@danypops/tickets 0.2.0 → 0.3.0

package/README.md

@@ -157,15 +157,54 @@ tickets auth status
 tickets auth logout github
 ```
 
+### GitHub: reuse an already-authenticated `gh` CLI session
+
+`tickets auth login --backend github --gh-cli [account]` skips the device
+flow (and the `GITHUB_OAUTH_CLIENT_ID` App registration it needs) entirely
+by reading `gh auth token` instead — never re-implement a vendor CLI's own
+auth, just consume its result via its own documented, stable interface.
+Works whether `gh` stores its token in the OS keyring or a legacy
+plaintext file. Omit `account` for `gh`'s current active account, or name
+one of `gh`'s own multiple authenticated accounts (`gh auth status` lists
+them) — pair with a distinct `--backend` name to register each as its own
+tickets backend:
+
+```bash
+tickets auth login --backend github-personal --gh-cli DanyPops
+tickets auth login --backend github-work --gh-cli work-account
+```
+
 A stored, still-fresh delegated token always takes precedence over a static
 config/env token for that backend. Tokens are written to
 `$XDG_STATE_HOME/tickets/oauth/<backend>.json`, mode `0600`, and are never
 printed by any command. **Restart the daemon** after logging in so it picks
 up the new credential — `buildRepositories()` runs once at daemon startup.
 
+### Optional: credentials via Enigma
+
+If an [Enigma](https://github.com/DanyPops/enigma) vault is running,
+tickets checks it first on every request, ahead of a stored delegated token
+and any static config/env token — a credential Enigma rotates is picked up
+on the very next call, no daemon restart needed. Purely additive: tickets
+works identically with no Enigma running at all.
+
+Register tickets as a scoped Enigma client (once), then pass the printed
+token to the daemon via `ENIGMA_CLIENT_TOKEN`:
+
+```bash
+enigma client add tickets --backends github,gitlab,jira
+# -> prints a token once; export it wherever the tickets daemon is started
+export ENIGMA_CLIENT_TOKEN=<printed token>
+```
+
+Without `ENIGMA_CLIENT_TOKEN`, tickets falls back to Enigma's shared
+admin-token file if one exists at `$XDG_STATE_HOME/enigma/token` — fine for
+a single-user machine where every local daemon is equally trusted, but a
+scoped client token is the least-privilege default.
+
 ## The `pi-tickets` extension
 
-`extensions/pi-tickets/` registers a single `tickets` tool for
+Published as `@danypops/pi-tickets`. `../pi-tickets/` (this repo's workspace member) registers a single `tickets` tool for
 [pi](https://github.com/badlogic/pi) with one action per CLI command (`list`,
 `get`, `create`, `update`, `search`, `children`, `comments`, `comment_add`,
 `backends`, `ledger_search`, `ledger_stats`, `focus_set`, `focus_get`,
@@ -189,27 +228,21 @@ shows the current focus at all times, refreshed on session start and after
 every `tickets` tool call — so a focus the LLM sets via `focus_set` mid-
 conversation shows up in the footer too, and vice versa.
 
-To use it:
-
-```bash
-cd extensions/pi-tickets
-bun install
-```
-
-then either symlink (or copy) `extensions/pi-tickets` into
-`~/.pi/agent/extensions/pi-tickets`, or add its path to `settings.json`:
+To use it, add it to pi's `settings.json`:
 
 ```json
-{ "extensions": ["/path/to/tickets/extensions/pi-tickets"] }
+{ "packages": ["npm:@danypops/pi-tickets"] }
 ```
 
+Or, for local development against this monorepo, point at the workspace
+member directory instead: `{ "packages": ["/path/to/tickets/packages/pi-tickets"] }`.
