--repo", repo, "--json", "number,title,body,state"],
+    "gh",
+    ["issue", "view", id, "--repo", repoArg, "--json", "number,title,body,state"],
     root,
     id,
     ["number"],
     ["body"],
   );
-  if (viaCli) return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "github")))(root);
-  if ("error" in credentials) return { ...credentials, kind: "creds" as const };
-  const out = await (deps.request ?? trackerRequest)(
-    `${credentials.api}/repos/${repo}/issues/${id}`,
-    {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${credentials.token}`,
-        Accept: "application/vnd.github+json",
-      },
-    },
-  );
-  if (out.status !== 0)
-    return { error: out.stderr || "GitHub issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(
-      JSON.parse(out.stdout) as Record<string, unknown>,
-      id,
-      ["number"],
-      ["body"],
-    );
-    if (!triple) return { error: "unexpected GitHub issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitHub issue response", kind: "request" };
-  }
 };
 
-/** Fetch a GitLab issue triple for context.read: glab CLI first, token fallback (fail-closed). */
+/** Fetch a GitLab issue triple for context.read through the authenticated CLI. */
 export const fetchGitLabIssueBody = async (
   ref: string,
   root: string,
@@ -203,35 +150,25 @@ export const fetchGitLabIssueBody = async (
 ): Promise<{ data: TrackerIssueBody } | TrackerIssueFailure> => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id)) return { error: `invalid GitLab issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo) return { error: "no origin remote to resolve the project", kind: "input" };
-  const viaCli = await tryCliTriple(
+  const cfg = vcsConfig("load", root);
+  const host = (
+    deps.host ??
+    (cfg.ok && cfg.provider === "gitlab" ? cfg.gitlab?.host : null) ??
+    "gitlab.com"
+  ).toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "gitlab.com" ? repo : `https://${host}/${repo}`;
+  return tryCliTriple(
     deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")),
-    ["issue", "view", id, "-R", repo, "-F", "json"],
+    "glab",
+    ["issue", "view", id, "-R", repoArg, "-F", "json"],
     root,
     id,
     ["iid"],
     ["description"],
   );
-  if (viaCli) return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "gitlab")))(root);
-  if ("error" in credentials) return { ...credentials, kind: "creds" as const };
-  const out = await (deps.request ?? trackerRequest)(
-    `${credentials.api}/projects/${encodeURIComponent(repo)}/issues/${id}`,
-    { method: "GET", headers: { "PRIVATE-TOKEN": credentials.token } },
-  );
-  if (out.status !== 0)
-    return { error: out.stderr || "GitLab issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(
-      JSON.parse(out.stdout) as Record<string, unknown>,
-      id,
-      ["iid"],
-      ["description"],
-    );
-    if (!triple) return { error: "unexpected GitLab issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitLab issue response", kind: "request" };
-  }
 };