@open-cr-agent/vcs-gitlab 0.1.2

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,3 @@
+# @open-cr-agent/vcs-gitlab
+
+The adapter for GitLab merge requests of [Open-CR-Agent](https://github.com/jma49/Open-CR-Agent), the multi-agent code reviewer, on GitLab.com and self-managed GitLab. Most users want [`@open-cr-agent/cli`](https://www.npmjs.com/package/@open-cr-agent/cli), which provides the `ocra` command and installs this package; see the [manual](https://ocra.majincheng.com). All `@open-cr-agent` packages are released together at one version. Apache-2.0.

package/dist/adapter.d.ts

@@ -0,0 +1,15 @@
+import { type FileDiff } from "@open-cr-agent/core";
+import { type CodeSource, type History, PlatformReview } from "@open-cr-agent/vcs-platform";
+import { type GitLabApi, type MergeRequest, type Position } from "./client.js";
+export interface GitLabAdapterOptions {
+    iid: number;
+    api: GitLabApi;
+    code: CodeSource;
+    history?: History;
+    snapshot?: MergeRequest;
+}
+export declare class GitLabAdapter extends PlatformReview {
+    constructor(options: GitLabAdapterOptions);
+}
+export declare function positionOf(file: string, line: number, diffs: readonly FileDiff[], refs: NonNullable<MergeRequest["diff_refs"]>): Position | undefined;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.js

@@ -0,0 +1,195 @@
+import { errorMessage } from "@open-cr-agent/core";
+import { PlatformReview, } from "@open-cr-agent/vcs-platform";
+import { DEVELOPER, GitLabApiError, } from "./client.js";
+// A GitLab merge request as ocra's review conversation (vcs-platform).
+export class GitLabAdapter extends PlatformReview {
+    constructor(options) {
+        super({
+            name: "gitlab",
+            platform: new GitLabPlatform(options),
+            code: options.code,
+            ...(options.history ? { history: options.history } : {}),
+        });
+    }
+}
+// A note whose editor is not in the GraphQL answer (past its page cap) reads
+// as edited by nobody who could be its author or ocra: the rules then ignore
+// it rather than trust it. Parentheses cannot occur in a GitLab username.
+const UNKNOWN_EDITOR = "(unknown)";
+class GitLabPlatform {
+    options;
+    text = { changeRequest: "merge request", authority: "the Developer role or higher" };
+    mergeRequest;
+    user;
+    editors;
+    // User ids by username, from the notes read, for membership lookups.
+    ids = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    // The token's own user: a project access token has a bot user of its own.
+    async bot() {
+        this.user ??= this.options.api.currentUser();
+        const { username } = await this.user;
+        return { login: username, is: (other) => other === username };
+    }
+    async changeRequest() {
+        const mr = await this.mr();
+        const refs = diffRefs(mr);
+        return {
+            id: `${projectPath(mr.web_url)}!${mr.iid}`,
+            title: mr.title,
+            description: mr.description ?? "",
+            baseSha: refs.start_sha,
+            headSha: refs.head_sha,
+            ...(mr.author ? { author: mr.author.username } : {}),
+        };
+    }
+    // Comments on the merge request as a whole: plain notes and the notes of
+    // threads started on it, not notes on lines or system notes.
+    async comments() {
+        const notes = await this.options.api.listNotes(this.options.iid);
+        return notes
+            .filter((n) => !n.system && n.type !== "DiffNote")
+            .map((n) => {
+            this.remember(n);
+            return { id: String(n.id), author: n.author.username, body: n.body };
+        });
+    }
+    async editor(comment) {
+        const editors = await this.noteEditors();
+        const id = Number(comment.id);
+        if (!editors.has(id))
+            throw new Error(`GitLab did not say who last edited note ${id}`);
+        return editors.get(id);
+    }
+    async canWrite(login) {
+        const id = this.ids.get(login) ?? (await this.options.api.findUser(login));
+        if (id === undefined)
+            return false;
+        return (await this.options.api.accessLevel(id)) >= DEVELOPER;
+    }
+    async threads() {
+        const discussions = await this.options.api.listDiscussions(this.options.iid);
+        // Without editors every reply would read as unedited, so no threads.