+
 ## Development
 
 ```bash
-bun install
-bun run typecheck   # tsc --noEmit against src/ and test/
-bun test            # domain, adapters, application service, auth flows, daemon
-cd extensions/pi-tickets && bun install && bun test && bun run typecheck
+bun install                # from the repo root -- links both workspace members
+bun run typecheck          # both packages
+bun test                   # both packages
 ```
 
 Tests never hit real GitHub/GitLab/Jira/Atlassian: adapters take an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/tickets",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Unified CLI, daemon, and TypeScript library for issue tracking across GitHub, GitLab, and Jira.",
   "type": "module",
   "license": "MIT",
@@ -20,14 +20,16 @@
   ],
   "scripts": {
     "daemon": "bun run src/daemon/main.ts",
-    "test": "bun test --path-ignore-patterns 'extensions/**'",
-    "test:extension": "cd extensions/pi-tickets && bun install && bun test",
-    "test:all": "npm run test && npm run test:extension",
+    "test": "bun test",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@danypops/daemon-kit": "^0.2.1",
+    "@danypops/daemon-kit": "^0.3.0",
+    "@danypops/enigma-client": "^0.3.0",
+    "@gitbeaker/rest": "^43.8.0",
     "commander": "^12.1.0",
+    "jira.js": "^5.4.0",
+    "octokit": "^5.0.5",
     "yaml": "^2.6.0"
   },
   "devDependencies": {
@@ -50,7 +52,8 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/DanyPops/tickets.git"
+    "url": "git+https://github.com/DanyPops/tickets.git",
+    "directory": "packages/tickets"
   },
   "homepage": "https://github.com/DanyPops/tickets#readme",
   "bugs": {

package/src/adapters/github.ts

@@ -1,19 +1,39 @@
 /**
  * GitHub adapter — driven implementation of IssueRepository/CommentCapable against
- * the GitHub REST API v3 (docs: https://docs.github.com/en/rest/issues/issues).
- * Token is optional: public repos allow unauthenticated reads at a lower rate limit.
+ * the GitHub REST API v3, via octokit (github.com/octokit) rather than a hand-rolled
+ * HTTP client: it's GitHub's own official SDK, generated from GitHub's OpenAPI spec,
+ * and its typed `assignees: string[]` matches the real write contract exactly (see
+ * RESEARCH.md). Token is optional: public repos allow unauthenticated reads at a
+ * lower rate limit.
+ *
+ * IMPORTANT: the `octokit` meta-package bundles @octokit/plugin-retry and
+ * @octokit/plugin-throttling ON by default, with default onRateLimit/
+ * onSecondaryRateLimit handlers that silently SLEEP for GitHub's advertised
+ * Retry-After window (which for an exhausted hourly quota can be tens of
+ * minutes) before even attempting a retry -- confirmed for real: a live smoke
+ * test against an already-rate-limited endpoint hung with zero output rather
+ * than failing fast. That's the opposite of this project's own design (the
+ * daemon's ledger exists so live calls can fail fast and the caller decides
+ * what to do next, not so octokit can unilaterally decide to block for an
+ * indeterminate duration). Both plugins are explicitly disabled below, and
+ * every call carries a hard timeout matching the old hand-rolled HttpClient's.
  */
+import { Octokit } from "octokit";
+import { RequestError } from "@octokit/request-error";
 import type { Comment, CreateInput, Issue, ListFilter, Status, UpdateInput } from "../domain/issue.js";
 import { parsePriority } from "../domain/issue.js";
-import { AuthRequiredError } from "./errors.js";
-import { type FetchLike, HttpClient } from "./http.js";
+import { ApiError, AuthRequiredError, IssueNotFoundError } from "./errors.js";
+
+const DEFAULT_TIMEOUT_MS = 30_000;
 
 export interface GitHubOptions {
   owner: string;
   repo?: string;
   token?: string;
   baseUrl?: string;
-  fetchImpl?: FetchLike;
+  timeoutMs?: number;
+  /** Injected in tests instead of hitting a real network — see @octokit/types' RequestRequestOptions.fetch. */
+  fetchImpl?: typeof fetch;
 }
 
 interface GhUser {
@@ -31,14 +51,14 @@ interface GhIssue {
   html_url: string;
   user: GhUser | null;
   assignee: GhUser | null;
-  labels: GhLabel[];
+  labels: (GhLabel | string)[];
   created_at: string;
