@gaodes/pi-gitlab 0.3.0

package/src/tools/gitlab_force_push_safe.ts

@@ -0,0 +1,246 @@
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { requireConfirm } from "../lib/confirm.js";
+import { loadConfig } from "../config/loader.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { spawn } from "node:child_process";
+
+export function registerGitlabForcePushSafe(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_force_push_safe",
+		label: "Force Push (Safe)",
+		description:
+			"Force-push a branch after safety checks: verifies protected branch status, pauses for protection removal if needed, then re-protects after push. Requires confirmation.",
+		parameters: Type.Object(
+			{
+				remote: Type.Optional(
+					Type.String({
+						default: "origin",
+						description: "Git remote name.",
+					}),
+				),
+				branch: Type.String({
+					description: "Local branch name to push.",
+				}),
+				remoteBranch: Type.Optional(
+					Type.String({
+						description:
+							"Remote branch name. Defaults to same as local branch.",
+					}),
+				),
+				confirm: Type.Optional(Type.Boolean({ default: false })),
+				dryRun: Type.Optional(Type.Boolean({ default: false })),
+			},
+			{ additionalProperties: false },
+		),
+		async execute(
+			_toolCallId,
+			params,
+			_signal,
+			_onUpdate,
+			ctx: ExtensionContext,
+		) {
+			try {
+				requireSetup(ctx.cwd);
+			} catch {
+				return setupRequiredResult();
+			}
+
+			const config = loadConfig(ctx.cwd);
+			const remote = params.remote ?? "origin";
+			const remoteBranch = params.remoteBranch ?? params.branch;
+
+			let projectId: number;
+			try {
+				const projectPath = await resolveProject(undefined, ctx.cwd);
+				projectId = await resolveProjectId(projectPath);
+			} catch (err) {
+				return {
+					content: [
+						{
+							type: "text",
+							text: `❌ Could not resolve project ID for branch protection checks: ${String(err instanceof Error ? err.message : err)}`,
+						},
+					],
+					details: { success: false, error: "project_resolution_failed" },
+				};
+			}
+
+			// Step 1: Check protected branches
+			let isProtected = false;
+			try {
+				await glab(
+					[
+						"api",
+						`projects/${projectId}/protected_branches/${encodeURIComponent(remoteBranch)}`,
+					],
+					ctx.cwd,
+				);
+				isProtected = true;
+			} catch {
+				// Not protected or API error — treat as unprotected
+			}
+
+			const reprotectionNote = isProtected
+				? `\n⚠️ Branch \`${remoteBranch}\` is **protected**. Will temporarily unprotect, force-push, then re-protect.`
+				: "";
+
+			const preview =
+				`Force-push \`${params.branch}\` to \`${remote}/${remoteBranch}\`` +
+				reprotectionNote;
+
+			const blocked = requireConfirm(preview, {
+				confirm: params.confirm,
+				dryRun: params.dryRun,
+			});
+			if (blocked) return blocked;
+
+			// Step 2: Temporarily unprotect if needed
+			if (isProtected) {
+				try {
+					await glab(
+						[
+							"api",
+							"-X",
+							"DELETE",
+							`projects/${projectId}/protected_branches/${encodeURIComponent(remoteBranch)}`,
+						],
+						ctx.cwd,
+					);
+				} catch (err) {
+					return {
+						content: [
+							{
+								type: "text",
+								text: `❌ Failed to unprotect branch \`${remoteBranch}\`: ${String(err instanceof Error ? err.message : err)}\n\nManual unprotection required before force-push.`,
+							},
+						],
+						details: { success: false, error: "unprotect_failed" },
+					};
+				}
+			}
+
+			// Step 3: Force push
+			try {
+				await runGitPush(
+					["push", "--force-with-lease", remote, `${params.branch}:${remoteBranch}`],
+					ctx.cwd,
+				);
+			} catch (err) {
+				// Attempt re-protection even if push fails
+				if (isProtected) {
+					await reprotectBranch(
+						ctx.cwd,
+						projectId,
+						remoteBranch,
+						config.safety.forcePushReprotectAlways,
+					);
+				}
+				return {
+					content: [
+						{
+							type: "text",
+							text: `❌ Force-push failed: ${String(err instanceof Error ? err.message : err)}`,
+						},
+					],
+					details: { success: false, error: "push_failed" },
+				};
+			}
+
+			// Step 4: Re-protect if we unprotected
+			if (isProtected) {
+				const reprotectionOk = await reprotectBranch(
+					ctx.cwd,
+					projectId,
+					remoteBranch,
+					config.safety.forcePushReprotectAlways,
+				);
+				if (!reprotectionOk) {
+					return {
+						content: [
+							{
+								type: "text",
+								text: `✅ Force-push succeeded, but **re-protection failed** for \`${remoteBranch}\`. Manually re-protect this branch.`,
+							},
+						],
+						details: {
+							success: true,
+							warning: "reprotection_failed",
+							branch: remoteBranch,
+						},
+					};
+				}
+			}
+
+			return {
+				content: [
+					{
+						type: "text",
+						text: `✅ Force-push complete: \`${params.branch}\` → \`${remote}/${remoteBranch}\`${isProtected ? "\nBranch re-protected." : ""}`,
+					},
+				],
+				details: { success: true, branch: remoteBranch, wasProtected: isProtected },
+			};
+		},
+	});
+}
+
+async function reprotectBranch(
+	cwd: string | undefined,
+	projectId: number,
+	branch: string,
+	alwaysReprotect: boolean,
+): Promise<boolean> {
+	if (!alwaysReprotect) return true;
+
+	try {
+		await glab(
+			[
+				"api",
+				"-X",
+				"POST",
+				`projects/${projectId}/protected_branches`,
+				"-f",
+				`name=${branch}`,
+				"-f",
+				"push_access_level=30",
+				"-f",
+				"merge_access_level=30",
+			],
+			cwd,
+		);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+async function runGitPush(
+	args: string[],
+	cwd?: string,
+): Promise<void> {
+	await new Promise<void>((resolve, reject) => {
+		const child = spawn("git", args, {
+			cwd,
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		let stderr = "";
+		child.stderr.on("data", (d) => {
+			stderr += String(d);
+		});
+		child.on("error", reject);
+		child.on("close", (code) => {
+			if (code === 0) {
+				resolve();
+				return;
+			}
+			reject(new Error(stderr.trim() || `git push exited with code ${code ?? -1}`));
+		});
+	});
+}

