@ddtcorex/dsh-maestro-review 0.3.2 → 0.5.0

package/src/host/gitlab-client.ts

@@ -1,6 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { gitlabAuthHeaders } from './gitlab-auth.js'
 
 export const name = 'maestro-gitlab-client'
 export const inject = ['tools']
@@ -27,6 +30,23 @@ interface GitlabDiff {
   diff: string
 }
 
+export interface DiffFileEntry {
+  path: string
+  bytes: number
+}
+
+/** Per-file inventory of the MR diff — small enough to return inline. Pure. */
+export function diffFileList(diffs: GitlabDiff[]): DiffFileEntry[] {
+  return diffs.map((d) => ({ path: d.new_path, bytes: Buffer.byteLength(d.diff, 'utf8') }))
+}
+
+/** Unified text for one file, or undefined when the path is not in the MR. Pure. */
+export function selectFileDiff(diffs: GitlabDiff[], path: string): string | undefined {
+  const d = diffs.find((x) => x.new_path === path || x.old_path === path)
+  if (d === undefined) return undefined
+  return `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`
+}
+
 interface GitlabDiffRefs {
   base_sha: string
   start_sha: string
@@ -45,10 +65,74 @@ interface GitlabDiscussion {
   notes: GitlabDiscussionNote[]
 }
 
+interface OwnThread {
+  discussionId: string
+  path: string
+  line: number | null
+  lastCommentBody: string
+  resolved: boolean
+}
+
+/**
+ * Resolve the in-workspace spill path for the MR diff. The DSH runtime
+ * spills large tool outputs to /tmp/dsh-spill-*, which sits outside the
+ * agent's cwd — and Guard blocks the agent from reading it back
+ * ("path outside cwd", tickets g-dd0d1679/g-716cd436). Writing the diff
+ * inside the workspace root keeps it readable via maestro_read_file.
+ */
+export function resolveDiffSpillPath(workspaceRoot: string, mrIid: number): string {
+  return join(resolve(workspaceRoot), '.maestro', `mr-${mrIid}.diff`)
+}
+
+export function writeDiffSpill(workspaceRoot: string, mrIid: number, text: string): { path: string; bytes: number } {
+  const abs = resolveDiffSpillPath(workspaceRoot, mrIid)
+  mkdirSync(join(resolve(workspaceRoot), '.maestro'), { recursive: true })
+  writeFileSync(abs, text, 'utf-8')
+  return { path: join('.maestro', `mr-${mrIid}.diff`), bytes: Buffer.byteLength(text, 'utf8') }
+}
+
+interface SC{agent?:{session?:{header?:{cwd?:string}}}}
+function sessionCwd(e: unknown): string | undefined {
+  const cwd = (e as SC|undefined)?.agent?.session?.header?.cwd
+  return typeof cwd === 'string' && cwd !== '' ? cwd : undefined
+}
+
+/**
+ * Pick this bot's inline threads out of the MR discussions list, including
+ * resolved ones (flagged) so a same-SHA re-review can reply-update instead
+ * of posting duplicates. Pure for unit testing.
+ */
+export function selectOwnThreads(
+  discussions: GitlabDiscussion[],
+  botUsername: string,
+): { threads: OwnThread[]; totalDiscussions: number } {
+  const threads = discussions
+    .filter(d => d.notes.length > 0 && d.notes[0].author.username === botUsername && d.notes[0].position !== undefined)
+    .map(d => ({
+      discussionId: d.id,
+      path: d.notes[0].position!.new_path,
+      line: d.notes[0].position!.new_line,
+      lastCommentBody: d.notes[d.notes.length - 1].body,
+      resolved: d.notes[0].resolved === true,
+    }))
+  return { threads, totalDiscussions: discussions.length }
+}
+
 export function apply(ctx: Context, config: Config): void {
   const apiBase = `${config.baseUrl}/api/v4/projects/${config.projectId}/merge_requests/${config.mrIid}`
-  const headers = { 'PRIVATE-TOKEN': config.token }
+  const headers = gitlabAuthHeaders(config.token)
   let cachedDiffRefs: GitlabDiffRefs | undefined
+  let cachedDiffs: GitlabDiff[] | undefined
+
+  async function getDiffs(): Promise<GitlabDiff[]> {
+    if (cachedDiffs !== undefined) return cachedDiffs
+    const response = await fetch(`${apiBase}/diffs`, { headers })
+    if (!response.ok) {
+      throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+    }
+    cachedDiffs = (await response.json()) as GitlabDiff[]
+    return cachedDiffs
+  }
 
