@gitkraken/core-gitlens 0.3.0 → 0.4.0

package/src/plus/agents/types.ts

@@ -135,22 +135,46 @@ export interface AgentSession {
 	 *  identity. For "what repo is this session in", use {@link commonPath}. */
 	readonly workspacePath?: string;
 	readonly cwd?: string;
+	/** The session's `cwd` at first observation. Set once and never overwritten — captures the
+	 *  agent's launch directory so consumers can detect drift (e.g. an agent that `cd`'d into a
+	 *  sibling worktree). Pairs with {@link initialWorktreePath} / {@link initialCommonPath}; for
+	 *  the live cwd, see {@link cwd}. */
+	readonly initialCwd?: string;
+	/** The session's `worktreePath` at first successful git-info resolution. Set once and never
+	 *  overwritten — compare against {@link worktreePath} to detect cross-worktree drift. Undefined
+	 *  if the session has never resolved into a git repo. */
+	readonly initialWorktreePath?: string;
+	/** The session's `commonPath` at first successful git-info resolution. Set once and never
+	 *  overwritten — compare against {@link commonPath} to detect cross-repo drift. Undefined if
+	 *  the session has never resolved into a git repo. */
+	readonly initialCommonPath?: string;
 	readonly planFile?: string;
 	readonly isInWorkspace: boolean;
 	readonly lastPrompt?: string;
 	readonly firstPrompt?: string;
-	/** Absolute paths of files targeted by in-flight file-editing tool calls (Edit/Write/MultiEdit/
-	 *  NotebookEdit). Populated on PreToolUse, drained on PostToolUse/PermissionDenied, cleared on
-	 *  Stop/SessionEnd. Empty/undefined when no file-editing tool is active.
+	/** Per-file activity record covering both read-class (Read/NotebookRead) and edit-class
+	 *  (Edit/Write/MultiEdit/NotebookEdit) tool calls. Populated on PreToolUse; each path is retained
+	 *  and fades for the configured decay window measured from its own last PostToolUse — the tail
+	 *  survives the turn-end Stop (which only drops the live `editing`/`reading` flags) and is fully
+	 *  cleared only on SessionEnd or once the decay window elapses.
 	 *
-	 *  Mutable array form so `Shape<AgentSession>` projects it as `string[]` (the `Shape<>` type
-	 *  mangles `readonly T[]` into a mapped object that loses its iterator). Treat as immutable. */
-	currentFiles?: string[];
-	/** Absolute paths of files the agent recently *read* (Read/NotebookRead). Populated on
-	 *  PreToolUse, drained on PostToolUse/PermissionDenied with the same cooldown as
-	 *  `currentFiles`. Distinct from `currentFiles` which tracks write-class tools so consumers can
-	 *  visualize "looking at" vs "working on" differently. Treat as immutable. */
-	currentReads?: string[];
+	 *  A sub-agent's file activity appears on its PARENT's `fileActivity`, not the sub-agent's own:
+	 *  the GK CLI keys a sub-agent's tool events under the parent session id (with `agentId` set), so
+	 *  they accumulate in the parent's bookkeeping directly. Consumers never need to recurse into
+	 *  `subagents[]`; sub-agent `AgentSession` objects carry `fileActivity: undefined`.
+	 *
+	 *  Field semantics:
+	 *  - `path`: absolute path on the agent's filesystem.
+	 *  - `readAt` / `editedAt`: milliseconds since the last PreToolUse for that kind, computed by
+	 *    the host at serialization time (relative — avoids clock-skew). Omitted when never touched
+	 *    by that kind within the window.
+	 *  - `reading` / `editing`: `true` when at least one tool of that kind is in flight on this
+	 *    path right now (refcount > 0 in the host bookkeeping). Omitted when false to keep the
+	 *    wire minimal.
+	 *
+	 *  Mutable array form so `Shape<AgentSession>` projects it cleanly (the `Shape<>` type mangles
+	 *  `readonly T[]` into a mapped object that loses its iterator). Treat as immutable. */
+	fileActivity?: { path: string; readAt?: number; editedAt?: number; reading?: true; editing?: true }[];
 	/** `true` when the session was discovered via peer IPC sync (i.e. another GitLens window hosts
 	 *  the agent's hook flow and Claude Code extension panel). Locally-owned sessions leave this
 	 *  unset. The dispatcher uses this to route opens through the peer's IPC route + an OS-level
@@ -186,6 +210,11 @@ export interface AgentSessionProvider extends UnifiedDisposable {
 	stop(): void;
 	updateWorkspacePaths?(workspacePaths: string[]): void;
 
