@ulysses-ai/create-workspace 0.22.0-beta.0 → 0.23.0-beta.0

package/template/_claude/scripts/task-pr.mjs

@@ -16,14 +16,15 @@
 //
 // Usage:
 //   node task-pr.mjs --create --root <launcher> --branch <branch>
-//                    [--work-item gh:N] [--chat <name> | --repo <r> ...]
+//                    [--work-item gh:N|gl:N] [--chat <name> | --repo <r> ...]
 //                    --body-file <forge-repo>=<path> ... [--out <file>]
 //                    [--force-with-lease]
 //   node task-pr.mjs --merge --root <launcher> --prs <json-from-create>
-//                    [--work-item gh:N]
+//                    [--work-item gh:N|gl:N]
 //
 // Every repo of the task resolves to a merge mode (mergeModeFor below):
-// "forge" — its origin is a forge-hosted owner/name — or "local" — no
+// "forge" — its origin is forge-hosted (github.com, gitlab.com, or the
+// configured self-managed GitLab host) — or "local" — no
 // origin at all, or an explicit "local" override in workspace.json
 // (repos.{repo}.merge / workspace.merge), the escape hatch for a clone
 // whose origin is a third-party upstream nobody here may push to. An
@@ -39,7 +40,9 @@
 // body file is required per forge repo alone; one given for a local repo
 // is ignored). The PR title is the linked issue's title when --work-item
 // is given, else the branch's first commit subject; the body is the
-// repo's body file with `Closes <ref>` appended. Prints
+// repo's body file with a closing reference appended — `Closes <ref>`
+// when the tracker's forge matches the PR's, else the issue's URL (a
+// GitHub `owner/repo#N` reference cannot resolve on GitLab). Prints
 // `{ prs, empty, pushed }` — prs holds forge entries (mode "forge") and
 // local entries (mode "local") alike, every entry carrying its commit
 // count — and, with --out, writes the same JSON to a file — a mid-run
@@ -77,7 +80,7 @@ import { resolve, dirname } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { taskWorktreePath, defaultBranchFor } from './task-worktree.mjs';
-import { WORKSPACE_REPO, repoDirFor, readWorkspace, parseForgeRemote, mergeModeFor } from './merge-mode.mjs';
+import { WORKSPACE_REPO, repoDirFor, readWorkspace, parseForgeRemote, forgeHosts, perRepoForge, mergeModeFor } from './merge-mode.mjs';
 import { readRecord } from './chat-record.mjs';
 import { createForge } from './forges/interface.mjs';
 import { createTracker } from './trackers/interface.mjs';
@@ -97,6 +100,33 @@ function assertForgeEnabled(ws) {
   }
 }
 
+// perRepoForge (from merge-mode.mjs, re-exported below) builds each repo's
+// forge config; see its definition there for why the origin wins over the
+// workspace-level type.
+
+// Which forge an issues adapter's references resolve on — `owner/repo#N`
+// from github-issues only closes on GitHub, `group/sub#N` from
+// gitlab-issues only on GitLab.
+const TRACKER_FORGE = { 'github-issues': 'github', 'gitlab-issues': 'gitlab' };
+
+// The closing line for a PR body. Same forge as the tracker: the native
+// reference (issueRef). Cross-forge — a GitHub tracker's issue referenced
+// from a GitLab MR, or the reverse — cannot use it, since the target forge
+// cannot resolve the reference; the line carries the issue's URL instead.
+// As `Closes {url}` when the tracker mints canonical URLs (issueUrl —
+// both forges close issues referenced by full URL); otherwise as a bare
+// `Refs {url}` on the URL getIssue already returned, which references the
+// issue without claiming close semantics the target forge may not honor.
+function closingLineFor(tracker, issue, workItem, target, trackerConfig) {
+  const ref = tracker.issueRef(workItem, { fromRepo: `${target.owner}/${target.name}` });
+  const trackerForge = trackerConfig?.type ? TRACKER_FORGE[trackerConfig.type] : undefined;
+  if (!trackerForge || !target.forge || trackerForge === target.forge) {
+    return `Closes ${ref}`;
+  }
+  if (typeof tracker.issueUrl === 'function') return `Closes ${tracker.issueUrl(workItem)}`;
+  return issue?.url ? `Refs ${issue.url}` : `Closes ${ref}`;
+}
+
 // Branch names become refs, refspecs, and (via the slug) paths; git's own
 // format check is the authority, and its --branch variant also rejects
 // names a later git call could mistake for an option. It needs no
@@ -236,7 +266,7 @@ async function createPrs(args, deps) {
   // still complete with forge operations disabled.
   if (forgeActive.length > 0) assertForgeEnabled(ws);
   for (const t of forgeActive) {
-    Object.assign(t, parseForgeRemote(gitOut(deps.gitFn, t.worktree, ['remote', 'get-url', 'origin'])));
+    Object.assign(t, parseForgeRemote(gitOut(deps.gitFn, t.worktree, ['remote', 'get-url', 'origin']), { hosts: forgeHosts(ws) }));
   }
   for (const t of forgeActive) {
     const bodyFile = args.bodyFiles.get(t.repo);
@@ -249,11 +279,12 @@ async function createPrs(args, deps) {
   }
 