   async function getDiffRefs(): Promise<GitlabDiffRefs> {
     if (cachedDiffRefs !== undefined) return cachedDiffRefs
@@ -62,20 +146,41 @@ export function apply(ctx: Context, config: Config): void {
 
   ctx.tools.register(defineTool({
     name: 'gitlab_get_mr_diff',
-    description: 'Fetch the current unified diff for this merge request.',
+    description: 'Fetch the current unified diff for this merge request. The full diff is written to path (inside your workspace, readable via maestro_read_file); bytes is its size and files lists per-file sizes. Prefer gitlab_get_file_diff per file you inspect — small inline results never spill. Do not look for anything under /tmp.',
     parameters: {},
     output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
+      schema: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, bytes: { type: 'number', required: true }, files: { type: 'array', items: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, bytes: { type: 'number', required: true } } } } } },
+      render: (_args, value) => [{ type: 'text', text: `diff written to ${value.path} (${value.bytes} bytes, ${value.files.length} files)` }],
+    },
+    async execute(_args, exec) {
+      const diffs = await getDiffs()
+      const text = diffs.map(d => `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`).join('\n\n')
+      const cwd = sessionCwd(exec)
+      // No session cwd (should not happen for review agents): fall back to
+      // the legacy inline text, which the runtime may spill to /tmp.
+      if (cwd === undefined) return { path: '', bytes: Buffer.byteLength(text, 'utf8'), files: diffFileList(diffs) }
+      const spilled = writeDiffSpill(cwd, config.mrIid, text)
+      return { ...spilled, files: diffFileList(diffs) }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'gitlab_get_file_diff',
+    description: "Return one file's unified diff inline (small results never spill to /tmp). Use after gitlab_get_mr_diff to inspect files one by one.",
+    parameters: {
+      path: { type: 'string', required: true, description: 'New path of the file, as listed in files.' },
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, text: { type: 'string', required: true } } },
       render: (_args, value) => [{ type: 'text', text: value.text }],
     },
-    async execute() {
-      const response = await fetch(`${apiBase}/diffs`, { headers })
-      if (!response.ok) {
-        throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
+    async execute(args) {
+      const diffs = await getDiffs()
+      const text = selectFileDiff(diffs, args.path)
+      if (text === undefined) {
+        throw new Error(`path not in this MR diff: ${args.path}`)
       }
-      const diffs = await response.json() as GitlabDiff[]
-      const text = diffs.map(d => `--- ${d.old_path}\n+++ ${d.new_path}\n${d.diff}`).join('\n\n')
-      return { text }
+      return { path: args.path, text }
     },
   }))
 
@@ -104,11 +209,34 @@ export function apply(ctx: Context, config: Config): void {
 
