@ipul-labs/forge 1.16.8 → 1.17.0

package/lib/server/forge/routes.js

@@ -0,0 +1,984 @@
+/**
+ * server/forge/routes.js
+ *
+ * Express router for /api/forge/*.
+ *
+ * Required env vars:
+ *   FORGE_TOKEN   — dashboard password
+ *
+ * Project + token resolved via configStore (Settings UI) with env-var fallbacks.
+ *
+ * Multi-repo support
+ * ──────────────────
+ * Every endpoint accepts an optional `repo` param (primary, where the issue
+ * lives) and `secondaryRepos` param (additional repos that can participate in
+ * a full-stack fix). `secondaryRepos` may be sent as a comma-separated string
+ * in the query string, or as a JSON array in a POST body.
+ */
+import { Router } from "express";
+import * as configStore from "./core/configStore.js";
+import { listDeployments } from "./core/k8s.js";
+import { ForgeAgent } from "./core/ForgeAgent.js";
+import crypto from "node:crypto";
+import { probeQuota } from "./core/quotaClient.js";
+import { validate as runValidation } from "./core/validator.js";
+import { createProvider } from "./core/providers/index.js";
+import * as jobStore from "./core/jobs.js";
+import { FORGE_EVENTS } from "../../shared/events.js";
+const router = Router();
+// ─── Auth middleware ──────────────────────────────────────────────────────────
+function requireAuth(req, res, next) {
+    const token = process.env.FORGE_TOKEN;
+    if (!token) {
+        res.status(503).json({
+            error: "Forge is not configured. Set FORGE_TOKEN env var.",
+        });
+        return;
+    }
+    const auth = req.headers.authorization
+        ?? (req.query.token ? `Bearer ${req.query.token}` : null);
+    if (!auth?.startsWith("Bearer ")) {
+        res.status(401).json({ error: "Missing Authorization header." });
+        return;
+    }
+    const provided = Buffer.from(auth.slice(7));
+    const expected = Buffer.from(token);
+    if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) {
+        res.status(403).json({ error: "Invalid token." });
+        return;
+    }
+    next();
+}
+// ─── Error handler ────────────────────────────────────────────────────────────
+function redactSecrets(text) {
+    return text
+        .replace(/(?:token|key|secret|password|bearer)[=:\s]+\S+/gi, (m) => m.slice(0, m.indexOf(m.match(/[=:\s]/)[0]) + 1) + "***")
+        .replace(/oauth2:[^@]+@/gi, "oauth2:***@")
+        .replace(/ghp_\w+/g, "ghp_***")
+        .replace(/glpat-\w+/g, "glpat-***");
+}
+function handleError(res, error, operation) {
+    const msg = error?.message ?? "Unknown error";
+    console.error(`[forge] ${operation} failed:`, redactSecrets(msg));
+    const upstream = /^(?:GitLab|GitHub) (\d{3}) on /.exec(msg);
+    const status = error?.status ?? (upstream ? Number(upstream[1]) : 500);
+    res.status(status).json({ error: redactSecrets(msg), operation });
+}
+// ─── Repo helpers ─────────────────────────────────────────────────────────────
+function getAvailableRepos() {
+    // Precedence: persisted config → env vars → empty.
+    const fromConfig = configStore.get().repos;
+    if (fromConfig.length > 0)
+        return fromConfig;
+    const raw = process.env.FORGE_REPOS ?? process.env.FORGE_GITLAB_PROJECT ?? "";
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((path) => ({ id: path, label: path.split("/").pop() }));
+}
+function parseRepo(req) {
+    const repos = getAvailableRepos();
+    const requested = req.query.repo ?? req.body?.repo ?? null;
+    if (!requested)
+        return repos[0]?.id ?? configStore.getPrimaryProject();
+    const match = repos.find((r) => r.id === requested);
+    return match?.id ?? repos[0]?.id ?? configStore.getPrimaryProject();
+}
+/**
+ * Normalises `secondaryRepos` from either a query string (comma-separated) or
+ * a JSON body array, validating each entry against the configured repo list.
+ * The primary repo is always filtered out.