   updated_at: string;
   pull_request?: unknown;
 }
 interface GhComment {
   id: number;
-  body: string;
+  body?: string;
   created_at: string;
   updated_at: string;
   user: GhUser | null;
@@ -46,31 +66,32 @@ interface GhComment {
 
 export class GitHubRepository {
   readonly name: string;
-  private readonly http: HttpClient;
+  private readonly client: Octokit;
   private readonly owner: string;
   private repo?: string;
   private readonly readOnly: boolean;
 
+  private readonly timeoutMs: number;
+
   constructor(name: string, opts: GitHubOptions) {
     if (!opts.owner) throw new Error("github: owner is required");
     this.name = name;
     this.owner = opts.owner;
     this.repo = opts.repo;
     this.readOnly = !opts.token;
-    this.http = new HttpClient({
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.client = new Octokit({
+      auth: opts.token,
       baseUrl: opts.baseUrl ?? "https://api.github.com",
-      backend: "github",
-      fetchImpl: opts.fetchImpl,
-      headers: {
-        Accept: "application/vnd.github.v3+json",
-        ...(opts.token ? { Authorization: `token ${opts.token}` } : {}),
-      },
+      retry: { enabled: false },
+      throttle: { onRateLimit: () => false, onSecondaryRateLimit: () => false },
+      ...(opts.fetchImpl ? { request: { fetch: opts.fetchImpl } } : {}),
     });
   }
 
-  private repoPath(): string {
+  private repoName(): string {
     if (!this.repo) throw new Error("github: repo not set — pass repo, or scope via config");
-    return `/repos/${this.owner}/${this.repo}`;
+    return this.repo;
   }
 
   private requireAuth(): void {
@@ -79,52 +100,70 @@ export class GitHubRepository {
 
   async list(filter: ListFilter): Promise<Issue[]> {
     const limit = filter.limit && filter.limit > 0 ? filter.limit : 50;
-    const params = new URLSearchParams({ per_page: String(limit), state: "all" });
-    if (filter.status) params.set("state", mapStatusToGitHub(filter.status));
-    if (filter.assignee) params.set("assignee", filter.assignee);
-    if (filter.labels?.length) params.set("labels", filter.labels.join(","));
-
-    const raw = (await this.http.get<GhIssue[]>(`${this.repoPath()}/issues?${params}`)) ?? [];
-    return raw.filter((i) => !i.pull_request).map(toDomain);
+    const raw = await this.call((signal) =>
+      this.client.rest.issues.listForRepo({
+        owner: this.owner,
+        repo: this.repoName(),
+        per_page: limit,
+        state: filter.status ? mapStatusToGitHub(filter.status) : "all",
+        assignee: filter.assignee,
+        labels: filter.labels?.length ? filter.labels.join(",") : undefined,
+        request: { signal },
+      }),
+    );
+    return (raw as GhIssue[]).filter((i) => !i.pull_request).map(toDomain);
   }
 
   async get(key: string): Promise<Issue> {
-    const number = parseIssueNumber(key);
-    const raw = await this.http.get<GhIssue>(`${this.repoPath()}/issues/${number}`);
-    if (!raw) throw new Error(`github: empty response for #${number}`);
-    if (raw.pull_request) throw new Error(`github: #${number} is a pull request, not an issue`);
+    const issue_number = parseIssueNumber(key);
+    const raw = (await this.call((signal) =>
+      this.client.rest.issues.get({ owner: this.owner, repo: this.repoName(), issue_number, request: { signal } }),
+    )) as GhIssue;
+    if (raw.pull_request) throw new Error(`github: #${issue_number} is a pull request, not an issue`);
     return toDomain(raw);
   }
 
   async create(input: CreateInput): Promise<Issue> {
     this.requireAuth();
-    const body: Record<string, unknown> = { title: input.title, body: input.description ?? "" };
-    if (input.labels?.length) body.labels = input.labels;
-    if (input.assignee) body.assignees = [input.assignee];
-    const raw = await this.http.post<GhIssue>(`${this.repoPath()}/issues`, body);
-    if (!raw) throw new Error("github: create returned no body");
+    const raw = (await this.call((signal) =>
+      this.client.rest.issues.create({
+        owner: this.owner,
+        repo: this.repoName(),
+        title: input.title,
+        body: input.description ?? "",