+        // Read after the discussions, not reused from the summary's check: a note
+        // edited in between then reads as edited, never as unedited.
+        const editors = await this.options.api.noteEditors(this.options.iid);
+        // Where a push resolves outdated threads, GitLab records the pusher as
+        // the one who resolved them, so no resolution says who dismissed what.
+        const attributable = (await this.options.api.resolvesOutdatedThreads().catch(() => undefined)) === false;
+        return discussions
+            .filter((d) => !d.individual_note)
+            .flatMap((d) => {
+            const notes = d.notes.filter((n) => !n.system);
+            const first = notes[0];
+            if (!first)
+                return [];
+            for (const n of notes)
+                this.remember(n);
+            return [
+                {
+                    id: d.id,
+                    resolved: first.resolved === true,
+                    ...(first.resolved_by && attributable
+                        ? { resolvedBy: first.resolved_by.username }
+                        : {}),
+                    comments: notes.map((n) => {
+                        const editor = editors.has(n.id) ? editors.get(n.id) : UNKNOWN_EDITOR;
+                        return { author: n.author.username, body: n.body, ...(editor ? { editor } : {}) };
+                    }),
+                },
+            ];
+        });
+    }
+    // One thread per finding, each its own request: a position GitLab
+    // rejects (400) leaves that finding in the summary, and any other failure
+    // is a warning, so one bad comment never costs the rest or the summary.
+    async publishFindings(_report, fresh) {
+        if (fresh.length === 0)
+            return { posted: [], warnings: [] };
+        const refs = diffRefs(await this.mr());
+        const diffs = await this.options.code.getDiff();
+        const posted = [];
+        const warnings = [];
+        for (const { finding, body } of fresh) {
+            const position = positionOf(finding.file, finding.lineRange.end, diffs, refs);
+            if (!position)
+                continue;
+            try {
+                await this.options.api.createDiscussion(this.options.iid, body, position);
+                posted.push(finding.fingerprint);
+            }
+            catch (error) {
+                if (error instanceof GitLabApiError && error.status === 400)
+                    continue;
+                warnings.push(`could not comment on ${finding.file}:${finding.lineRange.end}: ${errorMessage(error)}`);
+            }
+        }
+        return { posted, warnings };
+    }
+    async writeSummary(existing, body) {
+        if (existing)
+            await this.options.api.updateNote(this.options.iid, Number(existing.id), body);
+        else
+            await this.options.api.createNote(this.options.iid, body);
+    }
+    resolveThread(id) {
+        return this.options.api.resolveDiscussion(this.options.iid, id);
+    }
+    remember(note) {
+        this.ids.set(note.author.username, note.author.id);
+        if (note.resolved_by)
+            this.ids.set(note.resolved_by.username, note.resolved_by.id);
+    }
+    noteEditors() {
+        this.editors ??= this.options.api.noteEditors(this.options.iid);
+        return this.editors;
+    }
+    mr() {
+        this.mergeRequest ??= this.options.snapshot
+            ? Promise.resolve(this.options.snapshot)
+            : this.options.api.getMergeRequest(this.options.iid);
+        return this.mergeRequest;
+    }
+}
+function diffRefs(mr) {
+    if (!mr.diff_refs)
+        throw new Error(`merge request !${mr.iid} has no diff yet; try again shortly`);
+    return mr.diff_refs;
+}
+// "https://gitlab.example.com/group/sub/project/-/merge_requests/7" names
+// the project "group/sub/project".
+function projectPath(webUrl) {
+    try {
+        return new URL(webUrl).pathname.split("/-/")[0]?.replace(/^\/+/, "") ?? webUrl;
+    }
+    catch {
+        return webUrl;
+    }
+}
+// Where GitLab puts a comment on the new version's line: an added line takes
+// its new number, an unchanged one both; a line outside the diff has none.