   let issueTitle = null;
-  let issueRefs = null;
+  let closingLines = null;
   if (args.workItem && ws.workspace?.tracker) {
     const tracker = deps.trackerFactory(ws.workspace.tracker);
-    issueTitle = (await tracker.getIssue(args.workItem)).title;
-    issueRefs = new Map(forgeActive.map((t) => [t.repo, tracker.issueRef(args.workItem, { fromRepo: `${t.owner}/${t.name}` })]));
+    const issue = await tracker.getIssue(args.workItem);
+    issueTitle = issue.title;
+    closingLines = new Map(forgeActive.map((t) => [t.repo, closingLineFor(tracker, issue, args.workItem, t, ws.workspace.tracker)]));
   }
 
   // Local entries are recorded up front, before anything can fail: they are
@@ -273,7 +304,7 @@ async function createPrs(args, deps) {
     }
 
     for (const t of forgeActive) {
-      const forge = deps.forgeFactory({ ...(ws.workspace?.forge ?? {}), repo: `${t.owner}/${t.name}` });
+      const forge = deps.forgeFactory(perRepoForge(ws, t));
       // Idempotency: a re-run must not open a second PR for a branch that
       // already has one open against the same base. Reuse it as-is —
       // re-titling or re-bodying an existing PR is a decision, not a
@@ -282,10 +313,11 @@ async function createPrs(args, deps) {
         .find((p) => p.headRefName === args.branch && p.baseRefName === t.defaultBranch);
       const title = issueTitle ?? firstCommitSubject(deps.gitFn, t, args.branch);
       let body = readFileSync(args.bodyFiles.get(t.repo), 'utf8').replace(/\s*$/, '');
-      if (issueRefs) body = `${body}\n\nCloses ${issueRefs.get(t.repo)}\n`;
+      if (closingLines) body = `${body}\n\n${closingLines.get(t.repo)}\n`;
       const pr = existing ?? await forge.prCreate({ title, body, head: args.branch, base: t.defaultBranch });
       prs.push({
         repo: t.repo, mode: 'forge', owner: t.owner, name: t.name,
+        forge: t.forge, host: t.host,
         number: pr.number, id: pr.id, url: pr.url, isWorkspace: t.isWorkspace, commits: t.commits,
       });
     }
@@ -375,7 +407,14 @@ async function mergePrs(args, deps) {
     }
   }
   if (prs.some((p) => modeOf(p) === 'forge')) assertForgeEnabled(ws);
-  const forgeFor = (p) => deps.forgeFactory({ ...(ws.workspace?.forge ?? {}), repo: `${p.owner}/${p.name}` });
+  // Entries carry their repo's forge and host since GitLab support landed;
+  // older files predate the fields and fall back to the workspace block —
+  // the GitHub default those runs were built under.
+  const forgeFor = (p) => deps.forgeFactory({
+    ...(ws.workspace?.forge ?? {}),
+    ...(p.forge ? { type: p.forge, host: p.host } : {}),
+    repo: `${p.owner}/${p.name}`,
+  });
 