+ */
+function parseSecondaryRepos(req, primary) {
+    const repos = getAvailableRepos();
+    const valid = new Set(repos.map((r) => r.id));
+    let raw = req.body?.secondaryRepos ?? req.query.secondaryRepos ?? null;
+    if (!raw)
+        return [];
+    let list;
+    if (Array.isArray(raw)) {
+        list = raw;
+    }
+    else if (typeof raw === "string") {
+        list = raw.split(",");
+    }
+    else {
+        return [];
+    }
+    return list
+        .map((s) => (typeof s === "string" ? s.trim() : ""))
+        .filter((s) => s && s !== primary && valid.has(s));
+}
+const MODEL_RATES = {
+    "claude-opus-4-7": { input: 15, output: 75 },
+    "claude-sonnet-4-6": { input: 3, output: 15 },
+    "claude-haiku-4-5-20251001": { input: 0.80, output: 4 },
+};
+const FALLBACK_MODELS = [
+    { id: "claude-opus-4-7", label: "Claude Opus 4.7", provider: "claude" },
+    { id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6", provider: "claude" },
+    { id: "claude-haiku-4-5-20251001", label: "Claude Haiku 4.5", provider: "claude" },
+];
+async function fetchAnthropicModels() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    try {
+        const res = await fetch("https://api.anthropic.com/v1/models?limit=100", {
+            headers: {
+                "x-api-key": process.env.ANTHROPIC_API_KEY ?? "",
+                "anthropic-version": "2023-06-01",
+            },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            throw new Error(`Anthropic models API ${res.status}`);
+        const { data } = await res.json();
+        return data
+            .filter((m) => m.type === "model" && m.id.startsWith("claude-"))
+            .map((m) => ({
+            id: m.id,
+            label: m.display_name,
+            provider: "claude",
+            ...(MODEL_RATES[m.id] ? { rates: MODEL_RATES[m.id] } : {}),
+        }));
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+router.get("/status", requireAuth, async (_req, res) => {
+    let models = FALLBACK_MODELS.map((m) => ({
+        ...m,
+        ...(MODEL_RATES[m.id] ? { rates: MODEL_RATES[m.id] } : {}),
+    }));
+    try {
+        if (process.env.ANTHROPIC_API_KEY) {
+            models = await fetchAnthropicModels();
+        }
+    }
+    catch (e) {
+        const err = e;
+        console.warn("[forge] fetchAnthropicModels failed, using fallback:", err?.message);
+    }
+    const repos = getAvailableRepos();
+    const agents = [
+        { id: "claude", label: "Claude", configured: true },
+        {
+            id: "openclaw",
+            label: "OpenClaw",
+            configured: Boolean(process.env.OPENCLAW_GATEWAY_URL),
+        },
+    ];
+    res.json({
+        ok: true,
+        project: configStore.getPrimaryProject(),
+        repos,
+        supportsMultiRepo: repos.length > 1,
+        hasGitlabToken: Boolean(configStore.getConnection("gitlab").token),
+        defaultModel: process.env.FORGE_MODEL ?? "claude-sonnet-4-6",
+        models,
+        agents,
+        defaultAgent: process.env.OPENCLAW_GATEWAY_URL ? "openclaw" : "claude",
+        hasApiKey: Boolean(process.env.ANTHROPIC_API_KEY),
+        // Test-deploy URL template stored in configStore.defaults — editable
+        // from Settings → Defaults. Supports "{branch}" / "{slug}" placeholders
+        // for ephemeral per-branch deploys. Empty string means "no link".
+        testDeployUrlTemplate: configStore.get().defaults?.testDeployUrlTemplate || null,
+    });
+});
+router.use(requireAuth);
+// ─── Config ───────────────────────────────────────────────────────────────────
+router.get("/config", (_req, res) => {
+    res.json(configStore.getPublic());
+});
+router.put("/config", async (req, res) => {
+    try {
+        await configStore.patch(req.body ?? {});
+        res.json(configStore.getPublic());
+    }
+    catch (err) {
+        handleError(res, err, "updating config");
+    }
+});
+// ─── Issues ───────────────────────────────────────────────────────────────────
+router.get("/issues", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        const [issues, forgeBranches, mergedLinks] = await Promise.all([
+            provider.listOpenIssues(),
+            provider.listBranchesByPrefix("forge/issue-").catch(() => []),
+            provider.listRecentMergedMRIssueLinks(50).catch(() => []),
+        ]);
+        // Map issue iid → most specific forge branch name. There may be several
+        // (old analyses that never merged), so prefer one with a slug suffix.
+        const branchByIid = new Map();
+        for (const name of forgeBranches) {
+            const m = name.match(/^forge\/issue-(\d+)(?:-|$)/);
+            if (!m)
+                continue;
+            const iid = Number(m[1]);
+            const hasSlug = name.length > `forge/issue-${iid}`.length;
+            const existing = branchByIid.get(iid);
+            if (!existing || (!/-/.test(existing.slice(`forge/issue-${iid}`.length)) && hasSlug)) {
+                branchByIid.set(iid, name);
+            }
+        }
+        // Map issue iid → most-recent merged MR that claims to close it.
+        // Primary signal: closing keywords in the MR description.
+        const fixByIid = new Map();
+        for (const link of mergedLinks) {
+            for (const iid of link.closedIssueIids) {
+                const prior = fixByIid.get(iid);
+                if (!prior || (link.mergedAt ?? "") > (prior.mergedAt ?? "")) {
+                    fixByIid.set(iid, { mrIid: link.mrIid, webUrl: link.webUrl, mergedAt: link.mergedAt });
+                }
+            }
+        }
+        // Fallback signal: merged MRs whose source branch encodes the issue iid
+        // (`forge/issue-<iid>[-slug]`). Catches MRs that merged without a
+        // closing keyword in the description — e.g. manually opened MRs on a
+        // Forge branch. Only fills gaps; the keyword match above wins on
+        // conflicts since it's a stronger signal (the MR explicitly says so).