+        labels: input.labels?.length ? input.labels : undefined,
+        assignees: input.assignee ? [input.assignee] : undefined,
+        request: { signal },
+      }),
+    )) as GhIssue;
     return toDomain(raw);
   }
 
   async update(key: string, input: UpdateInput): Promise<Issue> {
     this.requireAuth();
-    const number = parseIssueNumber(key);
-    const body: Record<string, unknown> = {};
-    if (input.title !== undefined) body.title = input.title;
-    if (input.description !== undefined) body.body = input.description;
-    if (input.status !== undefined) body.state = mapStatusToGitHub(input.status);
-    if (input.labels !== undefined) body.labels = input.labels;
-    if (input.assignee !== undefined) body.assignees = input.assignee ? [input.assignee] : [];
-    const raw = await this.http.patch<GhIssue>(`${this.repoPath()}/issues/${number}`, body);
-    if (!raw) throw new Error("github: update returned no body");
+    const issue_number = parseIssueNumber(key);
+    const raw = (await this.call((signal) =>
+      this.client.rest.issues.update({
+        owner: this.owner,
+        repo: this.repoName(),
+        issue_number,
+        title: input.title,
+        body: input.description,
+        state: input.status !== undefined ? mapStatusToGitHub(input.status) : undefined,
+        labels: input.labels,
+        assignees: input.assignee !== undefined ? (input.assignee ? [input.assignee] : []) : undefined,
+        request: { signal },
+      }),
+    )) as GhIssue;
     return toDomain(raw);
   }
 
   async search(query: string, limit = 50): Promise<Issue[]> {
     const scope = this.repo ? `repo:${this.owner}/${this.repo}` : `org:${this.owner}`;
-    const q = encodeURIComponent(`${scope} ${query}`);
-    const result = await this.http.get<{ items: GhIssue[] }>(`/search/issues?q=${q}&per_page=${limit}`);
-    return (result?.items ?? []).filter((i) => !i.pull_request).map(toDomain);
+    const result = (await this.call((signal) =>
+      this.client.rest.search.issuesAndPullRequests({ q: `${scope} ${query}`, per_page: limit, request: { signal } }),
+    )) as { items: GhIssue[] };
+    return result.items.filter((i) => !i.pull_request).map(toDomain);
   }
 
   // GitHub has no native sub-issue relationship exposed via REST v3.
@@ -133,24 +172,60 @@ export class GitHubRepository {
   }
 
   async listComments(key: string): Promise<Comment[]> {
-    const number = parseIssueNumber(key);
-    const raw = (await this.http.get<GhComment[]>(`${this.repoPath()}/issues/${number}/comments`)) ?? [];
+    const issue_number = parseIssueNumber(key);
+    const raw = (await this.call((signal) =>
+      this.client.rest.issues.listComments({ owner: this.owner, repo: this.repoName(), issue_number, request: { signal } }),
+    )) as GhComment[];
     return raw.map(commentToDomain);
   }
 
   async addComment(key: string, body: string): Promise<Comment> {
     this.requireAuth();
-    const number = parseIssueNumber(key);
-    const raw = await this.http.post<GhComment>(`${this.repoPath()}/issues/${number}/comments`, { body });
-    if (!raw) throw new Error("github: add comment returned no body");
+    const issue_number = parseIssueNumber(key);
+    const raw = (await this.call((signal) =>
+      this.client.rest.issues.createComment({ owner: this.owner, repo: this.repoName(), issue_number, body, request: { signal } }),
+    )) as GhComment;
     return commentToDomain(raw);
   }
+
+  /**
+   * Runs an octokit call, unwraps `.data`, and maps RequestError onto this
+   * project's shared error taxonomy. Uses a plain AbortController + setTimeout
+   * (not AbortSignal.timeout()) specifically so the timer can be cleared the
+   * moment the call settles, matching the old hand-rolled HttpClient's
+   * finally-block discipline -- AbortSignal.timeout() has no way to cancel
+   * early once created, and confirmed for real that letting it linger shows
+   * up as measurable delay (each call leaves a live timer sitting in the
+   * event loop until it eventually fires). With retry/throttling disabled
+   * above, a stalled connection or rate-limit response now fails predictably
+   * within `timeoutMs` instead of hanging.
