@f5xc-salesdemos/xcsh 18.35.2 → 18.36.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/xcsh",
-	"version": "18.35.2",
+	"version": "18.36.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -48,12 +48,12 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5xc-salesdemos/xcsh-stats": "18.35.2",
-		"@f5xc-salesdemos/pi-agent-core": "18.35.2",
-		"@f5xc-salesdemos/pi-ai": "18.35.2",
-		"@f5xc-salesdemos/pi-natives": "18.35.2",
-		"@f5xc-salesdemos/pi-tui": "18.35.2",
-		"@f5xc-salesdemos/pi-utils": "18.35.2",
+		"@f5xc-salesdemos/xcsh-stats": "18.36.0",
+		"@f5xc-salesdemos/pi-agent-core": "18.36.0",
+		"@f5xc-salesdemos/pi-ai": "18.36.0",
+		"@f5xc-salesdemos/pi-natives": "18.36.0",
+		"@f5xc-salesdemos/pi-tui": "18.36.0",
+		"@f5xc-salesdemos/pi-utils": "18.36.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.18",

package/src/config/settings-schema.ts

@@ -1328,6 +1328,17 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"gitlab.enabled": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "tools",
+			label: "GitLab CLI",
+			description:
+				"Enable read-only glab_* tools for GitLab issue tracking, search, and work item access via glab CLI",
+		},
+	},
+
 	"web_search.enabled": {
 		type: "boolean",
 		default: true,

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "18.35.2",
-	"commit": "4476717a972f57d501906d71b1377b21e00744df",
-	"shortCommit": "4476717",
+	"version": "18.36.0",
+	"commit": "e184ba33c5bf2f52613a85f40b7ebd0d5043deb5",
+	"shortCommit": "e184ba3",
 	"branch": "main",
-	"tag": "v18.35.2",
-	"commitDate": "2026-05-03T23:47:28Z",
-	"buildDate": "2026-05-04T00:10:18.411Z",
+	"tag": "v18.36.0",
+	"commitDate": "2026-05-04T03:30:53Z",
+	"buildDate": "2026-05-04T03:50:55.993Z",
 	"dirty": false,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5xc-salesdemos/xcsh",
 	"repoSlug": "f5xc-salesdemos/xcsh",
-	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/4476717a972f57d501906d71b1377b21e00744df",
-	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.35.2"
+	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/e184ba33c5bf2f52613a85f40b7ebd0d5043deb5",
+	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.36.0"
 };

package/src/prompts/system/system-prompt.md

@@ -196,13 +196,22 @@ Most tools resolve custom protocol URLs to internal resources (not web URLs):
 
   When the user needs to **make an API call** (create, read, update, delete):
 
-  1. `xcsh://api-catalog/?resource={resource_name}` → get endpoint path, method, minimum
-     payload JSON, required fields, and response summary
+  1. `xcsh://api-catalog/?resource={resource_name}&compact=true` → get endpoint path, method,
+     minimum payload JSON, OneOf recommendations, and response summary
   2. Call `xcsh_api` tool with `method`, `path`, `params` (all `{placeholder}` substitutions), and `payload`
 
+  When the resource type and required parameters are clear, your **first output
+  MUST be the catalog tool call** — do not preface with explanation or deliberation.
+  If required parameters (e.g., namespace) are ambiguous, ask first.
+
   The `xcsh_api` tool handles authentication, URL construction, and HTTP execution.
   Never construct curl commands for F5 XC API calls — use `xcsh_api` instead.
 
+  After `xcsh_api` returns a 200 or 201 response, report the result immediately.
+  Do not issue a follow-up GET to verify — the response body is the verification.
+  Only issue a GET if the user explicitly asks to read current state, or if the
+  initial call returned a non-2xx status.
+
   If the resource name is unknown, search first:
   `xcsh://api-catalog/?search={term}` → find the matching category, then read it.
 

package/src/prompts/tools/glab-issue-list.md

@@ -0,0 +1,7 @@
+List GitLab issues with structured filters via glab CLI. Returns a markdown summary table.
+
+<instruction>
+Use for "show open bugs", "list issues assigned to X", "show high priority issues".
+Supports: state (opened/closed/all), labels, assignee, search text, milestone, sort field, order direction, limit.
+Defaults to the configured project. Pass project explicitly to override.
+</instruction>

package/src/prompts/tools/glab-issue-view.md

@@ -0,0 +1,7 @@
+View a single GitLab issue with full details, description, and comments via glab CLI.
+
+<instruction>
+Use when the user asks to "show issue #N" or "view details of issue X".
+Returns structured markdown with title, state, author, labels, assignee, milestone, description, and comments thread.
+System notes (automated messages) are filtered out.
+</instruction>

package/src/prompts/tools/glab-search.md

@@ -0,0 +1,7 @@
+Full-text search across GitLab issue titles, descriptions, labels, and comments via glab CLI.
+
+<instruction>
+Use for "find issues about Tempus", "search for login timeout bugs", "bugs mentioning Safari".
+Three-tier search: REST API (fast, titles+descriptions), GraphQL (includes comments), client-side dedup.
+Supports state filtering and label filtering alongside text search.
+</instruction>