package/src/tools/gitlab_issue_close.ts

@@ -0,0 +1,64 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { requireConfirm } from "../lib/confirm.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { OptionalProject } from "../lib/schemas.js";
+
+export function registerGitlabIssueClose(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_issue_close",
+		label: "Close Issue",
+		description: "Close an open issue. Requires confirmation.",
+		parameters: Type.Object(
+			{
+				project: OptionalProject,
+				issueId: Type.Number({ description: "Issue IID" }),
+				confirm: Type.Optional(Type.Boolean({ default: false })),
+				dryRun: Type.Optional(Type.Boolean({ default: false })),
+			},
+			{ additionalProperties: false },
+		),
+		async execute(_toolCallId, params, _signal, _onUpdate, ctx: ExtensionContext) {
+			try {
+				requireSetup(ctx.cwd);
+			} catch {
+				return setupRequiredResult();
+			}
+
+			const cwd = ctx.cwd;
+			const projectPath = await resolveProject(params.project, cwd);
+			const projectId = await resolveProjectId(projectPath);
+
+			const issue = (await glab([
+				"api",
+				`projects/${projectId}/issues/${params.issueId}`,
+			])) as Record<string, unknown>;
+
+			const preview = `Close issue #${params.issueId}: **${issue.title}**\nProject: \`${projectPath}\``;
+			const blocked = requireConfirm(preview, { confirm: params.confirm, dryRun: params.dryRun });
+			if (blocked) return blocked;
+
+			const result = await glab([
+				"api",
+				"-X",
+				"PUT",
+				`projects/${projectId}/issues/${params.issueId}`,
+				"-f",
+				"state_event=close",
+			]);
+
+			return {
+				content: [
+					{
+						type: "text",
+						text: `✅ Issue #${params.issueId} closed\n${(result as Record<string, unknown>).web_url ?? ""}`,
+					},
+				],
+				details: { success: true, issue: result },
+			};
+		},
+	});
+}