   // State first, so a re-run knows what an earlier run already finished.
   // A PR the forge reports MERGED is done; anything else is offered to
@@ -552,4 +591,4 @@ if (isMainModule(import.meta.url)) {
 }
 
 export { run, parseArgs };
-export { parseForgeRemote, mergeModeFor } from './merge-mode.mjs';
+export { parseForgeRemote, mergeModeFor, perRepoForge, forgeConfigForRepo } from './merge-mode.mjs';

package/template/_claude/scripts/task-worktree.mjs

@@ -23,19 +23,28 @@
 // chat name it also consults the chat record, which is the only place
 // open tasks are listed. /complete-work uses that to pick its flow.
 //
+// Long-lived lane chats sit at the launcher across BOTH lifecycles, so
+// detection also matches the chat's session id against each old session's
+// chatSessions frontmatter — a chat that drove a work-sessions/{name}/
+// session by path is findable from the launcher too (gh:188). The id comes
+// from --session-id, from the named chat record's sessionId, or from
+// $CLAUDE_CODE_SESSION_ID, in that order. Tasks AND sessions at once
+// report model "mixed" and let the operator pick.
+//
 // Usage:
 //   node task-worktree.mjs --root <dir> --create --repo <r> --branch <b> [--base <ref>]
 //   node task-worktree.mjs --root <dir> --remove --repo <r> --branch <b> [--force] [--delete-branch]
-//   node task-worktree.mjs --root <dir> --detect [--cwd <dir>] [--chat <name>]
+//   node task-worktree.mjs --root <dir> --detect [--cwd <dir>] [--chat <name>] [--session-id <id>]
 
 import {
-  readFileSync, writeFileSync, existsSync, mkdirSync, statSync,
+  readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync,
 } from 'node:fs';
 import { realpathSync } from 'node:fs';
 import { join, resolve, relative, sep, isAbsolute, basename, dirname } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { readRecord } from './chat-record.mjs';
+import { readSessionFields } from '../lib/session-frontmatter.mjs';
 import { WORKSPACE_REPO, repoDirFor, mergeModeFor } from './merge-mode.mjs';
 
 function isMainModule(metaUrl) {
@@ -192,9 +201,11 @@ function ensureWorkspaceExcluded(gitFn, rootDir) {
  * Create (or return) the task worktree for {branch} in {repo}.
  *
  * Idempotent: a worktree already at the path on the same branch is a
- * success — /start-work is not guaranteed to run exactly once per task. A
- * path held by anything else is a collision and refuses rather than
- * guessing. Three creation cases, in order:
+ * success — /start-work is not guaranteed to run exactly once per task,
+ * and adopting another chat's task re-runs --create over the owner's
+ * existing worktree, which must be reused (created: false), never
+ * duplicated or failed. A path held by anything else is a collision and
+ * refuses rather than guessing. Three creation cases, in order:
  *   - the local branch exists (a prior remove kept it) → check it out,
  *     keeping its commits;
  *   - only refs/remotes/origin/{branch} exists → the task was started on
@@ -382,6 +393,58 @@ function matchingTasks(rootDir, chat, branch) {
   return tasks.length > 0 ? tasks : null;
 }
 