package/src/prompts/tools/glab-setup.md

@@ -0,0 +1,6 @@
+GitLab onboarding wizard via glab CLI. Check installation, authenticate, discover projects, and persist configuration.
+
+<instruction>
+Actions: "check" (verify glab installed), "status" (auth + config), "login" (browser OAuth), "select_project" (list available projects), "save_project" (persist selected project path).
+Run this sequence when the user first asks about GitLab issues and no project is configured.
+</instruction>

package/src/prompts/tools/xcsh-api.md

@@ -7,3 +7,5 @@ Pass all path `{placeholder}` values via `params`, e.g. `{ namespace: "default",
 Body is sent for all methods except GET when `payload` is provided — including DELETE operations that require a body.
 
 Use this tool after reading the API catalog to get the endpoint path and payload structure.
+
+API calls to the same F5 XC tenant reuse a single TLS connection — sequential calls are faster than parallel calls. Do not issue multiple xcsh_api calls in the same turn; issue them one at a time.

package/src/tools/bash.ts

@@ -772,10 +772,26 @@ export const bashToolRenderer = {
 				const verbose = getBashVerboseSetting();
 				const hasAsyncDetails = details?.async != null;
 				const forceExpand = isError || hasAsyncDetails || hasSixelOutput;
-				if (!verbose && !expanded && !forceExpand && !options.isPartial) {
+				if (!verbose && !expanded && !forceExpand) {
 					const rawCmd = args?.command;
 					const summaryText =
 						args?.description ?? (rawCmd && rawCmd.length > 60 ? `${rawCmd.slice(0, 60)}…` : rawCmd) ?? "…";
+
+					if (options.isPartial) {
+						const lineCount = rawOutputLines.filter(l => l.trim().length > 0).length;
+						const line = renderStatusLine(
+							{
+								icon: "running",
+								spinnerFrame: options.spinnerFrame,
+								title: "Bash",
+								description: summaryText,
+								meta: lineCount > 0 ? [`${lineCount} lines`] : undefined,
+							},
+							uiTheme,
+						);
+						return [truncateToWidth(line, width)];
+					}
+
 					const line = renderStatusLine(
 						{
 							title: "Bash",

package/src/tools/glab/config.ts

@@ -0,0 +1,37 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import type { GlabConfig } from "./types";
+
+const CONFIG_FILENAME = "glab-config.json";
+const XCSH_DIR = ".xcsh";
+
+export async function loadConfig(cwd: string): Promise<GlabConfig | null> {
+	const projectConfig = path.join(cwd, XCSH_DIR, CONFIG_FILENAME);
+	try {
+		const raw = await fs.readFile(projectConfig, "utf8");
+		return JSON.parse(raw) as GlabConfig;
+	} catch {
+		// try user-level fallback
+	}
+
+	const userConfig = path.join(os.homedir(), ".xcsh", "agent", CONFIG_FILENAME);
+	try {
+		const raw = await fs.readFile(userConfig, "utf8");
+		return JSON.parse(raw) as GlabConfig;
+	} catch {
+		return null;
+	}
+}
+
+export async function saveConfig(cwd: string, config: GlabConfig): Promise<void> {
+	const dir = path.join(cwd, XCSH_DIR);
+	await fs.mkdir(dir, { recursive: true });
+	await fs.writeFile(path.join(dir, CONFIG_FILENAME), JSON.stringify(config, null, 2), "utf8");
+}
+
+export async function resolveProject(paramProject: string | undefined, cwd: string): Promise<string | null> {
+	if (paramProject) return paramProject;
+	const config = await loadConfig(cwd);
+	return config?.project ?? null;
+}

package/src/tools/glab/exec.ts

@@ -0,0 +1,66 @@
+export interface GlabExecResult {
+	stdout: string;
+	stderr: string;
+	code: number;
+	killed: boolean;
+}
+
+export interface GlabExecApi {
+	cwd: string;
+	exec(command: string, args: string[], options?: { signal?: AbortSignal; cwd?: string }): Promise<GlabExecResult>;
+}
+
+export class GlabAuthError extends Error {
+	constructor(message: string) {
+		super(`GitLab auth error: ${message}. Run glab_setup with action "login".`);
+		this.name = "GlabAuthError";
+	}
+}
+
+export class GlabNotFoundError extends Error {
+	constructor(message: string) {
+		super(`GitLab resource not found (404/403): ${message}`);
+		this.name = "GlabNotFoundError";
+	}
+}
+
+export class GlabExecError extends Error {
+	constructor(
+		message: string,
+		public readonly code: number,
+	) {
+		super(`glab command failed (exit ${code}): ${message}`);
+		this.name = "GlabExecError";
+	}
+}
+
+export async function checkInstalled(pi: GlabExecApi): Promise<boolean> {
+	const result = await pi.exec("which", ["glab"], { cwd: pi.cwd });
+	return result.code === 0;
+}
+
+export async function checkAuth(pi: GlabExecApi): Promise<boolean> {
+	const result = await pi.exec("glab", ["auth", "status"], { cwd: pi.cwd });
+	return result.code === 0;
+}
+
+export async function execGlab(pi: GlabExecApi, args: string[], signal?: AbortSignal): Promise<GlabExecResult> {
+	const result = await pi.exec("glab", args, { signal, cwd: pi.cwd });
+	if (result.killed) throw new Error("Command was cancelled");
+	if (result.code !== 0) {
+		const stderr = result.stderr.toLowerCase();
+		if (stderr.includes("auth") || stderr.includes("not logged in") || stderr.includes("token")) {
+			throw new GlabAuthError(result.stderr);
+		}
+		if (stderr.includes("404") || stderr.includes("403") || stderr.includes("not found")) {
+			throw new GlabNotFoundError(result.stderr);
+		}
+		throw new GlabExecError(result.stderr, result.code);
+	}
+	return result;
+}
+
+export async function execGlabJson<T = unknown>(pi: GlabExecApi, args: string[], signal?: AbortSignal): Promise<T> {
+	const result = await execGlab(pi, args, signal);
+	return JSON.parse(result.stdout) as T;
+}