+        for (const link of mergedLinks) {
+            const m = link.sourceBranch?.match(/^forge\/issue-(\d+)(?:-|$)/);
+            if (!m)
+                continue;
+            const iid = Number(m[1]);
+            if (fixByIid.has(iid))
+                continue;
+            fixByIid.set(iid, { mrIid: link.mrIid, webUrl: link.webUrl, mergedAt: link.mergedAt });
+        }
+        // Only compare branches we actually care about — issues shown in the list.
+        const compareTargets = issues
+            .map((i) => ({ iid: i.iid, branch: branchByIid.get(i.iid) }))
+            .filter((e) => !!e.branch);
+        const compareResults = await Promise.all(compareTargets.map((e) => provider.compareRefs("main", e.branch).catch(() => null)));
+        const aheadByIid = new Map();
+        compareTargets.forEach((e, idx) => {
+            aheadByIid.set(e.iid, compareResults[idx]?.aheadCount ?? null);
+        });
+        const enriched = issues.map((i) => {
+            const out = { ...i };
+            const b = branchByIid.get(i.iid);
+            if (b) {
+                out.forgeBranch = b;
+                if (aheadByIid.has(i.iid))
+                    out.branchAhead = aheadByIid.get(i.iid);
+            }
+            const fix = fixByIid.get(i.iid);
+            if (fix)
+                out.likelyFixedByMr = { iid: fix.mrIid, webUrl: fix.webUrl };
+            return out;
+        });
+        res.json({ issues: enriched });
+    }
+    catch (error) {
+        handleError(res, error, "listOpenIssues");
+    }
+});
+router.post("/issues", async (req, res) => {
+    const { title, description = "" } = req.body;
+    if (!title?.trim()) {
+        res.status(400).json({ error: "title is required." });
+        return;
+    }
+    try {
+        const issue = await createProvider(parseRepo(req)).createIssue(title.trim(), description.trim());
+        res.json({ issue });
+        broadcast({ type: FORGE_EVENTS.ISSUE_CREATED, iid: issue.iid });
+    }
+    catch (error) {
+        handleError(res, error, "createIssue");
+    }
+});
+router.put("/issues/:iid", async (req, res) => {
+    const { title, description = "" } = req.body;
+    if (!title?.trim()) {
+        res.status(400).json({ error: "title is required." });
+        return;
+    }
+    try {
+        const issue = await createProvider(parseRepo(req)).updateIssue(Number(req.params.iid), { title: title.trim(), description: description.trim() });
+        res.json({ issue });
+    }
+    catch (error) {
+        handleError(res, error, "updateIssue");
+    }
+});
+router.post("/issues/:iid/close", async (req, res) => {
+    try {
+        const iid = Number(req.params.iid);
+        const provider = createProvider(parseRepo(req));
+        // Refuse if there's an open Forge MR — the user should merge or close the
+        // MR first. The frontend surfaces this message verbatim.
+        const openMrs = await provider.listForgeMRsForIssue(iid).catch(() => []);
+        if (openMrs.length > 0) {
+            const mr = openMrs[0];
+            res.status(409).json({
+                error: `Cannot close: active MR !${mr.iid} is still open. Merge or close it first.`,
+                openMr: { iid: mr.iid, web_url: mr.web_url, title: mr.title },
+            });
+            return;
+        }
+        // Stop any ephemeral environments attached to forge branches for this
+        // issue BEFORE deleting branches — on most providers deleting the
+        // branch orphans the environment rather than tearing it down. Each
+        // stop is best-effort (already-stopped envs 4xx).
+        const branches = await provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []);
+        const baseBranch = `forge/issue-${iid}`;
+        const all = [...branches, baseBranch];
+        const envs = (await Promise.all(all.map((b) => provider.listEnvironmentsForBranch(b).catch(() => [])))).flat();
+        await Promise.all(envs.map((e) => provider.stopEnvironment(e.id).catch(() => { })));
+        // Now delete the branches. Also best-effort.