   ctx.tools.register(defineTool({
     name: 'gitlab_list_own_review_threads',
-    description: 'List this merge request\'s unresolved inline discussion threads previously created by this bot account, so you can reply instead of duplicating.',
+    description: 'List this merge request\'s inline discussion threads previously created by this bot account (both unresolved and resolved, flagged), so you can reply instead of duplicating. Returns {threads, totalDiscussions}.',
     parameters: {},
     output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          threads: {
+            type: 'array',
+            items: {
+              type: 'object',
+              additionalProperties: false,
+              properties: {
+                discussionId: { type: 'string', required: true },
+                path: { type: 'string', required: true },
+                line: { type: 'number' },
+                lastCommentBody: { type: 'string', required: true },
+                resolved: { type: 'boolean', required: true },
+              },
+            },
+          },
+          totalDiscussions: { type: 'number', required: true },
+        },
+      },
+      render: (_args, value: { threads: OwnThread[]; totalDiscussions: number }) => [{
+        type: 'text',
+        text: `${value.totalDiscussions} discussion(s) on this MR, ${value.threads.length} own inline thread(s):\n${JSON.stringify(value.threads)}`,
+      }],
     },
     async execute() {
       const response = await fetch(`${apiBase}/discussions`, { headers })
@@ -116,10 +244,7 @@ export function apply(ctx: Context, config: Config): void {
         throw new Error(`GitLab API error ${response.status}: ${await response.text()}`)
       }
       const discussions = await response.json() as GitlabDiscussion[]
-      const ownThreads = discussions
-        .filter(d => d.notes.length > 0 && d.notes[0].author.username === config.botUsername && !d.notes[0].resolved && d.notes[0].position !== undefined)
-        .map(d => ({ discussionId: d.id, path: d.notes[0].position!.new_path, line: d.notes[0].position!.new_line, lastCommentBody: d.notes[d.notes.length - 1].body }))
-      return { text: JSON.stringify(ownThreads) }
+      return selectOwnThreads(discussions, config.botUsername)
     },
   }))
 

package/src/host/govard-audit-lint-tool.ts

@@ -7,7 +7,39 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 
 export const name='maestro-govard-audit-lint-tool'
 export const inject=['tools']
-export const Config:z<{rootPath?:string, timeoutMs?:number}> = z.object({rootPath:z.string(), timeoutMs:z.number()})
+export const Config:z<{rootPath?:string, timeoutMs?:number, defaultBase?:string, allowXdebug?:boolean}> = z.object({rootPath:z.string(), timeoutMs:z.number(), defaultBase:z.string(), allowXdebug:z.boolean()})
+
+export interface AuditLintOptions {
+  checks?: string[]
+  mode?: string
+  scope?: string
+  base?: string
+  phpVersions?: string[]
+  noLintResultCache?: boolean
+  timeout?: string
+  lintProvider?: string
+  allowXdebug?: boolean
+}
+
+/** Explicit call base wins, then the review-wired default (MR base_sha). */
+export function resolveLintBase(argsBase: string | undefined, defaultBase: string | undefined): string | undefined {
+  return argsBase ?? defaultBase
+}
+
+export function buildAuditCliArgs(a: AuditLintOptions): string[] {
+  const checks = a.checks && a.checks.length ? a.checks.join(',') : 'lint'
+  const mode = a.mode ?? 'auto'
+  const timeout = a.timeout ?? 'auto'
+  const lintProvider = a.lintProvider ?? 'govard'
+  const cliArgs=['audit','run','--checks',checks,'--format','json','--mode',mode,'--timeout',timeout,'--lint-provider',lintProvider]
+  if(a.scope) cliArgs.push('--scope', a.scope)
+  const base = resolveLintBase(a.base, undefined)
+  if(base) cliArgs.push('--base', base)
+  if(a.phpVersions && a.phpVersions.length) cliArgs.push('--php', a.phpVersions.join(','))
+  if(a.noLintResultCache) cliArgs.push('--no-lint-result-cache')
+  if(a.allowXdebug) cliArgs.push('--allow-xdebug')
+  return cliArgs
+}
 