+// The sessions a chat id has driven, from each tracker's chatSessions. A
+// lane chat at the launcher works a session by path, so cwd can never say
+// which — the id the SessionStart hook registered is the only link. All
+// matches come back (a chat can hop across sessions over days); the caller
+// asks the operator when there is more than one. Archived sessions sit at
+// work-sessions/.archived/{name}/workspace/ — one level too deep for this
+// scan, so they never surface.
+function matchingSessions(rootReal, sessionId) {
+  if (!sessionId) return null;
+  const sessionsDir = sessionsDirFor(rootReal);
+  let names;
+  try {
+    names = readdirSync(sessionsDir).sort();
+  } catch {
+    return null; // no sessions dir — nothing to match
+  }
+  const out = [];
+  for (const name of names) {
+    const tracker = join(sessionsDir, name, 'workspace', 'session.md');
+    if (!existsSync(tracker)) continue;
+    let fields;
+    try {
+      fields = readSessionFields(tracker);
+    } catch {
+      continue; // an unparseable tracker is evidence about the tracker, not this chat
+    }
+    const chats = Array.isArray(fields.chatSessions) ? fields.chatSessions : [];
+    if (!chats.some((c) => c && c.id === sessionId)) continue;
+    out.push({
+      name,
+      branch: typeof fields.branch === 'string' ? fields.branch : null,
+      workItem: typeof fields.workItem === 'string' ? fields.workItem : null,
+      status: typeof fields.status === 'string' ? fields.status : null,
+    });
+  }
+  return out.length > 0 ? out : null;
+}
+
+// Which session id detection matches sessions by: an explicit argument
+// beats the named chat record's sessionId (the record IS this chat's id,
+// keyed stably where a name is renameable), which beats the ambient
+// $CLAUDE_CODE_SESSION_ID — the hook's id, present even when the hook's
+// `Chat record:` line was compacted away.
+function resolveSessionId(rootDir, chat, sessionId, env) {
+  if (sessionId) return sessionId;
+  if (chat) {
+    const rec = readRecord(rootDir, chat);
+    if (rec && rec.sessionId) return rec.sessionId;
+  }
+  return (env && env.CLAUDE_CODE_SESSION_ID) || null;
+}
+
 // One task worktree's detect payload, or null when {path} does not really
 // hold a task: a stale plain directory under .claude/worktrees/ would
 // otherwise detect through cwd and resolve to the repo around it — for the
@@ -408,10 +471,12 @@ function taskWorktreeInfo(gitFn, rootReal, repo, path, chat) {
  * Tell a skill which lifecycle the current directory is under, in order:
  * session (cwd in the old model's tree), task (cwd in a task worktree,
  * enriched with the chat's matching tasks when {chat} is given), then —
- * because task chats run at the launcher, where cwd is just the root —
- * task again if the named chat's record has open tasks. Else none.
+ * because lane chats run at the launcher, where cwd is just the root —
+ * task if the named chat's record has open tasks, session if the chat's
+ * session id appears in any tracker's chatSessions, "mixed" when both.
+ * Else none.
  */
-function detectWorkModel(cwd, root, { chat = null, gitFn = spawnSync } = {}) {
+function detectWorkModel(cwd, root, { chat = null, sessionId = null, gitFn = spawnSync, env = process.env } = {}) {
   const rootReal = realPath(resolve(root));
   const cwdReal = realPath(resolve(cwd));
 
@@ -441,7 +506,10 @@ function detectWorkModel(cwd, root, { chat = null, gitFn = spawnSync } = {}) {
   }
 
   const tasks = matchingTasks(rootReal, chat, null);
+  const sessions = matchingSessions(rootReal, resolveSessionId(rootReal, chat, sessionId, env));
+  if (tasks && sessions) return { model: 'mixed', tasks, sessions };
   if (tasks) return { model: 'task', source: 'chat-record', tasks };
+  if (sessions) return { model: 'session', source: 'chat-sessions', sessions };
 
   return { model: 'none' };
 }
@@ -454,6 +522,7 @@ const VALUE_FLAGS = new Map([
   ['--base', 'base'],
   ['--cwd', 'cwd'],
   ['--chat', 'chat'],
+  ['--session-id', 'sessionId'],
 ]);
 
 // A repo name becomes a path segment under repos/ — one segment only, no
@@ -468,7 +537,7 @@ function isRepoSegment(repo) {
 }
 
 function parseArgs(argv) {
-  const args = { root: '.', mode: null, repo: null, branch: null, base: null, cwd: null, chat: null, force: false, deleteBranch: false };
+  const args = { root: '.', mode: null, repo: null, branch: null, base: null, cwd: null, chat: null, sessionId: null, force: false, deleteBranch: false };
   const rest = argv.slice(2);
   for (let i = 0; i < rest.length; i += 1) {
     const a = rest[i];
@@ -513,7 +582,7 @@ function main() {
   } else if (args.mode === 'remove') {
     out = removeTaskWorktree(args.root, { repo: args.repo, branch: args.branch, force: args.force, deleteBranch: args.deleteBranch });
   } else {
-    out = detectWorkModel(args.cwd || process.cwd(), args.root, { chat: args.chat });
+    out = detectWorkModel(args.cwd || process.cwd(), args.root, { chat: args.chat, sessionId: args.sessionId });
   }
   process.stdout.write(`${JSON.stringify(out, null, 2)}\n`);
 }

package/template/_claude/scripts/template-baseline.mjs

@@ -57,6 +57,14 @@ import { dirname, join, resolve } from 'node:path';
 
 export const BASELINE_PATH = '.claude/.template-baseline.json';
 
