@brainervirus/workit-core 2.2.2 → 2.4.0

package/src/forge/gitlab.ts

@@ -0,0 +1,455 @@
+// GitLab adapter: `glab api` REST only (design §2.0 GitLab endpoints): the MR
+// (`detailed_merge_status`, `has_conflicts`, `head_pipeline`), pipeline jobs,
+// job traces, discussions, and pipeline/job retry.
+import { apiJson, apiText, FORGE_TIMEOUTS, type ForgeRunner } from "./exec";
+import { logTail, redactText, shortBody } from "./redact";
+import {
+  failure,
+  success,
+  type Forge,
+  type ForgeCheck,
+  type ForgePrStatus,
+  type ForgeResult,
+  type ForgeThread,
+  type PrState,
+} from "./types";
+
+/** Page cap for jobs and discussions (100 per page). */
+export const GITLAB_MAX_PAGES = 10;
+const PER_PAGE = 100;
+
+type GlUser = { username?: string; bot?: boolean } | null;
+
+type GlMr = {
+  iid: number;
+  web_url: string;
+  state: string;
+  draft?: boolean;
+  work_in_progress?: boolean;
+  detailed_merge_status?: string;
+  has_conflicts?: boolean;
+  target_branch: string;
+  source_branch: string;
+  sha: string;
+  diff_refs?: { base_sha?: string | null } | null;
+  source_project_id?: number;
+  head_pipeline?: {
+    id: number;
+    sha: string;
+    /** Merged-results / merge-train pipelines run on a merge ref; this is the MR head. */
+    source_sha?: string | null;
+    /** `refs/merge-requests/<iid>/merge` (merged results) or `/train` (merge train). */
+    ref?: string;
+    project_id: number;
+    status: string;
+    web_url?: string;
+  } | null;
+};
+
+type GlBridge = {
+  id: number;
+  name: string;
+  stage: string;
+  status: string;
+  allow_failure?: boolean;
+  web_url?: string;
+  downstream_pipeline?: {
+    id: number;
+    status: string;
+    project_id?: number;
+    web_url?: string;
+  } | null;
+};
+
+type GlJob = {
+  id: number;
+  name: string;
+  stage: string;
+  status: string;
+  allow_failure?: boolean;
+  web_url?: string;
+};
+
+type GlNote = {
+  id: number;
+  body: string;
+  author: GlUser;
+  system?: boolean;
+  resolvable?: boolean;
+  resolved?: boolean;
+  position?: {
+    new_path?: string | null;
+    new_line?: number | null;
+    old_path?: string | null;
+  } | null;
+};
+
+type GlDiscussion = { id: string; notes: GlNote[] };
+
+const mrState = (value: string): PrState =>
+  value === "merged" ? "merged" : value === "opened" ? "open" : "closed";
+
+const PENDING = new Set([
+  "created",
+  "pending",
+  "running",
+  "waiting_for_resource",
+  "waiting_for_callback",
+  "preparing",
+  "scheduled",
+]);
+
+const stateOf = (status: string, allowFailure: boolean): ForgeCheck["state"] => {
+  const failed = status === "failed" || status === "canceled";
+  return PENDING.has(status)
+    ? "pending"
+    : failed
+      ? allowFailure
+        ? "passing"
+        : "failing"
+      : status === "success"
+        ? "passing"
+        : "skipped";
+};
+
+/** A trigger/bridge job: its state is the downstream pipeline's. */
+export function checkFromBridge(bridge: GlBridge, pipelineId: number, scope: string): ForgeCheck {
+  const status = bridge.downstream_pipeline?.status ?? bridge.status;
+  const allow = bridge.allow_failure === true;
+  const failed = status === "failed" || status === "canceled";
+  return {
+    name: `${bridge.stage} / ${bridge.name}`,
+    context: bridge.name,
+    state: stateOf(status, allow),
+    conclusion: failed && allow ? "allowed_failure" : `downstream_${status}`,
+    url: safeUrl(bridge.downstream_pipeline?.web_url ?? bridge.web_url ?? null),
+    runId: pipelineId,
+    // Not a log-bearing job; rerun it on the downstream pipeline.