 interface SC{agent?:{session?:{header?:{cwd?:string}}}}
 function workspaceRootFor(c:string|undefined, e:unknown):string{
@@ -38,7 +70,98 @@ async function isInsideRoot(r:string,t:string):Promise<boolean>{
   }
 }
 export function cleanJson(raw:string):string{
-  return raw.replace(/\n\s*ERROR audit run.*$/s, '').replace(/\s{2,}ERROR audit run.*$/s, '').trimEnd()
+  // pterm pads the level name: "  ERROR   audit run ..." (multi-space).
+  return raw.replace(/\n\s*ERROR\s+audit run.*$/s, '').replace(/\s{2,}ERROR\s+audit run.*$/s, '').trimEnd()
+}
+
+interface LintViolationLike { path?: string; line?: number; rule?: string; message?: string }
+
+interface LintResultLike {
+  ok: boolean
+  exitCode?: number
+  lint?: {
+    phpcs?: { violations?: LintViolationLike[] }
+    phpstan?: { errors?: LintViolationLike[] }
+    pubMediaGuard?: { violations?: LintViolationLike[] }
+  }
+  summary?: { findingCount?: number }
+  diagnostics?: string
+}
+
+/**
+ * One-line-plus render for the agent: a bare "audit lint failed" hides the
+ * violations the reviewer needs, so carry counts plus the top findings.
+ */
+export interface CollectedLintFindings {
+  phpcsViolations: Array<{ path?: string; line?: number; column?: number; rule?: string; message?: string; severity?: string }>
+  phpstanErrors: Array<{ path?: string; line?: number; message?: string }>
+  pubMediaViolations: unknown[]
+  compat: Array<{ tool?: string; path?: string; line?: number; rule?: string; message?: string }>
+  total: number
+}
+
+/**
+ * Collect findings across govard audit JSON shapes. The live envelope nests
+ * them at results[].evidence.php_results[].findings (older callers used a
+ * top-level findings array or evidence.php_results) — and non-phpcs/phpstan
+ * tools (e.g. M2-LINT-COMPAT internal errors) go to the compat bucket
+ * instead of being silently dropped from counts.
+ */
+export function collectLintFindings(parsed: unknown): CollectedLintFindings {
+  const p = (parsed ?? {}) as Record<string, any>
+  const lists: unknown[][] = []
+  if (Array.isArray(p.findings)) lists.push(p.findings)
+  const ev = p.evidence as Record<string, any> | undefined
+  if (Array.isArray(ev?.php_results)) lists.push(...ev.php_results.map((r: any) => r?.findings).filter(Array.isArray))
+  if (Array.isArray(p.php_results)) lists.push(...p.php_results.map((r: any) => r?.findings).filter(Array.isArray))
+  // Live shape (govard audit run): jobs[].evidence.php_results[].findings.
+  // Older shapes (results[], bare evidence) kept for backward compatibility.
+  for (const key of ['jobs', 'results'] as const) {
+    if (!Array.isArray(p[key])) continue
+    for (const r of p[key] as Array<Record<string, any>>) {
+      const e = r?.evidence as Record<string, any> | undefined
+      const pr = e?.php_results ?? r?.php_results
+      if (Array.isArray(pr)) lists.push(...pr.map((x: any) => x?.findings).filter(Array.isArray))
+      if (Array.isArray(r?.findings)) lists.push(r.findings)
+    }
+  }
+  const out: CollectedLintFindings = { phpcsViolations: [], phpstanErrors: [], pubMediaViolations: [], compat: [], total: 0 }
+  // DSH tool output must be lossless JSON: drop undefined fields, the
+  // runtime rejects values that do not survive a JSON round-trip.
+  const compact = (entry: Record<string, unknown>): Record<string, unknown> => {
+    const kept: Record<string, unknown> = {}
+    for (const [k, v] of Object.entries(entry)) if (v !== undefined) kept[k] = v
+    return kept
+  }
+  for (const list of lists) {
+    for (const f of list as Array<Record<string, any>>) {
+      if (f?.tool === 'phpstan') out.phpstanErrors.push(compact({ path: f.path, line: f.line, message: f.message }) as CollectedLintFindings['phpstanErrors'][number])
+      else if (f?.tool === 'phpcs') {
+        if (f.path?.includes('pub/media') || f.rule?.includes('PubMedia')) out.pubMediaViolations.push(f)
+        else out.phpcsViolations.push(compact({ path: f.path, line: f.line, column: f.column, rule: f.rule, message: f.message, severity: f.severity }) as CollectedLintFindings['phpcsViolations'][number])
+      } else if (f && typeof f === 'object') {
+        out.compat.push(compact({ tool: f.tool, path: f.path, line: f.line, rule: f.rule, message: f.message }) as CollectedLintFindings['compat'][number])
+      }
+    }
+  }
+  out.total = out.phpcsViolations.length + out.phpstanErrors.length + out.pubMediaViolations.length + out.compat.length
+  return out
+}
+
+export function lintResultText(v: LintResultLike): string {
+  if (v.ok) return 'audit lint passed'
+  const phpcs = v.lint?.phpcs?.violations ?? []
+  const phpstan = v.lint?.phpstan?.errors ?? []
+  const pubMedia = v.lint?.pubMediaGuard?.violations ?? []
+  const compat = (v.lint as Record<string, any> | undefined)?.compat?.findings ?? []
+  const total = v.summary?.findingCount ?? phpcs.length + phpstan.length + pubMedia.length + compat.length
+  const bits: string[] = [`audit lint failed — ${total} finding(s) (phpcs ${phpcs.length}, phpstan ${phpstan.length}, pubMedia ${pubMedia.length}, compat ${compat.length})`]
+  const top = [...phpcs.map(x => ({ ...x, tool: 'phpcs' })), ...phpstan.map(x => ({ ...x, tool: 'phpstan' })), ...pubMedia.map(x => ({ ...x, tool: 'pubMedia' })), ...compat.map((x: Record<string, any>) => ({ ...x, tool: x.tool ?? 'compat' }))].slice(0, 5)
+  for (const f of top) bits.push(`- [${f.tool}] ${f.path ?? (f.message ?? '?').toString().slice(0, 120)}${f.path !== undefined ? `:${f.line ?? '?'}` : ''}${f.rule !== undefined ? ` ${f.rule}` : ''}`)
+  if (v.exitCode !== undefined) bits.push(`exit ${v.exitCode}`)
+  const diag = (v.diagnostics ?? '').split('\n')[0]?.trim()
+  if (total === 0 && diag !== '' && diag !== undefined) bits.push(diag.slice(0, 200))
+  return bits.join('\n')
 }
 // Govard 1.67 auto timeout: 90s-30m framework-aware (15m floor for wordpress/magento2 → 22.5m auto)
 // Keep kill timeout above the largest auto value so the outer watchdog doesn't cancel a valid auto run.
@@ -57,12 +180,16 @@ function run(cmd:string, args:string[], cwd:string, timeoutMs:number):Promise<{c
   })
 }
 