package/src/tools/gitlab_issue_create.ts

@@ -0,0 +1,71 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { requireConfirm } from "../lib/confirm.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { OptionalProject } from "../lib/schemas.js";
+
+export function registerGitlabIssueCreate(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_issue_create",
+		label: "Create Issue",
+		description: "Create a new issue. Requires confirmation.",
+		parameters: Type.Object(
+			{
+				project: OptionalProject,
+				title: Type.String({ description: "Issue title" }),
+				description: Type.Optional(Type.String({ description: "Issue description" })),
+				labels: Type.Optional(Type.Array(Type.String())),
+				assignee: Type.Optional(Type.String()),
+				milestone: Type.Optional(Type.String()),
+				confidential: Type.Optional(Type.Boolean({ default: false })),
+				confirm: Type.Optional(Type.Boolean({ default: false })),
+				dryRun: Type.Optional(Type.Boolean({ default: false })),
+			},
+			{ additionalProperties: false },
+		),
+		async execute(_toolCallId, params, _signal, _onUpdate, ctx: ExtensionContext) {
+			try {
+				requireSetup(ctx.cwd);
+			} catch {
+				return setupRequiredResult();
+			}
+
+			const cwd = ctx.cwd;
+			const projectPath = await resolveProject(params.project, cwd);
+			const projectId = await resolveProjectId(projectPath);
+
+			const preview = `Create issue **${params.title}**\nProject: \`${projectPath}\`${params.labels?.length ? `\nLabels: ${params.labels.join(", ")}` : ""}`;
+			const blocked = requireConfirm(preview, { confirm: params.confirm, dryRun: params.dryRun });
+			if (blocked) return blocked;
+
+			const body: Record<string, unknown> = { title: params.title };
+			if (params.description) body.description = params.description;
+			if (params.labels?.length) body.labels = params.labels.join(",");
+			if (params.assignee) body.assignee_ids = params.assignee;
+			if (params.milestone) body.milestone_id = params.milestone;
+			if (params.confidential) body.confidential = true;
+
+			const result = await glab([
+				"api",
+				"-X",
+				"POST",
+				`projects/${projectId}/issues`,
+				...Object.entries(body).flatMap(([k, v]) => ["-f", `${k}=${v}`]),
+			]);
+
+			const issue = result as Record<string, unknown>;
+			return {
+				content: [
+					{
+						type: "text",
+						text: `✅ Issue created: #${issue.iid} — ${issue.title}\n${issue.web_url ?? ""}`,
+					},
+				],
+				details: { success: true, issue },
+			};
+		},
+	});
+}