+	/** Pushed by the host from its cached agent detection. Lets the provider gate its reconciliation
+	 *  poll (the CLI `list-sessions` call) so an idle window with no sessions and no installed hooks
+	 *  doesn't spawn the CLI every interval. */
+	setClaudeHooksInstalled?(installed: boolean): void;
+
 	/** Resolves a pending permission. Returns `true` when the resolve was routed (the local IPC
 	 *  owns the session's pending entry); `false` when no local entry exists (typically a peer-
 	 *  discovered session owned by another GitLens window). Callers use this to give the user
@@ -231,6 +260,13 @@ export interface AgentProviderCallbacks {
 	/** Host-supplied IPC service. Required for agents to receive hook events from the GK CLI. */
 	ipc: IpcRegistrar;
 
+	/** Returns the current "activity decay" window in milliseconds — the cooldown between a tool
+	 *  call finishing and the file being dropped from `AgentSession.fileActivity`. Optional — when
+	 *  omitted the provider falls back to its built-in default (5 min). Read by the provider at
+	 *  schedule time so changes to the host setting take effect on the next tool call without
+	 *  needing a re-wiring step. */
+	getActivityDecayMs?(): number;
+
 	/** Report that an agent session started. No-op if the host has no telemetry. */
 	onSessionStarted?(provider: string): void;
 
@@ -240,6 +276,18 @@ export interface AgentProviderCallbacks {
 	/** Report that a permission request was resolved. No-op if the host has no telemetry. */
 	onPermissionResolved?(info: { provider: string; tool: string; decision: PermissionDecision }): void;
 
+	/** Report that a reconciliation poll found the polled session set drift from what the live IPC
+	 *  path had already tracked — `discovered` sessions the poll saw but we weren't tracking,
+	 *  `missing` sessions we track that the poll no longer reports alive. Ideally always zero. No-op
+	 *  if the host has no telemetry. */
+	onSyncDiscrepancy?(info: {
+		provider: string;
+		discovered: number;
+		missing: number;
+		polled: number;
+		tracked: number;
+	}): void;
+
 	/** Notify the host that a branch has agent activity. */
 	onBranchAgentActivity?(cwd: string): void;
 

package/src/plus/ai/models/model.ts

@@ -28,6 +28,7 @@ export type AIActionType =
 	| 'generate-changelog'
 	| `generate-create-${'cloudPatch' | 'codeSuggestion' | 'pullRequest'}`
 	| 'generate-commits'
+	| 'conflict-resolution'
 	| 'generate-searchQuery';
 
 export interface AIProviderDescriptor<T extends AIProviders = AIProviders> {

package/src/plus/ai/models/provider.ts

@@ -47,6 +47,12 @@ export interface AIProvider<Provider extends AIProviders = AIProviders> extends
 		model: AIModel<Provider>,
 		apiKey: string,
 		getMessages: (maxInputTokens: number, retries: number) => Promise<AIChatMessage[]>,
-		options: { signal: AbortSignal; modelOptions?: { outputTokens?: number; temperature?: number } },
+		options: {
+			signal: AbortSignal;
+			modelOptions?: { outputTokens?: number; temperature?: number };
+			/** Opaque session ID the GitKraken provider sends as `GK-Conversation-ID` so the backend
+			 *  charges its per-feature fee once per session; ignored by all other providers. */
+			conversationId?: string;
+		},
 	): Promise<AIProviderResponse<void> | undefined>;
 }