+    jobId: null,
+    scope,
+    required: !allow,
+  };
+}
+
+export function checkFromJob(job: GlJob, pipelineId: number, scope: string): ForgeCheck {
+  const failed = job.status === "failed" || job.status === "canceled";
+  return {
+    name: `${job.stage} / ${job.name}`,
+    context: job.name,
+    state: stateOf(job.status, job.allow_failure === true),
+    conclusion: failed && job.allow_failure ? "allowed_failure" : job.status,
+    url: safeUrl(job.web_url ?? null),
+    runId: pipelineId,
+    jobId: job.id,
+    scope,
+    // Every job that may not fail gates the pipeline, which gates the MR.
+    required: job.allow_failure !== true,
+  };
+}
+
+/** A pipeline-level check when no job explains the pipeline's state. */
+const pipelineCheck = (
+  state: ForgeCheck["state"],
+  conclusion: string,
+  pipeline: { id: number; project_id: number; web_url?: string } | null,
+): ForgeCheck => ({
+  name: "pipeline",
+  context: "pipeline",
+  state,
+  conclusion,
+  url: safeUrl(pipeline?.web_url ?? null),
+  runId: pipeline?.id ?? null,
+  jobId: null,
+  scope: pipeline ? String(pipeline.project_id) : null,
+  required: true,
+});
+
+const safeUrl = (value: string | null): string | null => (value ? redactText(value) : null);
+
+const isBot = (author: GlUser): boolean =>
+  author?.bot === true || /(?:^project_\d+_bot|bot$|\[bot\]$)/iu.test(author?.username ?? "");
+
+// Statuses where GitLab has not finished computing mergeability.
+const UNSETTLED = new Set(["checking", "unchecked", "preparing", "approvals_syncing"]);
+
+export function createGitLabForge(options: {
+  apiHost: string;
+  repo: string;
+  runner: ForgeRunner;
+  maxPages?: number;
+}): Forge {
+  const { apiHost, repo, runner } = options;
+  const maxPages = options.maxPages ?? GITLAB_MAX_PAGES;
+  const project = `projects/${encodeURIComponent(repo)}`;
+
+  const api = (endpoint: string): string[] => ["api", endpoint];
+
+  /** Every page of a list endpoint, up to the cap. */
+  const pages = (
+    endpoint: string,
+    what: string,
+  ): ForgeResult<{ items: unknown[]; truncated: boolean }> => {
+    const items: unknown[] = [];
+    const sep = endpoint.includes("?") ? "&" : "?";
+    for (let page = 1; page <= maxPages; page += 1) {
+      const chunk = apiJson<unknown>(
+        runner,
+        "glab",
+        apiHost,
+        api(`${endpoint}${sep}per_page=${PER_PAGE}&page=${page}`),
+        what,
+      );
+      if (!chunk.ok) return chunk;
+      if (!Array.isArray(chunk.data)) return failure("failed", `${what}: expected a list`);
+      items.push(...chunk.data);
+      if (chunk.data.length < PER_PAGE) return success({ items, truncated: false });
+    }
+    return success({ items, truncated: true });
+  };
+
+  /** True when merge commit `sha` (in project `scope`) has `head` as a parent. */
+  const mergeCommitTests = (scope: number, sha: string, head: string): boolean => {
+    const commit = apiJson<{ parent_ids?: string[] }>(
+      runner,
+      "glab",
+      apiHost,
+      api(`projects/${scope}/repository/commits/${sha}`),
+      `commit ${sha.slice(0, 12)}`,
+    );
+    return (
+      commit.ok && Array.isArray(commit.data.parent_ids) && commit.data.parent_ids.includes(head)
+    );
+  };
+
+  /** The current tip of the target branch (diff_refs.base_sha is the merge base). */
+  const baseTip = (branch: string): string | null => {
+    const tip = apiJson<{ commit?: { id?: string } }>(
+      runner,
+      "glab",
+      apiHost,
+      api(`${project}/repository/branches/${encodeURIComponent(branch)}`),
+      `branch ${branch}`,
+    );
+    return tip.ok && typeof tip.data.commit?.id === "string" ? tip.data.commit.id : null;
+  };
+
+  return {
+    kind: "gitlab",
+    apiHost,
+    repo,
+
+    identity(expected) {
+      const user = apiJson<{ username?: unknown }>(runner, "glab", apiHost, api("user"), "user");
+      // CI job tokens cannot read /user; reads still work, so skip the check.