package/src/tools/glab/formatters.ts

@@ -0,0 +1,73 @@
+import type { GlabIssue } from "./types";
+
+function formatDate(iso: string): string {
+	return iso.slice(0, 10);
+}
+
+function truncateLabels(labels: string[], maxLen = 30): string {
+	if (!labels.length) return "(none)";
+	const joined = labels.join(", ");
+	if (joined.length <= maxLen) return joined;
+	const truncated = labels.slice(0, 3).join(", ");
+	const remaining = labels.length - 3;
+	return remaining > 0 ? `${truncated}, +${remaining}` : truncated;
+}
+
+export function formatIssueTable(issues: GlabIssue[]): string {
+	if (issues.length === 0) {
+		return "No issues found matching the criteria.";
+	}
+
+	const header = "| IID | Title | State | Labels | Assignee | Updated |";
+	const divider = "|-----|-------|-------|--------|----------|---------|";
+
+	const rows = issues.map(issue => {
+		const title = issue.title.length > 50 ? `${issue.title.slice(0, 47)}...` : issue.title;
+		const labels = truncateLabels(issue.labels);
+		const assignee = issue.assignees.length > 0 ? `@${issue.assignees[0].username}` : "unassigned";
+		const updated = formatDate(issue.updated_at);
+		return `| ${issue.iid} | ${title} | ${issue.state} | ${labels} | ${assignee} | ${updated} |`;
+	});
+
+	return [header, divider, ...rows].join("\n");
+}
+
+export function formatIssueDetail(issue: GlabIssue): string {
+	const lines: string[] = [];
+
+	lines.push(`# Issue #${issue.iid}: ${issue.title}`);
+	lines.push("");
+	lines.push(
+		`State: ${issue.state} | Author: @${issue.author.username} | Created: ${formatDate(issue.created_at)} | Updated: ${formatDate(issue.updated_at)}`,
+	);
+
+	if (issue.labels.length > 0) {
+		lines.push(`Labels: ${issue.labels.join(", ")}`);
+	}
+
+	const assigneeStr =
+		issue.assignees.length > 0 ? issue.assignees.map(a => `@${a.username}`).join(", ") : "unassigned";
+	lines.push(`Assignee: ${assigneeStr}${issue.milestone ? ` | Milestone: ${issue.milestone.title}` : ""}`);
+	lines.push("");
+	lines.push("---");
+	lines.push("");
+	lines.push(issue.description || "(no description)");
+
+	const humanNotes = (issue.notes ?? []).filter(n => !n.system);
+	lines.push("");
+	lines.push("---");
+	lines.push("");
+
+	if (humanNotes.length === 0) {
+		lines.push("No comments.");
+	} else {
+		lines.push(`## Comments (${humanNotes.length})`);
+		for (const note of humanNotes) {
+			lines.push("");
+			lines.push(`**@${note.author.username}** (${formatDate(note.created_at)}):`);
+			lines.push("> " + note.body.split("\n").join("\n> "));
+		}
+	}
+
+	return lines.join("\n");
+}