package/src/plus/ai/providers/gitkrakenProvider.ts

@@ -87,11 +87,15 @@ export class GitKrakenProvider extends OpenAICompatibleProviderBase<typeof provi
 		apiKey: string,
 		_model: AIModel<typeof provider.id>,
 		_url: string,
+		conversationId?: string,
 	): Record<string, string> {
 		return {
 			Accept: 'application/json',
 			Authorization: `Bearer ${apiKey}`,
 			'GK-Action': action,
+			// Scopes the backend's once-per-conversation feature fee — without it every request in a
+			// multi-call session (e.g. conflict resolution) is charged the full flat fee.
+			...(conversationId ? { 'GK-Conversation-ID': conversationId } : {}),
 		};
 	}
 

package/src/plus/ai/providers/openAICompatibleProviderBase.ts

@@ -61,6 +61,9 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 		apiKey: string,
 		_model: AIModel<T>,
 		_url: string,
+		// Deliberately unused here: only the GitKraken provider forwards the conversation ID (as
+		// `GK-Conversation-ID`); it must never reach third-party APIs.
+		_conversationId?: string,
 	): Record<string, string> | Promise<Record<string, string>> {
 		return {
 			Accept: 'application/json',
@@ -74,12 +77,24 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 		model: AIModel<T>,
 		apiKey: string,
 		getMessages: (maxInputTokens: number, retries: number) => Promise<AIChatMessage[]>,
-		options: { signal: AbortSignal; modelOptions?: { outputTokens?: number; temperature?: number } },
+		options: {
+			signal: AbortSignal;
+			modelOptions?: { outputTokens?: number; temperature?: number };
+			conversationId?: string;
+		},
 	): Promise<AIProviderResponse<void> | undefined> {
 		using scope = maybeStartScopedLogger(`${getLoggableName(this)}.sendRequest`);
 
 		try {
-			const result = await this.fetch(action, model, apiKey, getMessages, options.modelOptions, options.signal);
+			const result = await this.fetch(
+				action,
+				model,
+				apiKey,
+				getMessages,
+				options.modelOptions,
+				options.signal,
+				options.conversationId,
+			);
 			return result;
 		} catch (ex) {
 			if (isCancellationError(ex)) {
@@ -104,6 +119,7 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 		messages: (maxInputTokens: number, retries: number) => Promise<AIChatMessage[]>,
 		modelOptions?: { outputTokens?: number; temperature?: number },
 		signal?: AbortSignal,
+		conversationId?: string,
 	): Promise<AIProviderResponse<void>> {
 		let retries = 0;
 		let maxInputTokens = model.maxTokens.input;
@@ -123,7 +139,7 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 				),
 			};
 
-			const rsp = await this.fetchCore(action, model, apiKey, request, signal);
+			const rsp = await this.fetchCore(action, model, apiKey, request, signal, conversationId);
 			if (!rsp.ok) {
 				const result = await this.handleFetchFailure(rsp, action, model, retries, maxInputTokens);
 				if (result.retry) {
@@ -207,6 +223,7 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 		apiKey: string,
 		request: object,
 		signal: AbortSignal | undefined,
+		conversationId?: string,
 	): Promise<Response> {
 		const url = this.getUrl(model);
 		if (!url) {
@@ -215,7 +232,7 @@ export abstract class OpenAICompatibleProviderBase<T extends AIProviders> implem
 
 		try {
 			return await this.context.fetch(url, {
-				headers: await this.getHeaders(action, apiKey, model, url),
+				headers: await this.getHeaders(action, apiKey, model, url, conversationId),
 				method: 'POST',
 				body: JSON.stringify(request),
 				signal: signal,

package/src/plus/ai/utils/ai.utils.ts

@@ -11,17 +11,19 @@ export function getActionName(action: AIActionType): string {
 		case 'generate-stashMessage':
 			return 'Generate Stash Message';
 		case 'generate-changelog':
-			return 'Generate Changelog (Preview)';
+			return 'Generate Changelog';
 		case 'generate-create-cloudPatch':
 			return 'Create Cloud Patch Details';
 		case 'generate-create-codeSuggestion':
 			return 'Create Code Suggestion Details';
 		case 'generate-create-pullRequest':
-			return 'Create Pull Request Details (Preview)';
+			return 'Create Pull Request Details';
 		case 'generate-commits':
-			return 'Generate Commits (Preview)';
+			return 'Generate Commits';
+		case 'conflict-resolution':
+			return 'Resolve Conflicts (Preview)';
 		case 'generate-searchQuery':
-			return 'Generate Search Query (Preview)';
+			return 'Generate Search Query';
 	}
 }
 

package/src/plus/git-github/api/github.ts

@@ -66,14 +66,49 @@ import {
 import type { GitHubApiConfig } from './config.js';
 import type { GitHubTokenInfo } from './token.js';
 