-export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}={}):void{
+export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number, defaultBase?:string, allowXdebug?:boolean}={}):void{
   const configuredRoot=config.rootPath
   const defaultTimeout=config.timeoutMs ?? DEFAULT_TIMEOUT
+  const defaultBase=config.defaultBase
+  // Review worktrees disable xdebug via .govard.local.yml, but govard's lint
+  // guard probes the base .govard.yml only — so the mount opts out explicitly.
+  const allowXdebug=config.allowXdebug ?? false
   ctx.effect(()=>ctx.tools.register(defineTool({
     name:'govard_audit_lint',
-    description:'Run govard audit --checks lint --format json and return structured phpcs/phpstan results. Use before hand-parsing text. Govard 1.67+ uses --timeout auto (framework-aware 90s-30m, 22.5m for wordpress/magento2) by default.',
+    description:'Run govard audit --checks lint --format json and return structured phpcs/phpstan results. Use before hand-parsing text. Govard 1.67+ uses --timeout auto (framework-aware 90s-30m, 22.5m for wordpress/magento2) by default. scope "diff" requires a base ref: pass base, or rely on the wired defaultBase (MR base_sha) when present.',
     parameters:{
       worktreePath:{type:'string'},
       checks:{type:'array', items:{type:'string'}},
@@ -93,7 +220,7 @@ export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}=
           runId:{type:'string'},
         }
       },
-      render:(_a,v:{ok:boolean})=>[{type:'text', text: v.ok? 'audit lint passed':'audit lint failed'}],
+      render:(_a,v:LintResultLike)=>[{type:'text', text: lintResultText(v)}],
     },
     async execute(args, exec){
       const rawPath=(args as {worktreePath?:string}).worktreePath
@@ -104,20 +231,13 @@ export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}=
       const timeoutMs=(args as {timeoutMs?:number}).timeoutMs ?? defaultTimeout
       if(timeoutMs<5000 || timeoutMs>1_800_000) return {text:'timeoutMs out of range 5000-1800000 (5s-30m). Use --timeout auto for framework-aware estimation.', truncated:false} as never
 