+   */
+  private async call<T>(fn: (signal: AbortSignal) => Promise<{ data: T }>): Promise<T> {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const res = await fn(controller.signal);
+      return res.data;
+    } catch (err) {
+      if (err instanceof RequestError) {
+        if (err.status === 404) throw new IssueNotFoundError("github", err.request.url);
+        throw new ApiError("github", err.request.method, err.request.url, err.status, redact(err.message));
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
 }
 
-function parseIssueNumber(key: string): string {
+function redact(text: string): string {
+  return text.replace(/"(token|password|secret|api_key|authorization)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"').slice(0, 2000);
+}
+
+function parseIssueNumber(key: string): number {
   const stripped = key.replace(/^#/, "");
   const idx = stripped.lastIndexOf("#");
-  return idx >= 0 ? stripped.slice(idx + 1) : stripped;
+  return Number(idx >= 0 ? stripped.slice(idx + 1) : stripped);
 }
 
 function mapStatusToGitHub(status: Status): "open" | "closed" {
@@ -161,9 +236,13 @@ function mapStatusFromGitHub(state: string): Status {
   return state.toLowerCase() === "closed" ? "done" : "todo";
 }
 
-function priorityFromLabels(labels: GhLabel[]): ReturnType<typeof parsePriority> {
+function labelName(label: GhLabel | string): string {
+  return typeof label === "string" ? label : label.name;
+}
+
+function priorityFromLabels(labels: (GhLabel | string)[]): ReturnType<typeof parsePriority> {
   for (const l of labels) {
-    const lower = l.name.toLowerCase();
+    const lower = labelName(l).toLowerCase();
     if (lower.includes("urgent") || lower.includes("critical")) return "urgent";
     if (lower.includes("high")) return "high";
     if (lower.includes("medium")) return "medium";
@@ -182,7 +261,7 @@ function toDomain(gh: GhIssue): Issue {
     status: mapStatusFromGitHub(gh.state),
     rawStatus: gh.state,
     priority: priorityFromLabels(gh.labels ?? []),
-    labels: gh.labels?.length ? gh.labels.map((l) => l.name) : undefined,
+    labels: gh.labels?.length ? gh.labels.map(labelName) : undefined,
     assignee: gh.assignee?.login,
     url: gh.html_url,
     createdAt: gh.created_at,
@@ -193,7 +272,7 @@ function toDomain(gh: GhIssue): Issue {
 function commentToDomain(c: GhComment): Comment {
   return {
     id: String(c.id),
-    body: c.body,
+    body: c.body ?? "",
     author: c.user?.login,
     createdAt: c.created_at,
     updatedAt: c.updated_at,

package/src/adapters/gitlab.ts

@@ -1,14 +1,21 @@
 /**
  * GitLab adapter — driven implementation of IssueRepository/CommentCapable against
- * the GitLab REST API v4 (docs: https://docs.gitlab.com/api/issues/).
- * Self-hosted base URLs are validated to reject SSRF-prone targets (private/loopback
- * IPs, non-HTTPS non-localhost) before any request is made.
+ * the GitLab REST API v4, via @gitbeaker/rest (github.com/jdalrymple/gitbeaker)
+ * rather than a hand-rolled HTTP client: a mature, actively-maintained,
+ * TypeScript-native GitLab SDK supporting both gitlab.com and self-managed
+ * instances. Its typed `assignee_ids: number[]` (not a username) matches GitLab's
+ * real write contract exactly — a class of bug this adapter used to have (see
+ * RESEARCH.md): assignee was silently dropped in update() because a hand-rolled
+ * body never resolved a username to the numeric ID GitLab's API actually requires.
+ * Self-hosted base URLs are still validated to reject SSRF-prone targets before
+ * any request is made.