+export function positionOf(file, line, diffs, refs) {
+    const diff = diffs.find((d) => d.newPath === file);
+    if (!diff)
+        return undefined;
+    for (const hunk of diff.hunks) {
+        for (const l of hunk.lines) {
+            if (l.kind === "delete" || l.newLine !== line)
+                continue;
+            return {
+                position_type: "text",
+                base_sha: refs.base_sha,
+                start_sha: refs.start_sha,
+                head_sha: refs.head_sha,
+                old_path: diff.oldPath,
+                new_path: diff.newPath,
+                new_line: line,
+                ...(l.kind === "context" ? { old_line: l.oldLine } : {}),
+            };
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=adapter.js.map

package/dist/client.d.ts

@@ -0,0 +1,107 @@
+import { z } from "zod";
+declare const mergeRequestSchema: z.ZodObject<{
+    iid: z.ZodNumber;
+    title: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    author: z.ZodNullable<z.ZodObject<{
+        id: z.ZodNumber;
+        username: z.ZodString;
+    }, z.core.$strip>>;
+    web_url: z.ZodString;
+    source_project_id: z.ZodNumber;
+    target_project_id: z.ZodNumber;
+    diff_refs: z.ZodNullable<z.ZodObject<{
+        base_sha: z.ZodString;
+        start_sha: z.ZodString;
+        head_sha: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type MergeRequest = z.infer<typeof mergeRequestSchema>;
+declare const noteSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    body: z.ZodString;
+    author: z.ZodObject<{
+        id: z.ZodNumber;
+        username: z.ZodString;
+    }, z.core.$strip>;
+    system: z.ZodBoolean;
+    type: z.ZodNullable<z.ZodString>;
+    resolvable: z.ZodOptional<z.ZodBoolean>;
+    resolved: z.ZodOptional<z.ZodBoolean>;
+    resolved_by: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodNumber;
+        username: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type Note = z.infer<typeof noteSchema>;
+declare const discussionSchema: z.ZodObject<{
+    id: z.ZodString;
+    individual_note: z.ZodBoolean;
+    notes: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        body: z.ZodString;
+        author: z.ZodObject<{
+            id: z.ZodNumber;
+            username: z.ZodString;
+        }, z.core.$strip>;
+        system: z.ZodBoolean;
+        type: z.ZodNullable<z.ZodString>;
+        resolvable: z.ZodOptional<z.ZodBoolean>;
+        resolved: z.ZodOptional<z.ZodBoolean>;
+        resolved_by: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            id: z.ZodNumber;
+            username: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Discussion = z.infer<typeof discussionSchema>;
+export interface Position {
+    position_type: "text";
+    base_sha: string;
+    start_sha: string;
+    head_sha: string;
+    old_path: string;
+    new_path: string;
+    new_line: number;
+    old_line?: number;
+}
+export declare class GitLabApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface GitLabApiOptions {
+    token: string;
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare const DEVELOPER = 30;
+export declare class GitLabApi {
+    private readonly project;
+    private readonly options;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(project: string | number, options: GitLabApiOptions);
+    currentUser(): Promise<{
+        id: number;
+        username: string;
+    }>;
+    fullPath(): Promise<string>;
+    resolvesOutdatedThreads(): Promise<boolean | undefined>;
+    getMergeRequest(iid: number): Promise<MergeRequest>;
+    listNotes(iid: number): Promise<Note[]>;
+    listDiscussions(iid: number): Promise<Discussion[]>;
+    createNote(iid: number, body: string): Promise<void>;
+    updateNote(iid: number, noteId: number, body: string): Promise<void>;
+    createDiscussion(iid: number, body: string, position: Position): Promise<void>;
+    resolveDiscussion(iid: number, discussionId: string): Promise<void>;
+    accessLevel(userId: number): Promise<number>;
+    findUser(username: string): Promise<number | undefined>;
+    noteEditors(iid: number): Promise<Map<number, string | undefined>>;
+    private pages;
+    private graphql;
+    private request;
+    private send;
+}
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -0,0 +1,233 @@
+import { retryDecision } from "@open-cr-agent/vcs-platform";
+import { z } from "zod";
+// Commit ids reach git as arguments; anything else is refused at the boundary.