package/src/tools/glab/graphql.ts

@@ -0,0 +1,59 @@
+import type { GlabExecApi } from "./exec";
+import { execGlab } from "./exec";
+import type { GraphQLIssueNode, GraphQLSearchResponse } from "./types";
+
+export function buildSearchQuery(includeState: boolean): string {
+	const stateVar = includeState ? ", $state: IssuableState" : "";
+	const stateArg = includeState ? ", state: $state" : "";
+	return `
+query SearchIssues($projectPath: ID!, $search: String!, $first: Int!${stateVar}) {
+  project(fullPath: $projectPath) {
+    issues(search: $search, first: $first${stateArg}) {
+      nodes {
+        iid
+        title
+        state
+        labels { nodes { title } }
+        assignees { nodes { username } }
+        updatedAt
+        notes(first: 20) {
+          nodes {
+            body
+            author { username }
+            createdAt
+          }
+        }
+      }
+    }
+  }
+}`.trim();
+}
+
+export async function executeGraphQL(
+	pi: GlabExecApi,
+	projectPath: string,
+	searchText: string,
+	limit: number,
+	signal?: AbortSignal,
+	state?: string,
+): Promise<GraphQLIssueNode[]> {
+	const includeState = !!state && state !== "all";
+	const query = buildSearchQuery(includeState);
+	const vars: Record<string, unknown> = { projectPath, search: searchText, first: limit };
+	if (includeState) vars.state = state === "closed" ? "closed" : "opened";
+	const variables = JSON.stringify(vars);
+
+	const result = await execGlab(
+		pi,
+		["api", "graphql", "-f", `query=${query}`, "-f", `variables=${variables}`],
+		signal,
+	);
+
+	const response = JSON.parse(result.stdout) as GraphQLSearchResponse;
+
+	if (response.errors && response.errors.length > 0) {
+		throw new Error(response.errors.map(e => e.message).join("; "));
+	}
+
+	return response.data?.project?.issues?.nodes ?? [];
+}

package/src/tools/glab/types.ts

@@ -0,0 +1,86 @@
+// .xcsh/tools/glab/lib/types.ts
+
+export interface GlabLabel {
+	name: string;
+	color: string;
+}
+
+export interface GlabUser {
+	username: string;
+	name: string;
+}
+
+export interface GlabMilestone {
+	title: string;
+	iid: number;
+}
+
+export interface GlabNote {
+	id: number;
+	body: string;
+	author: GlabUser;
+	created_at: string;
+	updated_at: string;
+	system: boolean;
+}
+
+export interface GlabIssue {
+	id: number;
+	iid: number;
+	title: string;
+	description: string;
+	state: "opened" | "closed";
+	labels: string[];
+	assignees: GlabUser[];
+	author: GlabUser;
+	milestone: GlabMilestone | null;
+	created_at: string;
+	updated_at: string;
+	web_url: string;
+	references: { full: string };
+	issue_type: string;
+	notes?: GlabNote[];
+}
+
+export interface GlabProject {
+	id: number;
+	name: string;
+	name_with_namespace: string;
+	path_with_namespace: string;
+	web_url: string;
+	description: string | null;
+}
+
+export interface GlabConfig {
+	project: string;
+	hostname: string;
+	defaultState: "opened" | "closed" | "all";
+	perPage: number;
+}
+
+export interface GraphQLIssueNode {
+	iid: string;
+	title: string;
+	state: string;
+	labels: { nodes: Array<{ title: string }> };
+	assignees: { nodes: Array<{ username: string }> };
+	updatedAt: string;
+	notes: {
+		nodes: Array<{
+			body: string;
+			author: { username: string };
+			createdAt: string;
+		}>;
+	};
+}
+
+export interface GraphQLSearchResponse {
+	data?: {
+		project?: {
+			issues?: {
+				nodes: GraphQLIssueNode[];
+			};
+		};
+	};
+	errors?: Array<{ message: string }>;
+}