+        await Promise.all(all.map((b) => provider.deleteBranch(b).catch(() => { })));
+        const issue = await provider.closeIssue(iid);
+        res.json({ issue, stoppedEnvironments: envs.length });
+        broadcast({ type: FORGE_EVENTS.ISSUE_CLOSED, iid });
+    }
+    catch (error) {
+        handleError(res, error, "closeIssue");
+    }
+});
+router.get("/issues/:iid", async (req, res) => {
+    try {
+        const issue = await createProvider(parseRepo(req)).getIssue(Number(req.params.iid));
+        res.json({ issue });
+    }
+    catch (error) {
+        handleError(res, error, "getIssue");
+    }
+});
+// ─── Open Forge MRs ───────────────────────────────────────────────────────────
+router.get("/mrs", async (req, res) => {
+    try {
+        const rawState = typeof req.query.state === "string" ? req.query.state : "open";
+        const state = ["open", "merged", "closed"].includes(rawState) ? rawState : "open";
+        const mrs = await createProvider(parseRepo(req)).listAllForgeMRs(state);
+        res.json({
+            mrs: mrs.map((mr) => ({
+                iid: mr.iid,
+                title: mr.title,
+                web_url: mr.web_url,
+                source_branch: mr.source_branch,
+                target_branch: mr.target_branch,
+                state: mr.state,
+                created_at: mr.created_at,
+                merged_at: mr.merged_at ?? null,
+                author: { name: mr.author?.name ?? "unknown" },
+                has_conflicts: mr.has_conflicts ?? false,
+                merge_status: mr.merge_status ?? "unchecked",
+                pipeline: mr.head_pipeline
+                    ? { status: mr.head_pipeline.status, web_url: mr.head_pipeline.web_url }
+                    : null,
+            })),
+        });
+    }
+    catch (error) {
+        handleError(res, error, "listAllForgeMRs");
+    }
+});
+// ─── MR detection ─────────────────────────────────────────────────────────────
+router.get("/issues/:iid/mr", async (req, res) => {
+    try {
+        const mrs = await createProvider(parseRepo(req)).listForgeMRsForIssue(Number(req.params.iid));
+        const latest = mrs[0] ?? null;
+        res.json({
+            mr: latest
+                ? { iid: latest.iid, web_url: latest.web_url, title: latest.title, branchName: latest.source_branch }
+                : null,
+        });
+    }
+    catch (error) {
+        handleError(res, error, "listForgeMRsForIssue");
+    }
+});
+router.get("/issues/:iid/merged-mrs", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        const mrs = await provider.listMergedForgeMRsForIssue(Number(req.params.iid));
+        // Attach the post-merge pipeline (the one that ran on the merge commit)
+        // to each MR so the UI can render pass/fail badges.
+        const enriched = await Promise.all(mrs.map(async (mr) => {
+            let pipeline = null;
+            if (mr.merge_commit_sha) {
+                try {
+                    const pipelines = await provider.getPipelinesBySha(mr.merge_commit_sha);
+                    const latest = pipelines[0];
+                    if (latest) {
+                        pipeline = { id: latest.id, status: latest.status, web_url: latest.web_url };
+                    }
+                }
+                catch {
+                    // Non-fatal — pipelines can 404 for older merges.
+                }
+            }
+            return {
+                iid: mr.iid,
+                web_url: mr.web_url,
+                title: mr.title,
+                merged_at: mr.merged_at,
+                branchName: mr.source_branch,
+                merge_commit_sha: mr.merge_commit_sha,
+                pipeline,
+            };
+        }));
+        res.json({ mrs: enriched });
+    }
+    catch (error) {
+        handleError(res, error, "listMergedForgeMRsForIssue");
+    }
+});
+router.get("/mr/:mrIid/detail", async (req, res) => {
+    try {
+        const mr = await createProvider(parseRepo(req)).getMR(Number(req.params.mrIid));
+        res.json({
+            iid: mr.iid,
+            title: mr.title,
+            web_url: mr.web_url,
+            source_branch: mr.source_branch,
+            target_branch: mr.target_branch,
+            state: mr.state,
+            has_conflicts: mr.has_conflicts ?? false,
+            rebase_in_progress: mr.rebase_in_progress ?? false,
+            merge_status: mr.merge_status ?? "unchecked",
+            detailed_merge_status: mr.detailed_merge_status ?? null,
+            merge_when_pipeline_succeeds: mr.merge_when_pipeline_succeeds ?? false,
+            draft: mr.draft ?? false,
+        });
+    }
+    catch (error) {
+        handleError(res, error, "getMR");
+    }
+});