+      if (!user.ok && user.code === "failed" && /\b403\b|forbidden/iu.test(user.error))
+        return success({
+          login: null,
+          expected,
+          matches: null,
+          note: "the credential cannot read /user (job or project token); identity not checked",
+        });
+      if (!user.ok) return user;
+      const login = typeof user.data.username === "string" ? user.data.username : "";
+      if (!login) return failure("failed", "glab api user returned no username");
+      return success({
+        login,
+        expected,
+        matches: expected ? login.toLowerCase() === expected.toLowerCase() : null,
+      });
+    },
+
+    repoInfo(target) {
+      const info = apiJson<{ id?: number; forked_from_project?: { path_with_namespace?: string } }>(
+        runner,
+        "glab",
+        apiHost,
+        api(`projects/${encodeURIComponent(target)}`),
+        `project ${target}`,
+      );
+      if (!info.ok) return info;
+      return success({
+        id: typeof info.data.id === "number" ? info.data.id : null,
+        parent: info.data.forked_from_project?.path_with_namespace ?? null,
+      });
+    },
+
+    findPr(head, match) {
+      const list = apiJson<GlMr[]>(
+        runner,
+        "glab",
+        apiHost,
+        api(
+          `${project}/merge_requests?source_branch=${encodeURIComponent(head)}&order_by=created_at&sort=desc&per_page=20`,
+        ),
+        `merge requests for ${head}`,
+      );
+      if (!list.ok) return list;
+      if (!Array.isArray(list.data)) return failure("failed", "merge request list is not a list");
+      // Same-named branches in other forks are not ours: match the source
+      // project or the exact head sha.
+      const matches = list.data.filter(
+        (mr) =>
+          mr.source_branch === head &&
+          ((match.projectId !== null && mr.source_project_id === match.projectId) ||
+            (match.sha !== null && mr.sha === match.sha)),
+      );
+      const pick = matches.find((mr) => mr.state === "opened") ?? matches[0];
+      return success(
+        pick
+          ? {
+              number: pick.iid,
+              url: pick.web_url,
+              state: mrState(pick.state),
+              headBranch: pick.source_branch,
+              headSha: pick.sha ?? null,
+            }
+          : null,
+      );
+    },
+
+    prStatus(iid) {
+      const mr = apiJson<GlMr>(
+        runner,
+        "glab",
+        apiHost,
+        api(`${project}/merge_requests/${iid}`),
+        `merge request !${iid}`,
+      );
+      if (!mr.ok) return mr;
+      const value = mr.data;
+      let truncated = false;
+      let checks: ForgeCheck[] = [];
+      const pipeline = value.head_pipeline ?? null;
+      const open = value.state === "opened";
+      // Merged-results and merge-train pipelines run on a merge ref whose sha
+      // is a merge commit, not the MR head. They test the current head when
+      // source_sha says so or, when the response has no source_sha, when the
+      // merge commit's parents include the head (GET …/repository/commits/:sha).
+      const current =
+        pipeline !== null &&
+        (pipeline.sha === value.sha ||
+          pipeline.source_sha === value.sha ||
+          (!pipeline.source_sha &&
+            new RegExp(`^refs/merge-requests/${value.iid}/(?:merge|train)$`, "u").test(
+              pipeline.ref ?? "",
+            ) &&
+            mergeCommitTests(pipeline.project_id, pipeline.sha, value.sha)));
+      if (pipeline && current) {
+        const scope = String(pipeline.project_id);
+        const jobs = pages(
+          `projects/${scope}/pipelines/${pipeline.id}/jobs`,
+          `pipeline ${pipeline.id} jobs`,
+        );
+        if (!jobs.ok) return jobs;
+        const bridges = pages(
+          `projects/${scope}/pipelines/${pipeline.id}/bridges`,
+          `pipeline ${pipeline.id} bridges`,
+        );
+        if (!bridges.ok) return bridges;
+        truncated ||= jobs.data.truncated || bridges.data.truncated;
+        checks = [
+          ...(jobs.data.items as GlJob[]).map((job) => checkFromJob(job, pipeline.id, scope)),
+          ...(bridges.data.items as GlBridge[]).map((bridge) =>
+            checkFromBridge(bridge, pipeline.id, scope),
+          ),
+        ];
+        // The pipeline status is a floor: a failed pipeline is never green,
+        // and a running one is never done, whatever the visible jobs say.
+        const pipelineState = stateOf(pipeline.status, false);
+        if (pipelineState === "failing" && !checks.some((check) => check.state === "failing"))
+          checks.push(pipelineCheck("failing", pipeline.status, pipeline));
+        if (pipelineState === "pending" && !checks.some((check) => check.state === "pending"))
+          checks.push(pipelineCheck("pending", pipeline.status, pipeline));
+      } else if (open && pipeline) {
+        // The head pipeline belongs to an older head: CI for this head has
+        // not reported yet. Pending, never "no checks".