-interface CancellationToken {
-	isCancellationRequested: boolean;
-	onCancellationRequested(fn: () => void): { dispose(): void };
-}
-
 const emptyPagedResult: PagedResult<any> = Object.freeze({ values: [] });
 const emptyBlameResult: GitHubBlame = Object.freeze({ ranges: [] });
 
+// Transient gateway/network failures (e.g. an upstream `502 Bad Gateway`) are worth a few quick
+// retries before surfacing to the caller. octokit provides no built-in retry for the standalone
+// `request`/`graphql` functions we use (its retry/throttle plugins only attach to the `Octokit`
+// class), so we retry here — but only for idempotent reads (REST GET/HEAD, GraphQL queries),
+// never for mutations.
+const maxRequestRetries = 2;
+const requestRetryBaseDelay = 300; // ms
+const requestRetryMaxDelay = 2000; // ms
+
+function isRetryableTransientError(ex: unknown): ex is RequestError {
+	// An aborted request is rethrown as the original `AbortError` (not a `RequestError`), so it is
+	// excluded here. octokit maps a fetch/network failure to a `RequestError` with status 500 and
+	// no response — those, along with real gateway statuses, are transient and safe to retry.
+	if (!(ex instanceof RequestError)) return false;
+
+	switch (ex.status) {
+		case 502: // Bad Gateway
+		case 503: // Service Unavailable
+		case 504: // Gateway Timeout
+			return true;
+		case 500: // Internal Server Error — only the network-failure variant (no response)
+			return ex.response == null;
+		default:
+			return false;
+	}
+}
+
+function getRequestRetryDelay(attempt: number): number {
+	// Exponential backoff with equal jitter, capped — spreads retries so a brief upstream blip
+	// isn't hammered by every in-flight request landing on the same schedule.
+	const backoff = Math.min(requestRetryMaxDelay, requestRetryBaseDelay * 2 ** (attempt - 1));
+	return Math.round(backoff / 2 + Math.random() * (backoff / 2));
+}
+
+// Matches a GraphQL document whose operation is definitely a read query — the `query` keyword as
+// the first significant token, after any leading whitespace or `#` comment lines. We retry only
+// when this matches; a mutation (even one prefixed by a comment), a subscription, or anything we
+// can't classify is left non-retryable so a transient failure can never re-run a mutation.
+const graphqlReadQueryRegex = /^(?:\s|#[^\n]*\n?)*query\b/;
+
 const gqlIssueOrPullRequestFragment = `
 closed
 closedAt
@@ -919,7 +954,7 @@ export class GitHubApi {
 			baseUrl?: string;
 			avatarSize?: number;
 		},
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<PullRequest | undefined> {
 		const scope = getScopedLogger();
 
@@ -1009,7 +1044,7 @@ export class GitHubApi {
 		options?: {
 			baseUrl?: string;
 		},
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<RepositoryMetadata | undefined> {
 		const scope = getScopedLogger();
 
@@ -2866,6 +2901,55 @@ export class GitHubApi {
 		return version ?? undefined;
 	}
 