+router.post("/mr/:mrIid/rebase", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        if (!provider.supportsRebase) {
+            res.status(422).json({ error: `${provider.name} does not support server-side rebase.` });
+            return;
+        }
+        await provider.rebaseMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+    }
+    catch (error) {
+        handleError(res, error, "rebaseMR");
+    }
+});
+router.get("/mr/:mrIid/diffs", async (req, res) => {
+    try {
+        const diffs = await createProvider(parseRepo(req)).getMRDiffs(Number(req.params.mrIid));
+        res.json({ diffs });
+    }
+    catch (error) {
+        handleError(res, error, "getMRDiffs");
+    }
+});
+router.post("/mr/:mrIid/auto-merge", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        await provider.setAutoMergeMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+    }
+    catch (error) {
+        handleError(res, error, "setAutoMergeMR");
+    }
+});
+router.post("/mr/:mrIid/cancel-auto-merge", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        await provider.cancelAutoMergeMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+    }
+    catch (error) {
+        handleError(res, error, "cancelAutoMergeMR");
+    }
+});
+router.post("/mr/:mrIid/merge", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        await provider.mergeMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+        broadcast({ type: FORGE_EVENTS.MR_MERGED, mrIid: Number(req.params.mrIid) });
+    }
+    catch (error) {
+        handleError(res, error, "mergeMR");
+    }
+});
+router.post("/mr/:mrIid/close", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        await provider.closeMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+        broadcast({ type: FORGE_EVENTS.MR_CLOSED, mrIid: Number(req.params.mrIid) });
+    }
+    catch (error) {
+        handleError(res, error, "closeMR");
+    }
+});
+router.post("/mr/:mrIid/reopen", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        await provider.reopenMR(Number(req.params.mrIid));
+        res.json({ ok: true });
+    }
+    catch (error) {
+        handleError(res, error, "reopenMR");
+    }
+});
+router.post("/mr/:mrIid/draft", async (req, res) => {
+    try {
+        const draft = Boolean(req.body?.draft);
+        const provider = createProvider(parseRepo(req));
+        await provider.setMRDraft(Number(req.params.mrIid), draft);
+        res.json({ ok: true });
+    }
+    catch (error) {
+        handleError(res, error, "setMRDraft");
+    }
+});
+// ─── Analysis (SSE) ───────────────────────────────────────────────────────────
+// The job is kicked off synchronously and runs to completion regardless of
+// whether a client is listening. The client opens /jobs/:jobId/stream to
+// attach (or reattach after a reload).
+router.post("/issues/:iid/analyze", (req, res) => {
+    const { iid } = req.params;
+    const primary = parseRepo(req);
+    const secondaryProjects = parseSecondaryRepos(req, primary);
+    const agent = new ForgeAgent({
+        project: primary,
+        secondaryProjects,
+        agent: req.body.agent || "claude",
+    });
+    const kind = ["fresh", "new", "update", "retry"].includes(req.body.kind)
+        ? req.body.kind
+        : "fresh";
+    const previousChanges = Array.isArray(req.body.previousChanges) ? req.body.previousChanges : null;
+    const jobId = jobStore.createJob("analyze", (send, signal) => agent.analyzeIssue(Number(iid), send, req.body.model || undefined, undefined, req.body.prompt || undefined, kind, { signal }, previousChanges), { meta: { iid: Number(iid) }, onComplete: () => broadcast({ type: FORGE_EVENTS.ANALYSIS_DONE, iid: Number(iid) }) });
+    broadcast({ type: FORGE_EVENTS.ANALYSIS_STARTED, iid: Number(iid), jobId });
+    res.json({ jobId });
+});
+// ─── Refine ───────────────────────────────────────────────────────────────────
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+router.post("/issues/:iid/refine", (req, res) => {
+    const { iid } = req.params;
+    const { feedback, previousChanges, ciContext, validationState, claudeSessionId } = req.body;
+    if (!feedback?.trim() && !ciContext?.trim()) {
+        res.status(400).json({ error: "feedback or ciContext is required." });
+        return;
+    }
+    if (!Array.isArray(previousChanges)) {
+        res.status(400).json({ error: "previousChanges must be an array." });
+        return;
+    }
+    // Only forward a syntactically valid UUID — anything else becomes an
+    // unrecognized --resume arg that the CLI would reject with an error we'd
+    // have to parse. Safer to drop it silently and let ForgeAgent mint a fresh
+    // session (the user-visible outcome is just "no resume this turn").