+        checks = [pipelineCheck("pending", "awaiting_pipeline_for_head", null)];
+      }
+      const discussions = pages(
+        `${project}/merge_requests/${iid}/discussions`,
+        `merge request !${iid} discussions`,
+      );
+      if (!discussions.ok) return discussions;
+      truncated ||= discussions.data.truncated;
+      const threads: ForgeThread[] = (discussions.data.items as GlDiscussion[])
+        .filter((discussion) =>
+          discussion.notes.some((note) => note.resolvable === true && note.resolved !== true),
+        )
+        .map((discussion) => {
+          const note = discussion.notes[0];
+          return {
+            id: discussion.id,
+            path: note.position?.new_path ?? note.position?.old_path ?? null,
+            line: note.position?.new_line ?? null,
+            author: note.author?.username ?? null,
+            isBot: isBot(note.author),
+            outdated: false,
+            url: safeUrl(`${value.web_url}#note_${note.id}`),
+            body: shortBody(note.body ?? ""),
+          };
+        });
+      const detailed = value.detailed_merge_status ?? "unchecked";
+      const conflicts = value.has_conflicts === true || detailed === "conflict";
+      const status: ForgePrStatus = {
+        number: value.iid,
+        url: value.web_url,
+        state: mrState(value.state),
+        draft: value.draft ?? value.work_in_progress ?? false,
+        base: value.target_branch,
+        baseSha: open ? baseTip(value.target_branch) : null,
+        head: { branch: value.source_branch, sha: value.sha },
+        mergeable: conflicts ? "no" : UNSETTLED.has(detailed) ? "unknown" : "yes",
+        conflicts,
+        rebaseRequired: detailed === "need_rebase",
+        reviewDecision:
+          detailed === "not_approved"
+            ? "review_required"
+            : detailed === "requested_changes"
+              ? "changes_requested"
+              : null,
+        mergeState: detailed,
+        inMergeQueue: false,
+        checks,
+        // GitLab gates on the whole pipeline (jobs that may not fail).
+        requiredContexts: [],
+        threads,
+        truncated,
+      };
+      return success(status);
+    },
+
+    jobLogTail(job, lines) {
+      const scope = job.scope ?? encodeURIComponent(repo);
+      const text = apiText(
+        runner,
+        "glab",
+        apiHost,
+        ["api", `projects/${scope}/jobs/${job.jobId}/trace`],
+        `job ${job.jobId} trace`,
+        FORGE_TIMEOUTS.log,
+      );
+      return text.ok ? success(logTail(text.data, lines)) : text;
+    },
+
+    rerun(target) {
+      const scope = target.scope ?? encodeURIComponent(repo);
+      const endpoint =
+        target.kind === "failed_in_run"
+          ? `projects/${scope}/pipelines/${target.runId}/retry`
+          : `projects/${scope}/jobs/${target.jobId}/retry`;
+      const what =
+        target.kind === "failed_in_run"
+          ? `retry of pipeline ${target.runId}`
+          : `retry of job ${target.jobId}`;
+      const run = apiText(
+        runner,
+        "glab",
+        apiHost,
+        ["api", "-X", "POST", endpoint],
+        what,
+        FORGE_TIMEOUTS.api,
+      );
+      return run.ok ? success(undefined) : run;
+    },
+  };
+}

package/src/forge/redact.ts

@@ -0,0 +1,191 @@
+// Redaction and bounding for text that comes back from a forge: CI logs,
+// review comments, CLI stderr. All of it is untrusted data that an agent will
+// read, so secrets are masked and the size is capped before it leaves core.
+
+const R = "[REDACTED]";
+
+// Token formats that are secrets wherever they appear.
+const TOKEN_PATTERNS: readonly RegExp[] = [
+  // GitHub tokens (classic, fine-grained, app, OAuth, refresh).
+  /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
+  // GitLab tokens: glpat-, glrt-, gldt-, glcbt-, glptt-, glft-, gloas-, …
+  /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+  /\bnpm_[A-Za-z0-9]{30,}/gu,
+  /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
+  /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}/gu,
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/gu,
+  /\bAIza[0-9A-Za-z_-]{35}/gu,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/gu,
+];
+
+// Slack/Discord webhooks: the path is the credential.