-      const a = args as {checks?:string[]; mode?:string; scope?:string; base?:string; phpVersions?:string[]; noLintResultCache?:boolean; timeout?:string; lintProvider?:string}
-      const checks = a.checks && a.checks.length ? a.checks.join(',') : 'lint'
-      const mode = a.mode ?? 'auto'
+      const a = args as {checks?:string[]; mode?:string; scope?:string; base?:string; phpVersions?:string[]; noLintResultCache?:boolean; timeout?:string; lintProvider?:string; allowXdebug?:boolean}
       const scope = a.scope
-      const base = a.base
-      const phpVersionsArg = a.phpVersions
-      const noLintResultCache = a.noLintResultCache
-      const timeout = a.timeout ?? 'auto'
-      const lintProvider = a.lintProvider ?? 'govard'
-      const cliArgs=['audit','run','--checks',checks,'--format','json','--mode',mode,'--timeout',timeout,'--lint-provider',lintProvider]
-      if(scope) cliArgs.push('--scope', scope)
-      if(base) cliArgs.push('--base', base)
-      if(phpVersionsArg && phpVersionsArg.length) cliArgs.push('--php', phpVersionsArg.join(','))
-      if(noLintResultCache) cliArgs.push('--no-lint-result-cache')
+      const base = resolveLintBase(a.base, defaultBase)
+      if (scope === 'diff' && base === undefined) {
+        return {text:'scope "diff" requires a base ref (govard --base): pass base explicitly (e.g. origin/master or the MR base_sha) or mount this tool with defaultBase.', truncated:false} as never
+      }
+      const cliArgs = buildAuditCliArgs({ ...a, base, allowXdebug: a.allowXdebug ?? allowXdebug })
       const result=await run('govard', cliArgs, worktreePath, timeoutMs)
       if(result.timedOut){
         return {ok:false, exitCode: result.code ?? 124, timedOut:true, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'timeout', message:`timed out after ${timeoutMs}ms` }], diagnostics:result.stderr.slice(0,4000)} as never
@@ -139,20 +259,13 @@ export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}=
       if(!parsed){
         return {ok:false, exitCode: result.code ?? 1, timedOut:false, worktreePath, lint:{phpcs:{violations:[]}, phpstan:{errors:[]}, pubMediaGuard:{violations:[]}}, summary:{status:null, phpVersions:[], matrixComplete:false, findingCount:0, truncated:false}, rawJson:{}, errors:[{code:'parse_error', message:'stdout not JSON'}], diagnostics:(cleaned+result.stderr).slice(0,4000)} as never
       }
-      const findings:Array<any>=parsed.findings ?? parsed.evidence?.php_results?.flatMap((r:any)=>r.findings) ?? []
-      const phpcsViolations:any[]=[]
-      const phpstanErrors:any[]=[]
-      const pubMediaViolations:any[]=[]
-      for(const f of findings){
-        if(f.tool==='phpstan') phpstanErrors.push({path:f.path, line:f.line, message:f.message})
-        else if(f.tool==='phpcs'){
-          if(f.path?.includes('pub/media') || f.rule?.includes('PubMedia')) pubMediaViolations.push(f)
-          else phpcsViolations.push({path:f.path, line:f.line, column:f.column, rule:f.rule, message:f.message, severity:f.severity})
-        }
-      }
+      const collected = collectLintFindings(parsed)
+      const phpcsViolations = collected.phpcsViolations
+      const phpstanErrors = collected.phpstanErrors
+      const pubMediaViolations = collected.pubMediaViolations
       const status=parsed.status ?? (result.code===0?'passed':'failed')
       const phpVersions=parsed.php_versions ?? parsed.phpVersions ?? []
-      const findingCount=findings.length
+      const findingCount=collected.total
       const sessionId = parsed.session_id ?? parsed.sessionId ?? undefined
       const runId = parsed.run_id ?? parsed.runId ?? undefined
       return {
@@ -164,7 +277,7 @@ export function apply(ctx:Context, config:{rootPath?:string, timeoutMs?:number}=
         ...(runId ? { runId: String(runId) } : {}),
         rawJson: parsed as Record<string, unknown>,
         summary:{status, phpVersions, matrixComplete:true, findingCount, truncated: findingCount>100},
-        lint:{phpcs:{violations:phpcsViolations}, phpstan:{errors:phpstanErrors}, pubMediaGuard:{violations:pubMediaViolations}},
+        lint:{phpcs:{violations:phpcsViolations}, phpstan:{errors:phpstanErrors}, pubMediaGuard:{violations:pubMediaViolations}, compat:{findings:collected.compat}},
         errors:[],
         diagnostics: result.stderr.slice(0,4000),
       } as never