  */
+import { Gitlab } from "@gitbeaker/rest";
+import { GitbeakerRequestError, type RequesterType, type ResourceOptions } from "@gitbeaker/requester-utils";
 import { isIP } from "node:net";
 import type { Comment, CreateInput, Issue, ListFilter, Status, UpdateInput } from "../domain/issue.js";
 import { parsePriority } from "../domain/issue.js";
-import { AuthRequiredError, InvalidUrlError } from "./errors.js";
-import { type FetchLike, HttpClient } from "./http.js";
+import { ApiError, AuthRequiredError, InvalidUrlError, IssueNotFoundError } from "./errors.js";
 
 export interface GitLabOptions {
   projectId: string;
@@ -20,10 +27,13 @@ export interface GitLabOptions {
    */
   tokenType?: "private" | "oauth";
   baseUrl?: string;
-  fetchImpl?: FetchLike;
+  timeoutMs?: number;
+  /** Injected in tests instead of a real network call — see @gitbeaker/requester-utils' requesterFn. */
+  requesterFn?: (resourceOptions: ResourceOptions) => RequesterType;
 }
 
 interface GlUser {
+  id: number;
   username: string;
   name: string;
 }
@@ -49,10 +59,11 @@ interface GlNote {
 }
 
 const DEFAULT_URL = "https://gitlab.com";
+const DEFAULT_TIMEOUT_MS = 30_000;
 
 export class GitLabRepository {
   readonly name: string;
-  private readonly http: HttpClient;
+  private readonly client: InstanceType<typeof Gitlab>;
   private readonly projectId: string;
   private readonly readOnly: boolean;
 
@@ -61,17 +72,20 @@ export class GitLabRepository {
     const baseUrl = opts.baseUrl?.trim() || DEFAULT_URL;
     validateUrl(baseUrl);
     this.name = name;
-    this.projectId = encodeURIComponent(opts.projectId);
+    this.projectId = opts.projectId;
     this.readOnly = !opts.token;
-    this.http = new HttpClient({
-      baseUrl,
-      backend: "gitlab",
-      fetchImpl: opts.fetchImpl,
-      headers: opts.token
+    this.client = new Gitlab({
+      host: baseUrl,
+      // gitbeaker generates a fresh AbortSignal.timeout() per request internally when this
+      // is set (confirmed by reading its source), so a stalled call fails predictably
+      // instead of hanging -- same class of gap the octokit adapter needed a manual fix for.
+      queryTimeout: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      ...(opts.token
         ? opts.tokenType === "oauth"
-          ? { Authorization: `Bearer ${opts.token}` }
-          : { "PRIVATE-TOKEN": opts.token }
-        : {},
+          ? { oauthToken: opts.token }
+          : { token: opts.token }
+        : {}),
+      ...(opts.requesterFn ? { requesterFn: opts.requesterFn } : {}),
     });
   }
 
@@ -81,47 +95,56 @@ export class GitLabRepository {
 
   async list(filter: ListFilter): Promise<Issue[]> {
     const limit = filter.limit && filter.limit > 0 ? filter.limit : 50;
-    const params = new URLSearchParams({ per_page: String(limit) });
-    if (filter.status) params.set("state", mapStatusToGitLab(filter.status));
-    if (filter.assignee) params.set("assignee_username", filter.assignee);
-    if (filter.labels?.length) params.set("labels", filter.labels.join(","));
-
-    const raw = (await this.http.get<GlIssue[]>(`/api/v4/projects/${this.projectId}/issues?${params}`)) ?? [];
+    const raw = await this.call<GlIssue[]>(() =>
+      this.client.Issues.all({
+        projectId: this.projectId,
+        perPage: limit,
+        state: filter.status ? mapStatusToGitLab(filter.status) : undefined,
+        assigneeUsername: filter.assignee ? [filter.assignee] : undefined,
+        labels: filter.labels?.length ? filter.labels.join(",") : undefined,
+      }),
+    );
     return raw.map(toDomain);
   }
 
   async get(key: string): Promise<Issue> {
     const iid = parseIid(key);
-    const raw = await this.http.get<GlIssue>(`/api/v4/projects/${this.projectId}/issues/${iid}`);
-    if (!raw) throw new Error(`gitlab: empty response for #${iid}`);
+    const raw = await this.call<GlIssue>(() => this.client.Issues.show(iid, { projectId: this.projectId }));
     return toDomain(raw);
   }
 
   async create(input: CreateInput): Promise<Issue> {
     this.requireAuth();
-    const body: Record<string, unknown> = { title: input.title, description: input.description ?? "" };
-    if (input.labels?.length) body.labels = input.labels.join(",");
-    const raw = await this.http.post<GlIssue>(`/api/v4/projects/${this.projectId}/issues`, body);
-    if (!raw) throw new Error("gitlab: create returned no body");
+    const assigneeIds = input.assignee ? [await this.resolveUserId(input.assignee)] : undefined;
+    const raw = await this.call<GlIssue>(() =>
+      this.client.Issues.create(this.projectId, input.title, {