+    const safeSessionId = typeof claudeSessionId === "string" && UUID_RE.test(claudeSessionId)
+        ? claudeSessionId
+        : undefined;
+    const primary = parseRepo(req);
+    const agent = new ForgeAgent({
+        project: primary,
+        secondaryProjects: parseSecondaryRepos(req, primary),
+        agent: req.body.agent || "claude",
+    });
+    const jobId = jobStore.createJob("refine", (send, signal) => agent.refineIssue(Number(iid), previousChanges, feedback?.trim() ?? "", send, undefined, ciContext?.trim(), validationState ?? null, safeSessionId, { signal }), { onComplete: () => broadcast({ type: FORGE_EVENTS.REFINE_DONE, iid: Number(iid) }) });
+    res.json({ jobId });
+});
+router.post("/issues/:iid/ci-fix", (req, res) => {
+    const { iid } = req.params;
+    const { ciContext, model } = req.body;
+    if (!ciContext?.trim()) {
+        res.status(400).json({ error: "ciContext is required." });
+        return;
+    }
+    const primary = parseRepo(req);
+    const agent = new ForgeAgent({
+        project: primary,
+        secondaryProjects: parseSecondaryRepos(req, primary),
+        agent: req.body.agent || "claude",
+    });
+    const jobId = jobStore.createJob("ci-fix", (send, signal) => agent.ciFixIssue(Number(iid), ciContext.trim(), send, model, { signal }), { onComplete: () => broadcast({ type: FORGE_EVENTS.CI_FIX_DONE, iid: Number(iid) }) });
+    res.json({ jobId });
+});
+router.get("/jobs/:jobId/trace", async (req, res) => {
+    try {
+        const trace = await createProvider(parseRepo(req)).getJobTrace(Number(req.params.jobId));
+        res.json({ trace });
+    }
+    catch (error) {
+        handleError(res, error, "getJobTrace");
+    }
+});
+router.get("/issues/:iid/active-job", (req, res) => {
+    const iid = Number(req.params.iid);
+    const job = jobStore.findActiveByMeta("iid", iid);
+    res.json({ job });
+});
+router.get("/jobs/:jobId", (req, res) => {
+    const snap = jobStore.snapshot(req.params.jobId);
+    if (!snap) {
+        res.status(404).json({ error: "Job not found." });
+        return;
+    }
+    res.json(snap);
+});
+router.get("/jobs/:jobId/stream", (req, res) => {
+    const jobId = req.params.jobId;
+    if (!jobStore.getJob(jobId)) {
+        res.status(404).json({ error: "Job not found." });
+        return;
+    }
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.flushHeaders();
+    let unsubscribe = () => { };
+    const write = (event) => {
+        if (res.writableEnded)
+            return;
+        res.write(`data: ${JSON.stringify(event)}\n\n`);
+        if (event.type === "done" || event.type === "error" || event.type === "cancelled") {
+            unsubscribe();
+            res.end();
+        }
+    };
+    const sub = jobStore.subscribe(jobId, write);
+    if (!sub) {
+        if (!res.writableEnded)
+            res.end();
+        return;
+    }
+    unsubscribe = sub;
+    req.on("close", () => {
+        unsubscribe();
+        if (!res.writableEnded)
+            res.end();
+    });
+});
+router.post("/jobs/:jobId/cancel", (req, res) => {
+    const jobId = req.params.jobId;
+    if (!jobStore.getJob(jobId)) {
+        res.status(404).json({ error: "Job not found." });
+        return;
+    }
+    const cancelled = jobStore.cancelJob(jobId);
+    res.json({ cancelled });
+});
+// ─── Apply fix ────────────────────────────────────────────────────────────────
+// ─── Validate ─────────────────────────────────────────────────────────────────
+// Pre-flight check: overlay the proposed changes on a cached clone of the
+// target repo, run lint/typecheck/test, and report results. Nothing is pushed
+// to GitLab — this is a sandbox check to prevent CI errors.
+router.post("/validate", (req, res) => {
+    const { analysis } = req.body;
+    if (!analysis?.changes?.length) {
+        res.status(400).json({ error: "analysis with changes is required." });
+        return;
+    }
+    // Take the user's *current* repo selection — analysis.repos is a stale
+    // snapshot from when the analysis ran (the user may have toggled
+    // secondaries on/off since then).
+    const primary = parseRepo(req);
+    const secondaryRepos = parseSecondaryRepos(req, primary);
+    const repos = [primary, ...secondaryRepos].filter(Boolean);
+    const enrichedAnalysis = repos.length ? { ...analysis, repos } : analysis;
+    const jobId = jobStore.createJob("validate", (send) => runValidation(enrichedAnalysis, send), { idPrefix: "val" });
+    res.json({ jobId });
+});
+router.post("/apply", async (req, res) => {
+    const { analysis } = req.body;
+    if (!analysis?.issue || !analysis?.changes?.length) {
+        res.status(400).json({ error: "Invalid or missing analysis payload." });
+        return;
+    }
+    try {
+        const primary = parseRepo(req);
+        const secondaryProjects = parseSecondaryRepos(req, primary);
+        const agent = new ForgeAgent({ project: primary, secondaryProjects });
+        const result = await agent.applyFix(analysis);
+        res.json(result);
+        broadcast({ type: FORGE_EVENTS.FIX_APPLIED, iid: analysis.issue?.iid });
+    }
+    catch (error) {
+        handleError(res, error, "applyFix");
+    }
+});
+router.post("/commit-to-branch", async (req, res) => {
+    const { branchName, analysis, repo: changeRepo } = req.body;
+    if (!branchName?.trim()) {
+        res.status(400).json({ error: "branchName is required." });
+        return;
+    }
+    if (!analysis?.issue || !analysis?.changes?.length) {
+        res.status(400).json({ error: "Invalid or missing analysis payload." });
+        return;
+    }
+    try {