+const WEBHOOK =
+  /\b(https?:\/\/(?:hooks\.slack\.com\/(?:services|workflows|triggers)|discord(?:app)?\.com\/api\/webhooks))\/[^\s"'<>]+/giu;
+
+// Userinfo in any URL (`https://user:pw@`, `postgres://a:b:c@`, `https://tok@`).
+const URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/giu;
+
+// `curl -u user:pass`, `--user user:pass`.
+const CURL_USER = /(\s(?:-u|--user)(?:\s+|=))(["']?)[^\s"':]+:[^\s"']+\2/gu;
+
+// Secret-ish keys in env dumps, YAML, JSON, headers and connection strings:
+// DB_PASSWORD=…, "access_token": "…", X-Api-Key: …, PRIVATE-TOKEN: …,
+// AccountKey=…; an optional auth scheme (Basic/Bearer) is kept.
+const KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+const ASSIGNMENT = new RegExp(
+  String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`,
+  "giu",
+);
+
+const BEARER = /\b(bearer\s+)[A-Za-z0-9._~+/-]{12,}=*/giu;
+
+// A quoted value may contain spaces: password: "correct horse battery".
+const QUOTED_ASSIGNMENT = new RegExp(
+  String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`,
+  "giu",
+);
+
+// ~/.netrc: `machine h login u password p` (also split across lines).
+const NETRC = /\b((?:machine|login)\s+\S+\s+(?:login\s+\S+\s+)?password\s+)\S+/giu;
+
+// Secrets passed as CLI flags: sshpass -p X, mysql -pX / -p X.
+const FLAG_SECRETS: readonly RegExp[] = [
+  /\b(sshpass\s+-p\s*)\S+/gu,
+  /\b(mysql(?:dump|admin|import|show)?\b[^\n]*?\s-p)(?!\s|$)\S+/gu,
+];
+
+// Signed-URL and query-string credentials (Azure SAS `sig=`, `token=`, …).
+const QUERY_SECRET =
+  /([?&;](?:sig|signature|token|access_token|api_key|apikey|key|password|secret|client_secret|X-Amz-Signature|X-Goog-Signature)=)[^&\s#"']+/giu;
+
+// A key block from BEGIN to END, or to the end of the text when truncated.
+const PRIVATE_KEY =
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|$)/gu;
+
+// Long base64 runs: redacted when they decode to a credential, or sit on a
+// line that decodes base64 (`echo … | base64 -d`).
+const BASE64 = /[A-Za-z0-9+/]{32,}={0,2}/gu;
+
+const ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+
+export const stripAnsi = (value: string): string => value.replace(ANSI, "");
+
+const decodesToSecret = (blob: string): boolean => {
+  if (/^[0-9a-f]+$/iu.test(blob)) return false; // hex: commit/tree ids
+  let decoded: string;
+  try {
+    decoded = Buffer.from(blob, "base64").toString("utf8");
+  } catch {
+    return false;
+  }
+  if (!/^[\x20-\x7e\s]+$/u.test(decoded)) return false;
+  return (
+    TOKEN_PATTERNS.some((pattern) => new RegExp(pattern.source, "u").test(decoded)) ||
+    /^[^\s:]{1,64}:[^\s]{6,}$/u.test(decoded.trim())
+  );
+};
+
+/** Mask secrets and strip terminal escapes. Works on whole (multi-line) text. */
+export function redactText(value: string): string {
+  let out = stripAnsi(value).replace(PRIVATE_KEY, "[REDACTED PRIVATE KEY]");
+  out = out.replace(WEBHOOK, `$1/${R}`);
+  out = out.replace(URL_USERINFO, `$1${R}@`);
+  for (const pattern of TOKEN_PATTERNS) out = out.replace(pattern, R);
+  out = out.replace(CURL_USER, `$1$2${R}$2`);
+  out = out.replace(BEARER, `$1${R}`);
+  out = out.replace(QUOTED_ASSIGNMENT, (match, lead: string, quote: string, secret: string) =>
+    secret.startsWith(R) ? match : `${lead}${quote}${R}${quote}`,
+  );
+  out = out.replace(NETRC, `$1${R}`);
+  for (const pattern of FLAG_SECRETS) out = out.replace(pattern, `$1${R}`);
+  out = out.replace(QUERY_SECRET, `$1${R}`);
+  out = out.replace(
+    ASSIGNMENT,
+    (match, lead: string, scheme: string | undefined, secret: string) =>
+      secret.startsWith(R) ? match : `${lead}${scheme ?? ""}${R}`,
+  );
+  return out
+    .split("\n")
+    .map((line) =>
+      line.replace(BASE64, (blob) =>
+        /\bbase64\b/iu.test(line) || decodesToSecret(blob) ? R : blob,
+      ),
+    )
+    .join("\n");
+}
+
+// GitHub Actions prefixes every log line with an ISO timestamp; GitLab traces
+// carry section markers and a leading timestamp/stream tag in newer runners.