+        description: input.description ?? "",
+        labels: input.labels?.length ? input.labels.join(",") : undefined,
+        assigneeIds,
+      }),
+    );
     return toDomain(raw);
   }
 
   async update(key: string, input: UpdateInput): Promise<Issue> {
     this.requireAuth();
     const iid = parseIid(key);
-    const body: Record<string, unknown> = {};
-    if (input.title !== undefined) body.title = input.title;
-    if (input.description !== undefined) body.description = input.description;
-    if (input.status !== undefined) body.state_event = mapStatusEventToGitLab(input.status);
-    if (input.labels !== undefined) body.labels = input.labels.join(",");
-    const raw = await this.http.put<GlIssue>(`/api/v4/projects/${this.projectId}/issues/${iid}`, body);
-    if (!raw) throw new Error("gitlab: update returned no body");
+    const options: Record<string, unknown> = {};
+    if (input.title !== undefined) options.title = input.title;
+    if (input.description !== undefined) options.description = input.description;
+    if (input.status !== undefined) options.stateEvent = mapStatusEventToGitLab(input.status);
+    if (input.labels !== undefined) options.labels = input.labels.join(",");
+    if (input.assignee !== undefined) {
+      options.assigneeIds = input.assignee ? [await this.resolveUserId(input.assignee)] : [];
+    }
+    const raw = await this.call<GlIssue>(() => this.client.Issues.edit(this.projectId, iid, options));
     return toDomain(raw);
   }
 
   async search(query: string, limit = 50): Promise<Issue[]> {
-    const params = new URLSearchParams({ search: query, per_page: String(limit) });
-    const raw = (await this.http.get<GlIssue[]>(`/api/v4/projects/${this.projectId}/issues?${params}`)) ?? [];
+    const raw = await this.call<GlIssue[]>(() =>
+      this.client.Issues.all({ projectId: this.projectId, search: query, perPage: limit }),
+    );
     return raw.map(toDomain);
   }
 
@@ -132,21 +155,54 @@ export class GitLabRepository {
 
   async listComments(key: string): Promise<Comment[]> {
     const iid = parseIid(key);
-    const raw = (await this.http.get<GlNote[]>(`/api/v4/projects/${this.projectId}/issues/${iid}/notes`)) ?? [];
+    const raw = await this.call<GlNote[]>(() => this.client.IssueNotes.all(this.projectId, iid));
     return raw.map(noteToDomain);
   }
 
   async addComment(key: string, body: string): Promise<Comment> {
     this.requireAuth();
     const iid = parseIid(key);
-    const raw = await this.http.post<GlNote>(`/api/v4/projects/${this.projectId}/issues/${iid}/notes`, { body });
-    if (!raw) throw new Error("gitlab: add comment returned no body");
+    const raw = await this.call<GlNote>(() => this.client.IssueNotes.create(this.projectId, iid, body));
     return noteToDomain(raw);
   }
+
+  /**
+   * GitLab's assignee write contract takes a numeric user ID, not a username
+   * (`assignee_ids: number[]`, confirmed against @gitbeaker/rest's generated
+   * types) — the exact gap the old hand-rolled adapter had (never resolved
+   * this, never even attempted to set assignee at all). GitLab's own username
+   * filter is an exact match, but we still confirm the returned user's
+   * username matches exactly before trusting its id.
+   */
+  private async resolveUserId(username: string): Promise<number> {
+    const users = await this.call<GlUser[]>(() => this.client.Users.all({ username }));
+    const match = users.find((u) => u.username === username);
+    if (!match) throw new Error(`gitlab: no user found with username "${username}"`);
+    return match.id;
+  }
+
+  /** Runs a gitbeaker call and maps GitbeakerRequestError onto this project's shared error taxonomy. */
+  private async call<T>(fn: () => Promise<unknown>): Promise<T> {
+    try {
+      return (await fn()) as T;
+    } catch (err) {
+      if (err instanceof GitbeakerRequestError) {
+        const status = err.cause?.response?.status ?? 500;
+        const url = err.cause?.request?.url ?? "";
+        if (status === 404) throw new IssueNotFoundError("gitlab", url);
+        throw new ApiError("gitlab", err.cause?.request?.method ?? "?", url, status, redact(err.message));
+      }
+      throw err;
+    }
+  }
+}
+
+function redact(text: string): string {
+  return text.replace(/"(token|password|secret|api_key|authorization)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"').slice(0, 2000);
 }
 
-function parseIid(key: string): string {
-  return key.replace(/^#/, "");
+function parseIid(key: string): number {
+  return Number(key.replace(/^#/, ""));
 }
 
 function mapStatusToGitLab(status: Status): "opened" | "closed" {