+const sha = z.string().regex(/^[0-9a-f]{40}([0-9a-f]{24})?$/, "not a commit id");
+const user = z.object({ id: z.number(), username: z.string() });
+const mergeRequestSchema = z.object({
+    iid: z.number(),
+    title: z.string(),
+    description: z.string().nullable(),
+    author: user.nullable(),
+    web_url: z.string(),
+    source_project_id: z.number(),
+    target_project_id: z.number(),
+    // Null while GitLab is still preparing the diff of a new merge request.
+    diff_refs: z.object({ base_sha: sha, start_sha: sha, head_sha: sha }).nullable(),
+});
+const noteSchema = z.object({
+    id: z.number(),
+    body: z.string(),
+    author: user,
+    system: z.boolean(),
+    // null for a plain comment, "DiscussionNote" in a thread, "DiffNote" on a line.
+    type: z.string().nullable(),
+    resolvable: z.boolean().optional(),
+    resolved: z.boolean().optional(),
+    resolved_by: user.nullable().optional(),
+});
+const discussionSchema = z.object({
+    id: z.string(),
+    individual_note: z.boolean(),
+    notes: z.array(noteSchema),
+});
+export class GitLabApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+const PER_PAGE = 100;
+const MAX_NOTE_PAGES = 30;
+const MAX_DISCUSSION_PAGES = 10;
+const MAX_EDITOR_PAGES = 30;
+// Developer: may push to unprotected branches, the nearest to GitHub's write.
+export const DEVELOPER = 30;
+const EDITORS_QUERY = `query($path: ID!, $iid: String!, $after: String) {
+  project(fullPath: $path) {
+    mergeRequest(iid: $iid) {
+      notes(first: 100, after: $after) {
+        pageInfo { hasNextPage endCursor }
+        nodes { id lastEditedBy { username } }
+      }
+    }
+  }
+}`;
+const editorsSchema = z.object({
+    project: z.object({
+        mergeRequest: z.object({
+            notes: z.object({
+                pageInfo: z.object({ hasNextPage: z.boolean(), endCursor: z.string().nullable() }),
+                nodes: z.array(z.object({
+                    id: z.string(),
+                    lastEditedBy: z.object({ username: z.string() }).nullable().optional(),
+                })),
+            }),
+        }),
+    }),
+});
+// A thin REST and GraphQL client for one project: every response is
+// validated before it reaches the adapter, and errors never echo the token.
+export class GitLabApi {
+    project;
+    options;
+    baseUrl;
+    fetchImpl;
+    // `project` is the numeric id or the full path ("group/project").
+    constructor(project, options) {
+        this.project = project;
+        this.options = options;
+        this.baseUrl = (options.baseUrl ?? "https://gitlab.com/api/v4").replace(/\/+$/, "");
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async currentUser() {
+        return user.parse(await this.send("GET", `${this.baseUrl}/user`, "/user"));
+    }
+    // The project's full path, which GraphQL takes instead of the id.
+    async fullPath() {
+        const data = z.object({ path_with_namespace: z.string() }).parse(await this.request("GET", ""));
+        return data.path_with_namespace;
+    }
+    // Whether a push resolves the threads on lines it changed, recording the
+    // pusher as the one who resolved them; undefined when GitLab does not say.