+const LINE_NOISE = /^(?:\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\s?)?(?:\d{2}[A-Z]\s)?/u;
+const GITLAB_SECTION = /section_(?:start|end):\d+:[A-Za-z0-9_.-]+(?:\[[^\]]*\])?\r?/gu;
+
+// Where the failure ends: everything after is runner cleanup.
+const FAILURE_END = [/##\[error\]Process completed with exit code/u, /^ERROR: Job failed\b/u];
+
+const MAX_LINE = 400;
+
+// The first line that looks like the actual failure: a strong marker (a
+// test-runner failure, an assertion, a thrown error) wins over a weak one
+// (any "failed"/"ERROR" mention, which passing tests also print).
+const STRONG_ERROR =
+  /^\s*(?:\(fail\)|FAIL\b|✗|✕|×|error(?:\[[A-Z0-9]+\])?:|[A-Za-z]*Error\b:|AssertionError|Traceback|panic:|Exception\b)/u;
+const WEAK_ERROR = /\berror\b[:[]|\bERROR\b|\bFAIL(?:ED)?\b|\bfailed\b|\bassert/u;
+// Passing test lines and summaries mention failure words without failing.
+const NOT_FIRST_ERROR =
+  /^\s*(?:\(pass\)|\(skip\)|\(todo\)|✓|✔|ok\b|PASS\b)|^\s*\d+ fail\b|##\[error\]Process completed|^\s*0 (?:errors?|fail)/u;
+
+/** Lines of context kept before the first error. */
+const LEAD = 3;
+
+/**
+ * A bounded, redacted view of a CI log: at most `lines` lines. Runner
+ * cleanup after the failure marker is dropped. When the first error sits
+ * before the final window, the view is the region around that first error,
+ * a `…` gap, then the end of the log (where the summary and exit code are).
+ */
+export function logTail(text: string, lines: number): string[] {
+  if (lines <= 0) return [];
+  const cleaned = text
+    .replace(GITLAB_SECTION, "")
+    .split(/\r?\n/u)
+    // A bare \r rewrites the line in a terminal (progress bars): keep what
+    // was finally shown.
+    .map(
+      (raw) =>
+        stripAnsi(raw)
+          .split("\r")
+          .findLast((part) => part.trim()) ?? "",
+    )
+    .map((raw) => raw.replace(LINE_NOISE, ""));
+  // Redact the whole text so a secret spanning lines (a private key) goes.
+  const all = redactText(cleaned.join("\n")).split("\n");
+  let end = all.length;
+  for (let index = all.length - 1; index >= 0; index -= 1)
+    if (FAILURE_END.some((pattern) => pattern.test(all[index]))) {
+      end = index + 1;
+      break;
+    }
+  const kept = all.slice(0, end);
+  while (kept.length > 0 && !kept[kept.length - 1].trim()) kept.pop();
+  const cap = (value: string) => (value.length > MAX_LINE ? `${value.slice(0, MAX_LINE)}…` : value);
+  const tailStart = Math.max(0, kept.length - lines);
+  const find = (pattern: RegExp) =>
+    kept.findIndex((value) => pattern.test(value) && !NOT_FIRST_ERROR.test(value));
+  const strong = find(STRONG_ERROR);
+  const first = strong >= 0 ? strong : find(WEAK_ERROR);
+  if (first < 0 || first >= tailStart || lines < 8) return kept.slice(tailStart).map(cap);
+  const headCount = Math.ceil((lines - 1) * (2 / 3));
+  const from = Math.max(0, first - LEAD);
+  const head = kept.slice(from, from + headCount);
+  const tailCount = lines - 1 - head.length;
+  const tailFrom = Math.max(from + head.length, kept.length - tailCount);
+  const tail = kept.slice(tailFrom);
+  return [...head, ...(tailFrom > from + head.length ? ["…"] : []), ...tail].map(cap);
+}
+
+/** One-line, redacted, length-capped text (review comment bodies). */
+export function shortBody(value: string, max = 300): string {
+  const flat = redactText(value).replace(/\s+/gu, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}