+	// Runs `execute`, retrying transient gateway/network failures with backoff. `retryable` gates
+	// retries to idempotent reads; `signal` lets an in-flight cancellation abort the backoff wait.
+	private async requestWithRetries<T>(
+		execute: () => Promise<T>,
+		retryable: boolean,
+		signal: AbortSignal | undefined,
+		scope: ScopedLogger | undefined,
+	): Promise<T> {
+		let attempt = 0;
+		while (true) {
+			try {
+				return await execute();
+			} catch (ex) {
+				if (!retryable || attempt >= maxRequestRetries || signal?.aborted || !isRetryableTransientError(ex)) {
+					throw ex;
+				}
+
+				attempt++;
+				const delay = getRequestRetryDelay(attempt);
+				scope?.warn(
+					`Transient request failure (status ${ex.status}); retrying ${attempt}/${maxRequestRetries} in ${delay}ms`,
+				);
+				await this.delayWithAbort(delay, signal);
+				// Bail rather than retry if we were cancelled while waiting
+				if (signal?.aborted) throw new CancellationError();
+			}
+		}
+	}
+
+	private delayWithAbort(ms: number, signal: AbortSignal | undefined): Promise<void> {
+		return new Promise<void>(resolve => {
+			if (signal?.aborted) {
+				resolve();
+				return;
+			}
+
+			let timer: ReturnType<typeof setTimeout>;
+			const onAbort = () => {
+				clearTimeout(timer);
+				resolve();
+			};
+			timer = setTimeout(() => {
+				signal?.removeEventListener('abort', onAbort);
+				resolve();
+			}, ms);
+			signal?.addEventListener('abort', onAbort, { once: true });
+		});
+	}
+
 	// Inflight dedupe: identical concurrent GraphQL requests share a single promise
 	// to cut redundant traffic during graph/details enrichment bursts.
 	private readonly _pendingGraphQL = new Map<string, Promise<unknown>>();
@@ -2876,10 +2960,9 @@ export class GitHubApi {
 		query: string,
 		variables: RequestParameters,
 		scope: ScopedLogger | undefined,
-		cancellation?: CancellationToken | undefined,
+		cancellation?: AbortSignal | undefined,
 	): Promise<T | undefined> {
 		const { accessToken, ...tokenInfo } = token;
-
 		// Only dedupe when no cancellation/request option is in play — sharing a promise that
 		// carries one caller's AbortSignal would let one cancellation cancel for everyone.
 		const dedupable = cancellation == null && variables?.request == null;
@@ -2899,21 +2982,26 @@ export class GitHubApi {
 
 		const run = async (): Promise<T | undefined> => {
 			try {
-				let aborter: AbortController | undefined;
 				if (cancellation != null) {
-					if (cancellation.isCancellationRequested) throw new CancellationError();
-
-					aborter = new AbortController();
-					cancellation.onCancellationRequested(() => aborter!.abort());
+					if (cancellation.aborted) throw new CancellationError();
 
 					variables = {
 						...variables,
-						request: { ...variables?.request, signal: aborter.signal },
+						request: { ...variables?.request, signal: cancellation },
 					};
 				}
 
-				return await this.config.wrapForForcedInsecureSSL(provider?.getIgnoreSSLErrors() ?? false, () =>
-					this.getDefaults(accessToken, graphql)(query, variables),
+				// Retry transient gateway/network failures, but only confirmed read queries — never
+				// mutations (re-running one isn't idempotent)
+				const retryable = graphqlReadQueryRegex.test(query);
+				return await this.requestWithRetries(
+					() =>
+						this.config.wrapForForcedInsecureSSL(provider?.getIgnoreSSLErrors() ?? false, () =>
+							this.getDefaults(accessToken, graphql)(query, variables),
+						),
+					retryable,
+					cancellation,
+					scope,
 				);
 			} catch (ex) {
 				if (ex instanceof GraphqlResponseError) {
@@ -2955,12 +3043,15 @@ export class GitHubApi {
 		const promise = run();
 		this._pendingGraphQL.set(dedupeKey, promise);
 		// Clear from the inflight map once the promise settles — successes and failures both
-		// clear, so failed requests don't poison subsequent retries.
-		void promise.finally(() => {
+		// clear, so failed requests don't poison subsequent retries. Use `then(cleanup, cleanup)`
+		// rather than `finally` so a rejected request doesn't spawn an orphaned (unhandled) promise;
+		// the real caller still receives the rejection via the returned `promise`.
+		const cleanup = () => {
 			if (this._pendingGraphQL.get(dedupeKey) === promise) {
 				this._pendingGraphQL.delete(dedupeKey);
 			}
-		});
+		};
+		promise.then(cleanup, cleanup);
 		return promise;
 	}
 