+// Where --upgrade stages a RECONSTRUCTED baseline (built from the installed
+// version's npm tarball) inside the payload. It never lands in the launcher:
+// with a remote, /workspace-update classifies inside a task worktree that
+// cannot see launcher-only files, and an untracked launcher baseline would
+// also dirty the launcher against the incoming PR. The payload travels to
+// the worktree by absolute path, so the baseline rides along.
+export const RECONSTRUCTED_BASELINE_NAME = '.template-baseline.reconstructed.json';
+
 // [source name, installed name] pairs for the verbatim-installed roots. The
 // staged payload carries the live names; the template tree stores .claude/ and
 // .mcp.json under the inert names _claude/ and _mcp.json, so scaffold passes
@@ -118,25 +126,38 @@ function* walkFiles(dir, prefix = '') {
 }
 
 /**
- * Read the baseline at <root>/.claude/.template-baseline.json. Returns
- * { templateVersion, files } or null when absent (workspaces older than the
- * baseline's introduction) or unparseable — classification then falls back to
- * the two-way behavior rather than failing the update.
+ * Read a baseline JSON file at an explicit path. Returns
+ * { templateVersion, files, reconstructed } or null when absent or
+ * unparseable — a corrupt baseline is treated exactly like a missing one
+ * (gh:186) so classification falls back to the two-way behavior rather than
+ * failing the update, and reconstruction is not blocked by a broken file.
  */
-export function readBaseline(root) {
-  const path = join(resolve(root), BASELINE_PATH);
+export function readBaselineFile(path) {
   if (!existsSync(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf8'));
     if (!parsed || typeof parsed !== 'object' || typeof parsed.files !== 'object' || parsed.files === null) {
       return null;
     }
-    return { templateVersion: typeof parsed.templateVersion === 'string' ? parsed.templateVersion : null, files: parsed.files };
+    return {
+      templateVersion: typeof parsed.templateVersion === 'string' ? parsed.templateVersion : null,
+      files: parsed.files,
+      reconstructed: parsed.reconstructed === true,
+    };
   } catch {
     return null;
   }
 }
 
+/**
+ * Read the baseline at <root>/.claude/.template-baseline.json. Returns the
+ * parsed baseline or null when absent (workspaces older than the baseline's
+ * introduction) or unparseable.
+ */
+export function readBaseline(root) {
+  return readBaselineFile(join(resolve(root), BASELINE_PATH));
+}
+
 /**
  * Build a baseline from a template source directory (a staged payload with
  * live names, or the template tree via INERT_PAIRS). `version` overrides the
@@ -186,7 +207,10 @@ export function buildBaseline(sourceDir, { pairs = LIVE_PAIRS, version = null }
  * they were for unapplied updates: a file whose workspace content still
  * matches the old baseline while the payload ships something new (a declined
  * `updated` batch) keeps the OLD entry, so the next update still offers the
- * change instead of filing the file away as a local edit.
+ * change instead of filing the file away as a local edit. The previous
+ * baseline defaults to <root>/.claude/.template-baseline.json; pass
+ * opts.previous to override (the worktree flow reads the payload's
+ * reconstructed baseline when the root has none of its own).
  */
 export function writeBaseline(root, sourceDir, opts = {}) {
   const absRoot = resolve(root);
@@ -196,7 +220,7 @@ export function writeBaseline(root, sourceDir, opts = {}) {
       `No verbatim template files found under ${resolve(sourceDir)} — refusing to write an empty baseline`,
     );
   }
-  const previous = readBaseline(absRoot);
+  const previous = 'previous' in opts ? opts.previous : readBaseline(absRoot);
   if (previous) {
     for (const rel of Object.keys(baseline.files)) {
       const oldHash = previous.files[rel];