package/src/tools/glab.ts

@@ -0,0 +1,409 @@
+import type {
+	AgentTool,
+	AgentToolContext,
+	AgentToolResult,
+	AgentToolUpdateCallback,
+} from "@f5xc-salesdemos/pi-agent-core";
+import { prompt } from "@f5xc-salesdemos/pi-utils";
+import { type Static, Type } from "@sinclair/typebox";
+import glabIssueListDescription from "../prompts/tools/glab-issue-list.md" with { type: "text" };
+import glabIssueViewDescription from "../prompts/tools/glab-issue-view.md" with { type: "text" };
+import glabSearchDescription from "../prompts/tools/glab-search.md" with { type: "text" };
+import glabSetupDescription from "../prompts/tools/glab-setup.md" with { type: "text" };
+import * as git from "../utils/git";
+import type { ToolSession } from ".";
+import { loadConfig, resolveProject, saveConfig } from "./glab/config";
+import type { GlabExecApi } from "./glab/exec";
+import { checkAuth, checkInstalled, execGlabJson, GlabAuthError } from "./glab/exec";
+import { formatIssueDetail, formatIssueTable } from "./glab/formatters";
+import { executeGraphQL } from "./glab/graphql";
+import type { GlabIssue, GlabProject, GraphQLIssueNode } from "./glab/types";
+
+function makeExecApi(cwd: string): GlabExecApi {
+	return {
+		cwd,
+		async exec(command: string, args: string[], options?: { signal?: AbortSignal; cwd?: string }) {
+			const child = Bun.spawn([command, ...args], {
+				cwd: options?.cwd ?? cwd,
+				stdin: "ignore",
+				stdout: "pipe",
+				stderr: "pipe",
+				signal: options?.signal,
+			});
+			if (!child.stdout || !child.stderr) {
+				return { stdout: "", stderr: "Failed to capture output", code: 1, killed: false };
+			}
+			const [stdout, stderr, exitCode] = await Promise.all([
+				new Response(child.stdout).text(),
+				new Response(child.stderr).text(),
+				child.exited,
+			]);
+			return {
+				stdout: stdout.trim(),
+				stderr: stderr.trim(),
+				code: exitCode ?? 0,
+				killed: child.killed,
+			};
+		},
+	};
+}
+
+// ─── Schemas ─────────────────────────────────────────────────────────────
+
+const glabSetupSchema = Type.Object({
+	action: Type.Union(
+		[
+			Type.Literal("check"),
+			Type.Literal("login"),
+			Type.Literal("select_project"),
+			Type.Literal("save_project"),
+			Type.Literal("status"),
+		],
+		{ description: "Onboarding action to perform" },
+	),
+	project: Type.Optional(Type.String({ description: "Project path to persist (used with save_project)" })),
+});
+
+const glabIssueListSchema = Type.Object({
+	project: Type.Optional(
+		Type.String({ description: "GitLab project path (e.g. group/repo). Defaults to configured project." }),
+	),
+	state: Type.Optional(
+		Type.Union([Type.Literal("opened"), Type.Literal("closed"), Type.Literal("all")], {
+			description: "Filter by issue state",
+		}),
+	),
+	labels: Type.Optional(Type.Array(Type.String(), { description: "Filter by labels" })),
+	assignee: Type.Optional(Type.String({ description: "Filter by assignee username" })),
+	search: Type.Optional(Type.String({ description: "Search text in title and description" })),
+	milestone: Type.Optional(Type.String()),
+	sort: Type.Optional(
+		Type.Union(
+			[Type.Literal("created_at"), Type.Literal("updated_at"), Type.Literal("priority"), Type.Literal("due_date")],
+			{ description: "Sort field" },
+		),
+	),
+	order: Type.Optional(Type.Union([Type.Literal("asc"), Type.Literal("desc")], { description: "Sort direction" })),
+	limit: Type.Optional(Type.Number({ default: 30, maximum: 100, description: "Max results" })),
+});
+
+const glabIssueViewSchema = Type.Object({
+	issue: Type.Union([Type.Number(), Type.String()], { description: "Issue IID number or full URL" }),
+	project: Type.Optional(Type.String()),
+	comments: Type.Optional(Type.Boolean({ default: true })),
+});
+
+const glabSearchSchema = Type.Object({
+	query: Type.String({ description: "Search text to find across issue titles, descriptions, labels, and comments" }),
+	project: Type.Optional(Type.String()),
+	state: Type.Optional(
+		Type.Union([Type.Literal("opened"), Type.Literal("closed"), Type.Literal("all")], {
+			description: "Filter by issue state",
+		}),
+	),
+	labels: Type.Optional(Type.Array(Type.String())),
+	limit: Type.Optional(Type.Number({ default: 20, maximum: 100 })),
+});
+
+type GlabSetupInput = Static<typeof glabSetupSchema>;
+type GlabIssueListInput = Static<typeof glabIssueListSchema>;
+type GlabIssueViewInput = Static<typeof glabIssueViewSchema>;
+type GlabSearchInput = Static<typeof glabSearchSchema>;
+
+interface GlabToolDetails {
+	items?: GlabIssue[];
+	issue?: GlabIssue;
+	projects?: GlabProject[];
+	total?: number;
+	project?: string;
+	query?: string;
+}
+
+function textResult(text: string, details?: GlabToolDetails): AgentToolResult<GlabToolDetails> {
+	return { content: [{ type: "text", text }], details };
+}
+
+// ─── GlabSetupTool ───────────────────────────────────────────────────────
+
+export class GlabSetupTool implements AgentTool<typeof glabSetupSchema, GlabToolDetails> {
+	readonly name = "glab_setup";
+	readonly label = "GitLab Setup";