package/src/tools/gitlab_issue_list.ts

@@ -0,0 +1,110 @@
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { limitRows } from "../lib/pagination.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { MaxRows, OptionalProject } from "../lib/schemas.js";
+
+interface Issue {
+	iid: number;
+	title: string;
+	state: string;
+	author?: { name?: string };
+	labels?: string[];
+	milestone?: { title?: string };
+	confidential?: boolean;
+}
+
+export function registerGitlabIssueList(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_issue_list",
+		label: "List Issues",
+		description: "List GitLab issues with optional filters.",
+		parameters: Type.Object(
+			{
+				project: OptionalProject,
+				state: Type.Optional(
+					Type.Union(
+						[
+							Type.Literal("opened"),
+							Type.Literal("closed"),
+							Type.Literal("all"),
+						],
+						{ default: "opened" },
+					),
+				),
+				labels: Type.Optional(Type.Array(Type.String())),
+				milestone: Type.Optional(Type.String()),
+				author: Type.Optional(Type.String()),
+				assignee: Type.Optional(Type.String()),
+				confidential: Type.Optional(Type.Boolean()),
+				search: Type.Optional(Type.String()),
+				maxRows: MaxRows,
+			},
+			{ additionalProperties: false },
+		),
+		async execute(
+			_toolCallId,
+			params,
+			_signal,
+			_onUpdate,
+			ctx: ExtensionContext,
+		) {
+			try {
+					requireSetup(ctx.cwd);
+				} catch {
+					return setupRequiredResult();
+				}
+
+				const projectPath = await resolveProject(params.project, ctx.cwd);
+			const projectId = await resolveProjectId(projectPath);
+
+			const query = new URLSearchParams();
+			query.set("state", params.state ?? "opened");
+			if (params.labels?.length) query.set("labels", params.labels.join(","));
+			if (params.milestone) query.set("milestone_title", params.milestone);
+			if (params.author) query.set("author_username", params.author);
+			if (params.assignee) query.set("assignee_username", params.assignee);
+			if (params.confidential !== undefined)
+				query.set("confidential", String(params.confidential));
+			if (params.search) query.set("search", params.search);
+			query.set("per_page", "100");
+
+			const issues = (await glab([
+				"api",
+				"--paginate",
+				`projects/${projectId}/issues?${query.toString()}`,
+			])) as Issue[];
+
+			const limited = limitRows(issues, params.maxRows ?? 25);
+			if (limited.length === 0) {
+				return {
+					content: [{ type: "text", text: "No issues found." }],
+					details: { success: true, count: 0, issues: [] },
+				};
+			}
+
+			const lines = [
+				"| IID | Title | State | Author | Labels | Milestone |",
+				"|---|---|---|---|---|---|",
+			];
+			for (const issue of limited) {
+				const labels = issue.labels?.join(", ") ?? "-";
+				const milestone = issue.milestone?.title ?? "-";
+				lines.push(
+					`| ${issue.iid} | ${issue.title}${issue.confidential ? " 🔒" : ""} | ${issue.state} | ${issue.author?.name ?? "-"} | ${labels} | ${milestone} |`,
+				);
+			}
+
+			return {
+				content: [{ type: "text", text: lines.join("\n") }],
+				details: { success: true, count: limited.length, issues: limited },
+			};
+		},
+	});
+}

package/src/tools/gitlab_job_logs.ts

@@ -0,0 +1,89 @@
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { redact } from "../lib/redact.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { OptionalProject } from "../lib/schemas.js";
+
+export function registerGitlabJobLogs(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_job_logs",
+		label: "Job Logs",
+		description:
+			"Fetch CI job log output. Redacts common secret patterns by default and truncates to the tail.",
+		parameters: Type.Object(
+			{
+				project: OptionalProject,
+				jobId: Type.Number(),
+				tail: Type.Optional(Type.Number({ default: 200, maximum: 5000 })),
+				redact: Type.Optional(
+					Type.Boolean({
+						default: true,
+						description:
+							"Disable to view raw logs for debugging. Use with care.",
+					}),
+				),
+			},
+			{ additionalProperties: false },
+		),
+		async execute(
+			_toolCallId,
+			params,
+			_signal,
+			_onUpdate,
+			ctx: ExtensionContext,
+		) {
+			try {
+					requireSetup(ctx.cwd);
+				} catch {
+					return setupRequiredResult();
+				}
+
+				const projectPath = await resolveProject(params.project, ctx.cwd);
+			const projectId = await resolveProjectId(projectPath);
+
+			const logText = (await glab([
+				"api",
+				`projects/${projectId}/jobs/${params.jobId}/trace`,
+			])) as string;
+
+			const tailCount = params.tail ?? 200;
+			const lines = logText.split("\n");
+			const tailLines = lines.slice(-tailCount);
+			let output = tailLines.join("\n");
+
+			if (params.redact !== false) {
+				output = redact(output);
+			}
+
+			return {
+				content: [
+					{
+						type: "text",
+						text:
+							"```text\n" +
+							output +
+							"\n```\n\n*Showing last " +
+							tailLines.length +
+							" of " +
+							lines.length +
+							" lines" +
+							(params.redact !== false ? " (redacted)" : "") +
+							"*",
+					},
+				],
+				details: {
+					success: true,
+					jobId: params.jobId,
+					lines: tailLines.length,
+					total: lines.length,
+				},
+			};
+		},
+	});
+}