package/template/_claude/scripts/trackers/gitlab-issues.mjs

@@ -0,0 +1,276 @@
+// GitLab Issues adapter. Wraps the `glab` CLI via an injectable spawnFn
+// (mirrors trackers/github-issues.mjs). Issue IDs are opaque strings of the
+// form "gl:N" — adapters outside this file don't need to parse them;
+// routing is handled by interface.mjs.
+//
+// The repo is a `group/sub/project` path (any depth); a self-managed
+// instance is selected with `host` in the tracker config (GITLAB_HOST for
+// glab, --hostname for `glab api`), defaulting to gitlab.com.
+
+import '../../lib/require-node.mjs';
+import { spawnSync as nodeSpawnSync } from 'node:child_process';
+import { AlreadyAssignedError } from './interface.mjs';
+
+const GITLAB_DEFAULT_HOST = 'gitlab.com';
+
+const STANDARD_LABELS = [
+  { name: 'bug', color: 'd73a4a' },
+  { name: 'feat', color: 'a2eeef' },
+  { name: 'chore', color: 'cfd3d7' },
+  { name: 'P1', color: 'b60205' },
+  { name: 'P2', color: 'fbca04' },
+  { name: 'P3', color: '0e8a16' },
+];
+
+export function createGitlabAdapter(config, { spawnFn = nodeSpawnSync } = {}) {
+  const repo = resolveRepo(config, spawnFn);
+  const host = typeof config?.host === 'string' && config.host ? config.host : GITLAB_DEFAULT_HOST;
+  let loginCache = null;
+
+  function glab(args, { input } = {}) {
+    // GITLAB_HOST always names the resolved instance — always, because an
+    // exported foreign value must not leak into a gitlab.com run — and
+    // aims the -R/--repo slugs at it.
+    const env = { ...process.env, GITLAB_HOST: host };
+    const result = spawnFn('glab', args, {
+      input,
+      encoding: 'utf-8',
+      env,
+      stdio: input !== undefined ? ['pipe', 'pipe', 'pipe'] : ['inherit', 'pipe', 'pipe'],
+    });
+    if (result.status !== 0) {
+      throw new Error(`glab ${args.join(' ')} failed: ${(result.stderr || '').trim()}`);
+    }
+    return result.stdout || '';
+  }
+
+  // `glab api` resolves its host from the CWD's git remote, not from
+  // GITLAB_HOST, so the resolved host is always passed explicitly.
+  function apiArgs(path) {
+    return ['api', path, '--hostname', host];
+  }
+
+  // Paged walk over a `glab api` list endpoint — 100 at a time until a
+  // short page. The list subcommands fetch a single page and cannot
+  // express the server-side filters some of these calls need, so `glab
+  // api` does both jobs.
+  function apiListAll(path, params = []) {
+    const found = [];
+    for (let page = 1; ; page += 1) {
+      const query = [...params, 'per_page=100', `page=${page}`].join('&');
+      const batch = JSON.parse(glab(apiArgs(`${path}?${query}`)));
+      if (!Array.isArray(batch)) {
+        throw new Error(`glab api ${path} returned a non-list: ${JSON.stringify(batch).slice(0, 80)}`);
+      }
+      found.push(...batch);
+      if (batch.length < 100) break;
+    }
+    return found;
+  }
+
+  function currentUser() {
+    if (loginCache) return loginCache;
+    loginCache = JSON.parse(glab(apiArgs('user'))).username;
+    return loginCache;
+  }
+
+  function normalize(raw) {
+    return {
+      id: `gl:${raw.iid}`,
+      number: raw.iid,
+      title: raw.title,
+      body: raw.description || '',
+      state: (raw.state || '').toLowerCase() === 'closed' ? 'closed' : 'open',
+      assignees: (raw.assignees || []).map((a) => a.username),
+      labels: (raw.labels || []).map((l) => (typeof l === 'string' ? l : l.name)),
+      milestone: raw.milestone?.title ?? null,
+      url: raw.web_url,
+      createdAt: raw.created_at,
+      updatedAt: raw.updated_at,
+    };
+  }
+
+  function parseIssueNumber(issueId) {
+    const m = issueId.match(/^gl:(\d+)$/);
+    if (!m) throw new Error(`Not a GitLab issue ID: ${issueId}`);
+    return parseInt(m[1], 10);
+  }
+
+  async function listAssignedToMe() {
+    const me = currentUser();
+    // `glab issue list` defaults to open issues; JSON output is -O here,