+        const primary = parseRepo(req);
+        const secondaryProjects = parseSecondaryRepos(req, primary);
+        const agent = new ForgeAgent({ project: primary, secondaryProjects });
+        const targetRepo = changeRepo && [primary, ...secondaryProjects].includes(changeRepo)
+            ? changeRepo
+            : primary;
+        const result = await agent.commitToBranch(branchName.trim(), analysis, targetRepo);
+        res.json(result);
+    }
+    catch (error) {
+        handleError(res, error, "commitToBranch");
+    }
+});
+router.post("/promote-branch", async (req, res) => {
+    const { branchName, repo: targetRepo, issueIid } = req.body;
+    if (!branchName?.trim()) {
+        res.status(400).json({ error: "branchName is required." });
+        return;
+    }
+    if (!Number.isFinite(Number(issueIid))) {
+        res.status(400).json({ error: "issueIid is required." });
+        return;
+    }
+    try {
+        const primary = parseRepo(req);
+        const secondaryProjects = parseSecondaryRepos(req, primary);
+        const agent = new ForgeAgent({ project: primary, secondaryProjects });
+        const result = await agent.promoteBranchToMR(branchName.trim(), targetRepo || primary, Number(issueIid));
+        res.json(result);
+    }
+    catch (error) {
+        handleError(res, error, "promoteBranchToMR");
+    }
+});
+router.post("/deploy-branch", async (req, res) => {
+    const { analysis } = req.body;
+    if (!analysis?.issue || !analysis?.changes?.length) {
+        res.status(400).json({ error: "Invalid or missing analysis payload." });
+        return;
+    }
+    try {
+        const primary = parseRepo(req);
+        const secondaryProjects = parseSecondaryRepos(req, primary);
+        const agent = new ForgeAgent({ project: primary, secondaryProjects });
+        const result = await agent.deployBranch(analysis);
+        res.json(result);
+    }
+    catch (error) {
+        handleError(res, error, "deployBranch");
+    }
+});
+// ─── Pipeline status ──────────────────────────────────────────────────────────
+router.get("/mr/:mrIid/pipeline", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        const pipelines = await provider.getMRPipelines(Number(req.params.mrIid));
+        if (!pipelines.length) {
+            res.json({ pipeline: null, jobs: [] });
+            return;
+        }
+        const latest = pipelines[0];
+        const [pipeline, jobs] = await Promise.all([
+            provider.getPipeline(latest.id),
+            provider.getPipelineJobs(latest.id),
+        ]);
+        res.json({ pipeline, jobs });
+    }
+    catch (error) {
+        handleError(res, error, "getPipelineStatus");
+    }
+});
+// Returns the latest branch pipeline (and its jobs) for any ref.
+// Used by Deploy-to-Test, which creates a branch with no MR, so MR-scoped
+// pipeline lookups don't apply.
+router.get("/branch-pipeline", async (req, res) => {
+    try {
+        const branch = req.query.branch;
+        if (!branch) {
+            res.status(400).json({ error: "branch is required" });
+            return;
+        }
+        const provider = createProvider(parseRepo(req));
+        const pipelines = await provider.getPipelinesByRef(branch);
+        if (!pipelines.length) {
+            res.json({ pipeline: null, jobs: [] });
+            return;
+        }
+        const [pipeline, jobs] = await Promise.all([
+            provider.getPipeline(pipelines[0].id),
+            provider.getPipelineJobs(pipelines[0].id),
+        ]);
+        res.json({ pipeline, jobs });
+    }
+    catch (error) {
+        handleError(res, error, "getBranchPipeline");
+    }
+});
+// Lists Forge branches for an issue that aren't yet tied to an open or merged
+// MR — i.e. Deploy-to-Test branches. Each entry carries the latest pipeline
+// summary so the UI can surface CI status without a separate round-trip.
+router.get("/issues/:iid/deploy-branches", async (req, res) => {
+    try {
+        const iid = Number(req.params.iid);
+        const provider = createProvider(parseRepo(req));
+        const [branches, openMrs, mergedMrs] = await Promise.all([
+            provider.listBranchesByPrefix(`forge/issue-${iid}-`),
+            provider.listForgeMRsForIssue(iid),
+            provider.listMergedForgeMRsForIssue(iid),
+        ]);
+        const mrBranches = new Set([...openMrs, ...mergedMrs].map((m) => m.source_branch).filter(Boolean));
+        const deployOnly = branches.filter((b) => !mrBranches.has(b));
+        const enriched = await Promise.all(deployOnly.map(async (branchName) => {
+            try {
+                const pipelines = await provider.getPipelinesByRef(branchName);
+                const latest = pipelines[0] ?? null;
+                return {
+                    branchName,
+                    pipeline: latest
+                        ? { id: latest.id, status: latest.status, web_url: latest.web_url, created_at: latest.created_at }
+                        : null,
+                };
+            }
+            catch {
+                return { branchName, pipeline: null };
+            }
+        }));
+        // Newest first — branch names end in a timestamp so lexicographic = chronological.
+        enriched.sort((a, b) => b.branchName.localeCompare(a.branchName));
+        res.json({ branches: enriched });
+    }
+    catch (error) {
+        handleError(res, error, "listDeployBranches");
+    }
+});
+// Ephemeral environments (review apps) attached to any forge/issue-:iid-*
+// branch. Returns a flat list — each entry carries the branch it's tied to
+// so the UI can colocate it with its pipeline.