package/src/tools/gitlab_mr_bulk_approve.ts

@@ -0,0 +1,109 @@
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { requireSetup, setupRequiredResult } from "../lib/errors.js";
+import { glab } from "../lib/glab.js";
+import { requireConfirm } from "../lib/confirm.js";
+import { resolveProject } from "../lib/projectFallback.js";
+import { resolveProjectId } from "../lib/resolveProjectId.js";
+import { OptionalProject } from "../lib/schemas.js";
+
+interface BulkResult {
+	mrIid: number;
+	success: boolean;
+	message: string;
+}
+
+export function registerGitlabMrBulkApprove(pi: ExtensionAPI) {
+	pi.registerTool({
+		name: "gitlab_mr_bulk_approve",
+		label: "Bulk Approve MRs",
+		description:
+			"Approve multiple merge requests in a single operation. Requires confirmation.",
+		parameters: Type.Object(
+			{
+				project: OptionalProject,
+				mrIds: Type.Array(Type.Number(), {
+					description: "List of MR IIDs to approve",
+					minItems: 1,
+				}),
+				confirm: Type.Optional(Type.Boolean({ default: false })),
+				dryRun: Type.Optional(Type.Boolean({ default: false })),
+			},
+			{ additionalProperties: false },
+		),
+		async execute(
+			_toolCallId,
+			params,
+			_signal,
+			_onUpdate,
+			ctx: ExtensionContext,
+		) {
+			try {
+				requireSetup(ctx.cwd);
+			} catch {
+				return setupRequiredResult();
+			}
+
+			const projectPath = await resolveProject(params.project, ctx.cwd);
+			const projectId = await resolveProjectId(projectPath);
+
+			const preview = `Approve ${params.mrIds.length} MR(s) in \`${projectPath}\`\nMRs: ${params.mrIds.map((id) => `!${id}`).join(", ")}`;
+			const blocked = requireConfirm(preview, {
+				confirm: params.confirm,
+				dryRun: params.dryRun,
+			});
+			if (blocked) return blocked;
+
+			const results: BulkResult[] = [];
+			for (const mrId of params.mrIds) {
+				try {
+					await glab([
+						"api",
+						"-X",
+						"POST",
+						`projects/${projectId}/merge_requests/${mrId}/approve`,
+					]);
+					results.push({
+						mrIid: mrId,
+						success: true,
+						message: "approved",
+					});
+				} catch (err) {
+					results.push({
+						mrIid: mrId,
+						success: false,
+						message: String(err instanceof Error ? err.message : err),
+					});
+				}
+			}
+
+			const succeeded = results.filter((r) => r.success);
+			const failed = results.filter((r) => !r.success);
+
+			const lines: string[] = [];
+			if (succeeded.length > 0) {
+				lines.push(`✅ Approved ${succeeded.length} MR(s): ${succeeded.map((r) => `!${r.mrIid}`).join(", ")}`);
+			}
+			if (failed.length > 0) {
+				lines.push(`\n❌ Failed ${failed.length}:`);
+				for (const f of failed) {
+					lines.push(`  - !${f.mrIid}: ${f.message}`);
+				}
+			}
+
+			return {
+				content: [{ type: "text", text: lines.join("\n") }],
+				details: {
+					success: failed.length === 0,
+					total: params.mrIds.length,
+					approved: succeeded.length,
+					failed: failed.length,
+					results,
+				},
+			};
+		},
+	});
+}