+	readonly description = prompt.render(glabSetupDescription);
+	readonly parameters = glabSetupSchema;
+
+	constructor(private readonly session: ToolSession) {}
+
+	static createIf(session: ToolSession): GlabSetupTool | null {
+		if (!git.gitlab.available()) return null;
+		return new GlabSetupTool(session);
+	}
+
+	async execute(
+		_toolCallId: string,
+		params: GlabSetupInput,
+		signal?: AbortSignal,
+		_onUpdate?: AgentToolUpdateCallback<GlabToolDetails>,
+		_context?: AgentToolContext,
+	): Promise<AgentToolResult<GlabToolDetails>> {
+		const api = makeExecApi(this.session.cwd);
+
+		switch (params.action) {
+			case "check": {
+				const installed = await checkInstalled(api);
+				if (!installed) {
+					return textResult(
+						'glab is not installed.\n\nInstall it with:\n- **macOS**: `brew install glab`\n- **Linux**: Download from https://gitlab.com/gitlab-org/cli/-/releases\n- **Windows**: `winget install gitlab.glab`\n\nAfter installing, call glab_setup with action "login" to authenticate.',
+					);
+				}
+				const ver = await api.exec("glab", ["--version"], { signal });
+				return textResult(`glab is installed: ${ver.stdout.trim()}`);
+			}
+
+			case "status": {
+				const authResult = await api.exec("glab", ["auth", "status"], { signal });
+				const config = await loadConfig(this.session.cwd);
+				const projectInfo = config?.project
+					? `\nConfigured project: ${config.project}`
+					: "\nNo project configured. Run select_project to choose one.";
+				const authStatus = authResult.code === 0 ? authResult.stdout : `Not authenticated: ${authResult.stderr}`;
+				return textResult(authStatus + projectInfo);
+			}
+
+			case "login":
+				return textResult(
+					"Starting GitLab authentication...\n\nRunning: `glab auth login --hostname gitlab.com --git-protocol https --web`\n\nYour browser will open for you to authorize access. Return here after authorizing.",
+				);
+
+			case "select_project": {
+				const authenticated = await checkAuth(api);
+				if (!authenticated) {
+					return textResult('Not authenticated. Run glab_setup with action "login" first.');
+				}
+				const projects = await execGlabJson<GlabProject[]>(
+					api,
+					["repo", "list", "--member", "--output", "json", "--per-page", "50"],
+					signal,
+				);
+				if (!projects.length) {
+					return textResult("No projects found for your account.");
+				}
+				const list = projects
+					.map((p, i) => `${i + 1}. **${p.name_with_namespace}** — \`${p.path_with_namespace}\``)
+					.join("\n");
+				return textResult(
+					`Found ${projects.length} projects:\n\n${list}\n\nWhich project do you want to use for GitLab issue tracking? Reply with the number or full path.`,
+					{ projects },
+				);
+			}
+
+			case "save_project": {
+				if (!params.project) {
+					return textResult("Error: project parameter is required for save_project action.");
+				}
+				const existing = (await loadConfig(this.session.cwd)) ?? {
+					project: "",
+					hostname: "gitlab.com",
+					defaultState: "opened" as const,
+					perPage: 30,
+				};
+				await saveConfig(this.session.cwd, { ...existing, project: params.project });
+				return textResult(`Configuration saved. Default project set to: **${params.project}**`);
+			}
+
+			default:
+				return textResult(`Unknown action: ${params.action}`);
+		}
+	}
+}
+
+// ─── GlabIssueListTool ──────────────────────────────────────────────────
+
+export class GlabIssueListTool implements AgentTool<typeof glabIssueListSchema, GlabToolDetails> {
+	readonly name = "glab_issue_list";
+	readonly label = "GitLab Issues";
+	readonly description = prompt.render(glabIssueListDescription);
+	readonly parameters = glabIssueListSchema;
+
+	constructor(private readonly session: ToolSession) {}
+
+	static createIf(session: ToolSession): GlabIssueListTool | null {
+		if (!git.gitlab.available()) return null;
+		return new GlabIssueListTool(session);
+	}
+
+	async execute(
+		_toolCallId: string,
+		params: GlabIssueListInput,
+		signal?: AbortSignal,
+		_onUpdate?: AgentToolUpdateCallback<GlabToolDetails>,
+		_context?: AgentToolContext,
+	): Promise<AgentToolResult<GlabToolDetails>> {
+		const api = makeExecApi(this.session.cwd);
+		const project = await resolveProject(params.project, this.session.cwd);
+		if (!project) {
+			return textResult("No GitLab project configured. Run glab_setup to set one up.");
+		}
+
+		const args = ["issue", "list", "--output", "json", "--repo", project];
+		if (params.state === "opened") args.push("--opened");
+		else if (params.state === "closed") args.push("--closed");
+		else if (params.state === "all") args.push("--all");
+		if (params.labels?.length) args.push("--label", params.labels.join(","));
+		if (params.assignee) args.push("--assignee", params.assignee);
+		if (params.search) args.push("--search", params.search);
+		if (params.milestone) args.push("--milestone", params.milestone);
+		if (params.sort) args.push("--order", params.sort);
+		if (params.order) args.push("--sort", params.order);
+		args.push("--per-page", String(Math.min(params.limit ?? 30, 100)));