+router.get("/issues/:iid/environments", async (req, res) => {
+    try {
+        const iid = Number(req.params.iid);
+        const provider = createProvider(parseRepo(req));
+        const branches = await provider.listBranchesByPrefix(`forge/issue-${iid}-`).catch(() => []);
+        const all = [...branches, `forge/issue-${iid}`];
+        const envsByBranch = await Promise.all(all.map(async (branch) => {
+            const envs = await provider.listEnvironmentsForBranch(branch).catch(() => []);
+            return envs.map((e) => ({ ...e, branchName: branch }));
+        }));
+        res.json({ environments: envsByBranch.flat() });
+    }
+    catch (error) {
+        handleError(res, error, "listEnvironments");
+    }
+});
+router.get("/issues/:iid/post-merge-pipeline", async (req, res) => {
+    try {
+        const provider = createProvider(parseRepo(req));
+        const mrs = await provider.listMergedForgeMRsForIssue(Number(req.params.iid));
+        if (!mrs.length) {
+            res.json({ pipeline: null, jobs: [] });
+            return;
+        }
+        const latestMr = await provider.getMR(mrs[0].iid);
+        const sha = latestMr.merge_commit_sha;
+        if (!sha) {
+            res.json({ pipeline: null, jobs: [] });
+            return;
+        }
+        const pipelines = await provider.getPipelinesBySha(sha);
+        if (!pipelines.length) {
+            res.json({ pipeline: null, jobs: [] });
+            return;
+        }
+        const [pipeline, jobs] = await Promise.all([
+            provider.getPipeline(pipelines[0].id),
+            provider.getPipelineJobs(pipelines[0].id),
+        ]);
+        res.json({ pipeline, jobs });
+    }
+    catch (error) {
+        handleError(res, error, "getPostMergePipeline");
+    }
+});
+// ─── Resolution check ─────────────────────────────────────────────────────────
+router.post("/issues/:iid/resolution-check", async (req, res) => {
+    try {
+        const primary = parseRepo(req);
+        const secondaryProjects = parseSecondaryRepos(req, primary);
+        const provider = createProvider(primary);
+        const mrs = await provider.listMergedForgeMRsForIssue(Number(req.params.iid));
+        if (!mrs.length) {
+            res.status(404).json({ error: "No merged MR found for this issue." });
+            return;
+        }
+        const agent = new ForgeAgent({ project: primary, secondaryProjects, agent: req.body.agent || "claude" });
+        const result = await agent.checkResolution(Number(req.params.iid), mrs[0].iid, primary);
+        res.json(result);
+    }
+    catch (error) {
+        handleError(res, error, "checkResolution");
+    }
+});
+// ─── Rollout status ───────────────────────────────────────────────────────────
+router.get("/rollout", async (_req, res) => {
+    try {
+        const deployments = await listDeployments("test");
+        res.json({ deployments });
+    }
+    catch (error) {
+        handleError(res, error, "rollout");
+    }
+});
+// ─── Quota probe ──────────────────────────────────────────────────────────────
+// User-triggered: hits the Anthropic Messages API once with a 1-token request
+// just to read `anthropic-ratelimit-*` response headers. All real Forge work
+// still runs through the `claude` CLI (subscription).
+router.get("/quota", async (_req, res) => {
+    try {
+        const result = await probeQuota();
+        res.json(result);
+    }
+    catch (e) {
+        // Propagate the Anthropic status code if the probe itself failed,
+        // but still return whatever rate-limit headers came back.
+        const error = e;
+        const status = error?.status ?? 500;
+        res.status(status).json({
+            error: error?.message ?? "Quota probe failed",
+            rateLimit: error?.rateLimit ?? null,
+            operation: "quota",
+        });
+    }
+});
+// ─── Live event bus ──────────────────────────────────────────────────────────
+// SSE channel that broadcasts state-change events so the UI can refetch
+// without polling. The CLI and API endpoints call broadcast() after any
+// mutating operation (analyze, apply, merge, close, etc.).
+const sseClients = new Set();
+function broadcast(event) {
+    const data = `data: ${JSON.stringify(event)}\n\n`;
+    for (const res of sseClients) {
+        if (!res.writableEnded)
+            res.write(data);
+    }
+}
+router.get("/events", (req, res) => {
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.flushHeaders();
+    res.write(":\n\n");
+    sseClients.add(res);
+    req.on("close", () => sseClients.delete(res));
+});
+router.post("/events", (req, res) => {
+    const { type, iid, mrIid } = req.body ?? {};
+    if (!type) {
+        res.status(400).json({ error: "type is required." });
+        return;
+    }
+    broadcast({ type, ...(iid != null && { iid }), ...(mrIid != null && { mrIid }) });
+    res.json({ ok: true });
+});
+export { broadcast };
+export default router;
+//# sourceMappingURL=routes.js.map