package/src/host/govard-tool.ts

@@ -82,7 +82,7 @@ export function apply(ctx: Context, config: Config): void {
     name: 'govard_shell',
     description: 'Run one non-interactive command inside the Govard-managed container (e.g. a test suite) and return its output.',
     parameters: {
-      command: { type: 'string', required: true, description: 'Shell command to run inside the container, e.g. "vendor/bin/phpunit".' },
+      command: { type: 'string', required: true, description: 'Shell command to run inside the container. PHPUnit in a Magento root: always scope it — "vendor/bin/phpunit -c dev/tests/unit/phpunit.xml.dist --filter <Module>" or "vendor/bin/phpunit --no-coverage --bootstrap dev/tests/unit/framework/bootstrap.php app/code/<Vendor>/<Module>/Test/Unit". The root ships no phpunit.xml so the bare binary prints usage and exits 1; never run the full suite bare (core fixture conflicts), and capture status via ${PIPESTATUS[0]} when piping through tail.' },
     },
     output: {
       schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string', required: true } } },

package/src/host/incremental.ts

@@ -1,3 +1,4 @@
+import { gitlabAuthHeaders } from './gitlab-auth.js'
 export interface CompareCommit {
   short_id?: string
   title?: string
@@ -57,7 +58,7 @@ export async function fetchMrDetailHeadSha(
   try {
     const response = await fetch(
       `${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}`,
-      { headers: { 'PRIVATE-TOKEN': token } },
+      { headers: gitlabAuthHeaders(token) },
     )
     if (!response.ok) return undefined
     const body = await response.json() as { diff_refs?: { head_sha?: string } }
@@ -74,7 +75,7 @@ export async function fetchCompare(
   try {
     const response = await fetch(
       `${baseUrl}/api/v4/projects/${projectId}/repository/compare?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`,
-      { headers: { 'PRIVATE-TOKEN': token } },
+      { headers: gitlabAuthHeaders(token) },
     )
     if (!response.ok) return undefined
     return await response.json() as CompareResult