+    async resolvesOutdatedThreads() {
+        const data = z
+            .object({ resolve_outdated_diff_discussions: z.boolean().nullish() })
+            .parse(await this.request("GET", ""));
+        return data.resolve_outdated_diff_discussions ?? undefined;
+    }
+    async getMergeRequest(iid) {
+        return mergeRequestSchema.parse(await this.request("GET", `/merge_requests/${iid}`));
+    }
+    async listNotes(iid) {
+        return this.pages(`/merge_requests/${iid}/notes?sort=asc&order_by=created_at`, noteSchema, MAX_NOTE_PAGES);
+    }
+    async listDiscussions(iid) {
+        return this.pages(`/merge_requests/${iid}/discussions`, discussionSchema, MAX_DISCUSSION_PAGES);
+    }
+    async createNote(iid, body) {
+        await this.request("POST", `/merge_requests/${iid}/notes`, { body });
+    }
+    async updateNote(iid, noteId, body) {
+        await this.request("PUT", `/merge_requests/${iid}/notes/${noteId}`, { body });
+    }
+    async createDiscussion(iid, body, position) {
+        await this.request("POST", `/merge_requests/${iid}/discussions`, { body, position });
+    }
+    async resolveDiscussion(iid, discussionId) {
+        await this.request("PUT", `/merge_requests/${iid}/discussions/${encodeURIComponent(discussionId)}?resolved=true`);
+    }
+    // The user's role in the project, inherited from groups included; 0 when
+    // they are not a member.
+    async accessLevel(userId) {
+        try {
+            const data = z
+                .object({ access_level: z.number() })
+                .parse(await this.request("GET", `/members/all/${userId}`));
+            return data.access_level;
+        }
+        catch (error) {
+            if (error instanceof GitLabApiError && error.status === 404)
+                return 0;
+            throw error;
+        }
+    }
+    async findUser(username) {
+        const found = z
+            .array(user)
+            .parse(await this.send("GET", `${this.baseUrl}/users?username=${encodeURIComponent(username)}`, "/users"));
+        return found.find((u) => u.username === username)?.id;
+    }
+    // Who last edited each note of the merge request, by note id; REST does
+    // not say, and a note's updated_at also moves when its thread is resolved.
+    async noteEditors(iid) {
+        const path = await this.fullPath();
+        const editors = new Map();
+        let after = null;
+        for (let page = 0; page < MAX_EDITOR_PAGES; page += 1) {
+            const data = editorsSchema.parse(await this.graphql(EDITORS_QUERY, { path, iid: String(iid), after }));
+            const { nodes, pageInfo } = data.project.mergeRequest.notes;
+            for (const node of nodes) {
+                const id = Number(node.id.slice(node.id.lastIndexOf("/") + 1));
+                if (Number.isInteger(id))
+                    editors.set(id, node.lastEditedBy?.username);
+            }
+            if (!pageInfo.hasNextPage)
+                break;
+            after = pageInfo.endCursor;
+        }
+        return editors;
+    }
+    async pages(path, schema, maxPages) {
+        const items = [];
+        const joiner = path.includes("?") ? "&" : "?";
+        for (let page = 1; page <= maxPages; page += 1) {
+            const batch = z
+                .array(schema)
+                .parse(await this.request("GET", `${path}${joiner}per_page=${PER_PAGE}&page=${page}`));
+            items.push(...batch);
+            if (batch.length < PER_PAGE)
+                break;
+        }
+        return items;
+    }
+    async graphql(query, variables) {
+        const url = this.baseUrl.endsWith("/api/v4")
+            ? `${this.baseUrl.slice(0, -"/v4".length)}/graphql`
+            : `${this.baseUrl}/graphql`;
+        const result = z
+            .object({
+            data: z.unknown().optional(),
+            errors: z.array(z.object({ message: z.string() })).optional(),
+        })
+            .parse(await this.send("POST", url, "/graphql", { query, variables }, true));
+        if (result.errors?.length) {
+            throw new GitLabApiError(200, `GitLab GraphQL failed: ${result.errors.map((e) => e.message).join("; ")}`);
+        }
+        return result.data;
+    }
+    request(method, path, body) {
+        const project = encodeURIComponent(String(this.project));
+        return this.send(method, `${this.baseUrl}/projects/${project}${path}`, path, body);
+    }
+    // GraphQL queries are safe to repeat, although they are POSTs; REST POSTs
+    // create notes and threads, and are not.