+
+		try {
+			const issues = await execGlabJson<GlabIssue[]>(api, args, signal);
+			return textResult(formatIssueTable(issues), { items: issues, total: issues.length, project });
+		} catch (err) {
+			if (err instanceof GlabAuthError) return textResult((err as Error).message);
+			throw err;
+		}
+	}
+}
+
+// ─── GlabIssueViewTool ──────────────────────────────────────────────────
+
+export class GlabIssueViewTool implements AgentTool<typeof glabIssueViewSchema, GlabToolDetails> {
+	readonly name = "glab_issue_view";
+	readonly label = "GitLab Issue";
+	readonly description = prompt.render(glabIssueViewDescription);
+	readonly parameters = glabIssueViewSchema;
+
+	constructor(private readonly session: ToolSession) {}
+
+	static createIf(session: ToolSession): GlabIssueViewTool | null {
+		if (!git.gitlab.available()) return null;
+		return new GlabIssueViewTool(session);
+	}
+
+	async execute(
+		_toolCallId: string,
+		params: GlabIssueViewInput,
+		signal?: AbortSignal,
+		_onUpdate?: AgentToolUpdateCallback<GlabToolDetails>,
+		_context?: AgentToolContext,
+	): Promise<AgentToolResult<GlabToolDetails>> {
+		const api = makeExecApi(this.session.cwd);
+		const project = await resolveProject(params.project, this.session.cwd);
+		if (!project) {
+			return textResult("No GitLab project configured. Run glab_setup to set one up.");
+		}
+
+		const issueId = String(params.issue);
+		const args = ["issue", "view", issueId, "--output", "json", "--repo", project];
+		if (params.comments !== false) args.push("--comments");
+
+		try {
+			const issue = await execGlabJson<GlabIssue>(api, args, signal);
+			return textResult(formatIssueDetail(issue), { issue, project });
+		} catch (err) {
+			if (err instanceof GlabAuthError) return textResult((err as Error).message);
+			throw err;
+		}
+	}
+}
+
+// ─── GlabSearchTool ─────────────────────────────────────────────────────
+
+export class GlabSearchTool implements AgentTool<typeof glabSearchSchema, GlabToolDetails> {
+	readonly name = "glab_search";
+	readonly label = "GitLab Search";
+	readonly description = prompt.render(glabSearchDescription);
+	readonly parameters = glabSearchSchema;
+
+	constructor(private readonly session: ToolSession) {}
+
+	static createIf(session: ToolSession): GlabSearchTool | null {
+		if (!git.gitlab.available()) return null;
+		return new GlabSearchTool(session);
+	}
+
+	async execute(
+		_toolCallId: string,
+		params: GlabSearchInput,
+		signal?: AbortSignal,
+		_onUpdate?: AgentToolUpdateCallback<GlabToolDetails>,
+		_context?: AgentToolContext,
+	): Promise<AgentToolResult<GlabToolDetails>> {
+		const api = makeExecApi(this.session.cwd);
+		const project = await resolveProject(params.project, this.session.cwd);
+		if (!project) {
+			return textResult("No GitLab project configured. Run glab_setup to set one up.");
+		}
+
+		const limit = Math.min(params.limit ?? 20, 100);
+		let issues: GlabIssue[] = [];
+
+		const restArgs = [
+			"issue",
+			"list",
+			"--output",
+			"json",
+			"--repo",
+			project,
+			"--search",
+			params.query,
+			"--per-page",
+			String(limit),
+		];
+		if (params.state === "opened") restArgs.push("--opened");
+		else if (params.state === "closed") restArgs.push("--closed");
+		else if (params.state === "all") restArgs.push("--all");
+		if (params.labels?.length) restArgs.push("--label", params.labels.join(","));
+
+		try {
+			issues = await execGlabJson<GlabIssue[]>(api, restArgs, signal);
+		} catch (err) {
+			if (err instanceof GlabAuthError) return textResult((err as Error).message);
+		}
+
+		let graphqlNodes: GraphQLIssueNode[] = [];
+		try {
+			graphqlNodes = await executeGraphQL(api, project, params.query, limit, signal, params.state);
+		} catch {
+			// GraphQL unavailable — use REST results only
+		}
+
+		if (graphqlNodes.length > 0) {
+			const seenIids = new Set(issues.map(i => i.iid));
+			for (const node of graphqlNodes) {
+				const iid = parseInt(node.iid, 10);
+				if (seenIids.has(iid)) continue;
+				seenIids.add(iid);
+				const lowerQuery = params.query.toLowerCase();
+				const inTitle = node.title.toLowerCase().includes(lowerQuery);
+				const inComments = node.notes.nodes.some(n => n.body.toLowerCase().includes(lowerQuery));
+				if (inTitle || inComments) {
+					issues.push({
+						id: iid,
+						iid,
+						title: node.title,
+						description: "",
+						state: node.state === "OPEN" ? "opened" : "closed",
+						labels: node.labels.nodes.map(l => l.title),
+						assignees: node.assignees.nodes.map(a => ({ username: a.username, name: a.username })),
+						author: { username: "", name: "" },
+						milestone: null,
+						created_at: node.updatedAt,
+						updated_at: node.updatedAt,
+						web_url: `https://gitlab.com/${project}/-/issues/${iid}`,
+						references: { full: `${project}#${iid}` },
+						issue_type: "issue",
+					});
+				}
+			}
+		}
+
+		return textResult(formatIssueTable(issues), {
+			items: issues,
+			total: issues.length,
+			project,
+			query: params.query,
+		});
+	}
+}