@@ -2970,20 +3061,29 @@ export class GitHubApi {
 		route: R,
 		options: (Endpoints[R]['parameters'] & RequestParameters) | undefined,
 		scope: ScopedLogger | undefined,
-		cancellation?: CancellationToken | undefined,
+		cancellation?: AbortSignal | undefined,
 	): Promise<Endpoints[R]['response']> {
 		const { accessToken } = token;
 		try {
+			let signal: AbortSignal | undefined;
 			if (cancellation != null) {
-				if (cancellation.isCancellationRequested) throw new CancellationError();
+				if (cancellation.aborted) throw new CancellationError();
 
-				const aborter = new AbortController();
-				cancellation.onCancellationRequested(() => aborter.abort());
-				options = { ...options, request: { ...options?.request, signal: aborter.signal } };
+				signal = cancellation;
+				options = { ...options, request: { ...options?.request, signal: signal } };
 			}
 
-			return (await this.config.wrapForForcedInsecureSSL(provider?.getIgnoreSSLErrors() ?? false, () =>
-				this.getDefaults(accessToken, request)(route as string, options),
+			// Retry transient gateway/network failures on idempotent reads only
+			const method = route.split(' ', 1)[0].toUpperCase();
+			const retryable = method === 'GET' || method === 'HEAD';
+			return (await this.requestWithRetries(
+				() =>
+					this.config.wrapForForcedInsecureSSL(provider?.getIgnoreSSLErrors() ?? false, () =>
+						this.getDefaults(accessToken, request)(route as string, options),
+					),
+				retryable,
+				signal,
+				scope,
 			)) as Endpoints[R]['response'];
 		} catch (ex) {
 			if (ex instanceof RequestError || ex.name === 'AbortError') {
@@ -3218,7 +3318,7 @@ export class GitHubApi {
 			avatarSize?: number;
 			silent?: boolean;
 		},
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<PullRequest[]> {
 		const scope = getScopedLogger();
 
@@ -3333,7 +3433,7 @@ export class GitHubApi {
 			avatarSize?: number;
 			includeBody?: boolean;
 		},
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<IssueShape[] | undefined> {
 		const scope = getScopedLogger();
 
@@ -3436,7 +3536,7 @@ export class GitHubApi {
 		provider: Provider,
 		token: GitHubTokenInfo,
 		options?: { search?: string; user?: string; repos?: string[]; baseUrl?: string; avatarSize?: number },
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<PullRequest[]> {
 		const scope = getScopedLogger();
 
@@ -3506,7 +3606,7 @@ export class GitHubApi {
 		nodeId: string,
 		expectedSourceSha: string,
 		options?: { mergeMethod?: PullRequestMergeMethod; baseUrl?: string },
-		cancellation?: CancellationToken,
+		cancellation?: AbortSignal,
 	): Promise<boolean> {
 		const scope = getScopedLogger();
 		interface QueryResult {

package/src/plus/git-github/providers/github/refs.ts

@@ -17,7 +17,7 @@ import { toTokenInfo } from '../../api/tokenUtils.js';
 import type { GitHubGitProviderInternal } from '../githubProvider.js';
 
 // Since negative lookbehind isn't supported in all browsers, this leaves out the negative lookbehind condition `(?<!\.lock)` to ensure the branch name doesn't end with `.lock`
-// eslint-disable-next-line no-control-regex
+// oxlint-disable-next-line no-control-regex
 const validBranchOrTagRegex = /^[^/](?!.*\/\.)(?!.*\.\.)(?!.*\/\/)(?!.*@\{)[^\x00-\x1F\x7F ~^:?*[\\]+[^./]$/;
 