+    async send(method, url, path, body, idempotent = method !== "POST") {
+        const sleep = this.options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        for (let attempt = 1;; attempt += 1) {
+            const init = {
+                method,
+                headers: {
+                    Accept: "application/json",
+                    Authorization: `Bearer ${this.options.token}`,
+                    "User-Agent": "open-cr-agent",
+                    ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+                },
+                signal: AbortSignal.timeout(30_000),
+            };
+            if (body !== undefined)
+                init.body = JSON.stringify(body);
+            let response;
+            try {
+                response = await this.fetchImpl(url, init);
+            }
+            catch (error) {
+                const next = retryDecision(method, idempotent, "network_error", attempt);
+                if (!next.retry)
+                    throw error;
+                await sleep(next.waitMs);
+                continue;
+            }
+            if (response.ok)
+                return response.status === 204 ? undefined : response.json();
+            const detail = (await response.text().catch(() => "")).slice(0, 500);
+            const next = retryDecision(method, idempotent, { status: response.status, headers: response.headers, body: detail }, attempt);
+            if (next.retry) {
+                await sleep(next.waitMs);
+                continue;
+            }
+            throw new GitLabApiError(response.status, `GitLab ${method} ${path.split("?")[0]} failed with ${response.status}: ${detail}`);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./adapter.js";
+export * from "./client.js";
+export * from "./plugin.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./adapter.js";
+export * from "./client.js";
+export * from "./plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/plugin.d.ts

@@ -0,0 +1,3 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+export declare const gitlabPlugin: OcraPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { GitLabAdapter } from "./adapter.js";
+import { GitLabApi } from "./client.js";
+const optionsSchema = z.object({
+    // The project's numeric id or full path ("group/project").
+    project: z.union([z.number().int().positive(), z.string().min(1)]),
+    iid: z.number().int().positive(),
+    token: z.string().min(1),
+    apiUrl: z.string().url().optional(),
+    fetch: z.custom((value) => typeof value === "function").optional(),
+    code: z.custom((value) => typeof value === "object" &&
+        value !== null &&
+        ["getDiff", "readFile", "searchCode"].every((m) => typeof value[m] === "function"), "code must provide getDiff, readFile and searchCode"),
+    snapshot: z
+        .custom((value) => typeof value === "object" && value !== null && "diff_refs" in value)
+        .optional(),
+    history: z
+        .custom((value) => typeof value === "object" &&
+        value !== null &&
+        typeof value.filesChangedSince === "function", "history must provide filesChangedSince")
+        .optional(),
+});
+export const gitlabPlugin = {
+    name: "vcs-gitlab",
+    configure(ctx) {
+        ctx.registerVcs("gitlab", (raw) => {
+            const options = optionsSchema.parse(raw);
+            const api = new GitLabApi(options.project, {
+                token: options.token,
+                ...(options.apiUrl ? { baseUrl: options.apiUrl } : {}),
+                ...(options.fetch ? { fetch: options.fetch } : {}),
+            });
+            return new GitLabAdapter({
+                iid: options.iid,
+                api,
+                code: options.code,
+                ...(options.history ? { history: options.history } : {}),
+                ...(options.snapshot ? { snapshot: options.snapshot } : {}),
+            });
+        });
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@open-cr-agent/vcs-gitlab",
+  "version": "0.1.2",
+  "description": "GitLab merge request adapter for Open-CR-Agent",
+  "keywords": [
+    "code-review",
+    "gitlab",
+    "merge-request"
+  ],
+  "license": "Apache-2.0",
+  "homepage": "https://ocra.majincheng.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jma49/Open-CR-Agent.git",
+    "directory": "packages/vcs-gitlab"
+  },
+  "bugs": "https://github.com/jma49/Open-CR-Agent/issues",
+  "engines": {
+    "node": ">=22.19"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "dependencies": {
+    "@open-cr-agent/core": "0.1.2",
+    "@open-cr-agent/vcs-platform": "0.1.2",
+    "zod": "^4.6.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}