package/src/tools/index.ts

@@ -40,6 +40,7 @@ import {
 	GhSearchIssuesTool,
 	GhSearchPrsTool,
 } from "./gh";
+import { GlabIssueListTool, GlabIssueViewTool, GlabSearchTool, GlabSetupTool } from "./glab";
 import { GrepTool } from "./grep";
 import { InspectImageTool } from "./inspect-image";
 import { NotebookTool } from "./notebook";
@@ -80,6 +81,7 @@ export * from "./exit-plan-mode";
 export * from "./find";
 export * from "./gemini-image";
 export * from "./gh";
+export * from "./glab";
 export * from "./grep";
 export * from "./inspect-image";
 export * from "./notebook";
@@ -229,6 +231,10 @@ export const BUILTIN_TOOLS: Record<string, ToolFactory> = {
 	gh_run_watch: GhRunWatchTool.createIf,
 	gh_search_issues: GhSearchIssuesTool.createIf,
 	gh_search_prs: GhSearchPrsTool.createIf,
+	glab_setup: GlabSetupTool.createIf,
+	glab_issue_list: GlabIssueListTool.createIf,
+	glab_issue_view: GlabIssueViewTool.createIf,
+	glab_search: GlabSearchTool.createIf,
 	find: s => new FindTool(s),
 	grep: s => new GrepTool(s),
 	lsp: LspTool.createIf,
@@ -398,6 +404,7 @@ export async function createTools(session: ToolSession, toolNames?: string[]): P
 		if (name === "find") return session.settings.get("find.enabled");
 		if (name === "grep") return session.settings.get("grep.enabled");
 		if (name.startsWith("gh_")) return session.settings.get("github.enabled");
+		if (name.startsWith("glab_")) return session.settings.get("gitlab.enabled");
 		if (name === "ast_grep") return session.settings.get("astGrep.enabled");
 		if (name === "ast_edit") return session.settings.get("astEdit.enabled");
 		if (name === "render_mermaid") return session.settings.get("renderMermaid.enabled");

package/src/tools/xcsh-api.ts

@@ -25,6 +25,7 @@ export interface XcshApiToolDetails {
 	status: number;
 	url: string;
 	method: string;
+	requestId: string;
 }
 
 type XcshApiResult = AgentToolResult<XcshApiToolDetails> & { isError?: boolean };
@@ -35,21 +36,31 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 	readonly description: string;
 	readonly parameters = xcshApiSchema;
 
+	#apiBase: string;
+	#apiToken: string;
+
 	constructor(_session: ToolSession) {
 		this.description = prompt.render(xcshApiDescription);
+		this.#apiBase = (process.env.F5XC_API_URL ?? "").replace(/\/+$/, "");
+		this.#apiToken = process.env.F5XC_API_TOKEN ?? "";
+
+		if (this.#apiBase && this.#apiToken) {
+			fetch(`${this.#apiBase}/api/web/namespaces`, {
+				method: "HEAD",
+				headers: { Authorization: `APIToken ${this.#apiToken}` },
+			}).catch(() => {});
+		}
 	}
 
 	async execute(_toolCallId: string, params: XcshApiParams): Promise<XcshApiResult> {
-		const apiUrl = process.env.F5XC_API_URL;
-		if (!apiUrl) {
+		if (!this.#apiBase) {
 			return {
 				content: [{ type: "text", text: "Error: F5XC_API_URL environment variable is not set." }],
 				isError: true,
 			};
 		}
 
-		const apiToken = process.env.F5XC_API_TOKEN;
-		if (!apiToken) {
+		if (!this.#apiToken) {
 			return {
 				content: [{ type: "text", text: "Error: F5XC_API_TOKEN environment variable is not set." }],
 				isError: true,
@@ -63,13 +74,19 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 			}
 		}
 
-		const url = `${apiUrl.replace(/\/+$/, "")}${resolvedPath}`;
+		const url = `${this.#apiBase}${resolvedPath}`;
+		const requestId = crypto.randomUUID();
 		const headers: Record<string, string> = {
-			Authorization: `APIToken ${apiToken}`,
+			Authorization: `APIToken ${this.#apiToken}`,
 			Accept: "application/json",
+			"X-Request-ID": requestId,
 		};
 
-		const init: RequestInit = { method: params.method, headers };
+		const init: RequestInit = {
+			method: params.method,
+			headers,
+			signal: AbortSignal.timeout(30_000),
+		};
 
 		if (params.payload && params.method !== "GET") {
 			headers["Content-Type"] = "application/json";
@@ -78,21 +95,12 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 
 		try {
 			const response = await fetch(url, init);
-			const contentType = response.headers.get("content-type") ?? "";
-			let bodyText: string;
-
-			if (contentType.includes("application/json")) {
-				const json = await response.json();
-				bodyText = JSON.stringify(json, null, 2);
-			} else {
-				bodyText = await response.text();
-			}
-
+			const bodyText = await response.text();
 			const statusLine = `${response.status} ${response.statusText}`;
 
 			return {
 				content: [{ type: "text", text: `${statusLine}\n\n${bodyText}` }],
-				details: { status: response.status, url, method: params.method },
+				details: { status: response.status, url, method: params.method, requestId },
 				...(response.status >= 400 ? { isError: true } : {}),
 			};
 		} catch (err) {

package/src/utils/git.ts

@@ -1421,3 +1421,13 @@ export const github = {
 		return result.stdout;
 	},
 };
+
+// ════════════════════════════════════════════════════════════════════════════
+// API: gitlab (GitLab CLI — glab)
+// ════════════════════════════════════════════════════════════════════════════
+
+export const gitlab = {
+	available(): boolean {
+		return Boolean($which("glab"));
+	},
+};