 export class RefsGitSubProvider implements GitRefsSubProvider {

package/src/plus/integrations/authentication/cloudIntegrationService.ts

@@ -0,0 +1,120 @@
+import { getScopedLogger } from '../../../utils/logger.scoped.js';
+import type { IntegrationIds } from '../constants.js';
+import type { IntegrationServiceContext } from '../context.js';
+import type { CloudIntegrationAuthenticationSession, CloudIntegrationConnection } from './models.js';
+import { toCloudIntegrationType } from './models.js';
+
+export class CloudIntegrationService {
+	constructor(private readonly ctx: IntegrationServiceContext) {}
+
+	async getConnections(): Promise<CloudIntegrationConnection[] | undefined> {
+		const scope = getScopedLogger();
+
+		const providersRsp = await this.ctx.account.fetchGkApi('v1/provider-tokens', { method: 'GET' });
+		if (!providersRsp.ok) {
+			const error = ((await providersRsp.json()) as { error?: unknown })?.error;
+			const errorMessage =
+				typeof error === 'string'
+					? error
+					: ((error as { message?: string })?.message ?? providersRsp.statusText);
+			if (error != null) {
+				scope?.error(undefined, `Failed to get connected providers from cloud: ${errorMessage}`);
+			}
+			this.ctx.hooks?.connection?.onConnectionsFetchFailed?.({ code: providersRsp.status });
+			return undefined;
+		}
+
+		return ((await providersRsp.json()) as { data?: unknown })?.data as CloudIntegrationConnection[] | undefined;
+	}
+
+	async getConnectionSession(
+		id: IntegrationIds,
+		refreshToken?: string,
+	): Promise<CloudIntegrationAuthenticationSession | undefined> {
+		const scope = getScopedLogger();
+
+		const refresh = Boolean(refreshToken);
+		const cloudIntegrationType = toCloudIntegrationType[id];
+		if (cloudIntegrationType == null) {
+			scope?.error(undefined, `Unsupported cloud integration type: ${id}`);
+			return undefined;
+		}
+
+		const reqInitOptions = refreshToken
+			? {
+					method: 'POST',
+					body: JSON.stringify({
+						access_token: refreshToken,
+					}),
+				}
+			: { method: 'GET' };
+
+		const tokenRsp = await this.ctx.account.fetchGkApi(
+			`v1/provider-tokens/${cloudIntegrationType}${refresh ? '/refresh' : ''}`,
+			reqInitOptions,
+		);
+		if (!tokenRsp.ok) {
+			const error = ((await tokenRsp.json()) as { error?: unknown })?.error;
+			const errorMessage =
+				typeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);
+			if (error != null) {
+				scope?.error(
+					undefined,
+					`Failed to ${refresh ? 'refresh' : 'get'} ${id} token from cloud: ${errorMessage}`,
+				);
+			}
+			this.ctx.hooks?.connection?.onConnectionFetchFailed?.({
+				id: id,
+				code: tokenRsp.status,
+				refreshing: refresh,
+			});
+
+			if (refresh) {
+				// try once to just get the latest token if the refresh fails, and give up if that fails too
+				const newTokenRsp = await this.ctx.account.fetchGkApi(`v1/provider-tokens/${cloudIntegrationType}`, {
+					method: 'GET',
+				});
+				if (newTokenRsp.ok) {
+					return ((await newTokenRsp.json()) as { data?: unknown })?.data as
+						| CloudIntegrationAuthenticationSession
+						| undefined;
+				}
+			}
+
+			return undefined;
+		}
+
+		return ((await tokenRsp.json()) as { data?: unknown })?.data as
+			| CloudIntegrationAuthenticationSession
+			| undefined;
+	}
+
+	async disconnect(id: IntegrationIds): Promise<boolean> {
+		const scope = getScopedLogger();
+
+		const cloudIntegrationType = toCloudIntegrationType[id];
+		if (cloudIntegrationType == null) {
+			scope?.error(undefined, `Unsupported cloud integration type: ${id}`);
+			return false;
+		}
+
+		const tokenRsp = await this.ctx.account.fetchGkApi(`v1/provider-tokens/${cloudIntegrationType}`, {
+			method: 'DELETE',
+		});
+		if (!tokenRsp.ok) {
+			const error = ((await tokenRsp.json()) as { error?: unknown })?.error;
+			const errorMessage =
+				typeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);
+			if (error != null) {
+				scope?.error(undefined, `Failed to disconnect ${id} token from cloud: ${errorMessage}`);
+			}
+			this.ctx.hooks?.connection?.onDisconnectFailed?.({
+				id: id,
+				code: tokenRsp.status,
+			});
+			return false;
+		}
+
+		return true;
+	}
+}