+    // -F on the single-entity commands.
+    const stdout = glab(['issue', 'list', '--repo', repo, '--assignee', me, '-O', 'json', '--per-page', '100']);
+    return JSON.parse(stdout).map(normalize);
+  }
+
+  async function listUnassigned() {
+    // The API's server-side `assignee_id=None` filter, paged to the end —
+    // a client-side filter over one `issue list` page saw only the first
+    // hundred open issues.
+    return apiListAll(`projects/${encodeURIComponent(repo)}/issues`, ['state=opened', 'assignee_id=None'])
+      .map(normalize);
+  }
+
+  async function getIssue(issueId) {
+    const num = parseIssueNumber(issueId);
+    const stdout = glab(['issue', 'view', String(num), '--repo', repo, '-F', 'json']);
+    return normalize(JSON.parse(stdout));
+  }
+
+  async function claim(issueId) {
+    const me = currentUser();
+    const issue = await getIssue(issueId);
+    const others = issue.assignees.filter((a) => a !== me);
+    if (others.length > 0) {
+      throw new AlreadyAssignedError(issueId, others);
+    }
+    if (!issue.assignees.includes(me)) {
+      // --assignee replaces the assignee list; with no other assignees
+      // (checked above) that is exactly "assign me".
+      glab(['issue', 'update', String(issue.number), '--repo', repo, '--assignee', me]);
+      return getIssue(issueId);
+    }
+    return issue;
+  }
+
+  async function createIssue({ title, body = '', labels = [], milestone = null }) {
+    const args = ['issue', 'create', '--repo', repo, '--title', title, '--description', body, '--yes'];
+    if (labels.length > 0) args.push('--label', labels.join(','));
+    if (milestone) args.push('--milestone', milestone);
+    const stdout = glab(args);
+    const m = stdout.match(/\/-\/issues\/(\d+)/);
+    if (!m) throw new Error(`Could not parse issue number from: ${stdout.trim()}`);
+    return getIssue(`gl:${m[1]}`);
+  }
+
+  async function comment(issueId, body) {
+    const num = parseIssueNumber(issueId);
+    // glab has no --body-file: the message travels as an argv element.
+    glab(['issue', 'note', String(num), '--repo', repo, '--message', body]);
+  }
+
+  // A closing reference for MR bodies: `#N` closes an issue in the MR's own
+  // project, `group/sub/project#N` reaches one living elsewhere — the same
+  // shapes github-issues renders, with GitLab's full-path reference for the
+  // cross-project case. No `fromRepo` means the MR is in this adapter's own
+  // project.
+  function issueRef(issueId, { fromRepo } = {}) {
+    const num = parseIssueNumber(issueId);
+    return fromRepo && fromRepo !== repo ? `${repo}#${num}` : `#${num}`;
+  }
+
+  // The canonical URL for an issue — what a cross-forge reference needs
+  // (a `group/sub#N` reference cannot resolve on a GitHub PR), minted from
+  // the same host/repo every other URL here is built from.
+  function issueUrl(issueId) {
+    const num = parseIssueNumber(issueId);
+    return `https://${host}/${repo}/-/issues/${num}`;
+  }
+
+  async function closeIssue(issueId, { comment: commentBody } = {}) {
+    const num = parseIssueNumber(issueId);
+    if (commentBody) {
+      glab(['issue', 'note', String(num), '--repo', repo, '--message', commentBody]);
+    }
+    glab(['issue', 'close', String(num), '--repo', repo]);
+  }
+
+  async function ensureLabels() {
+    // No --force equivalent: labels that exist are left as they are, so
+    // this stays idempotent without rewriting a team's chosen colors.
+    const stdout = glab(['label', 'list', '--repo', repo, '-F', 'json', '--per-page', '100']);
+    const existing = new Set(JSON.parse(stdout).map((l) => l.name));
+    for (const { name, color } of STANDARD_LABELS) {
+      if (existing.has(name)) continue;
+      glab(['label', 'create', '--repo', repo, '--name', name, '--color', `#${color}`]);
+    }
+  }
+
+  // `glab milestone create` prints human text (it has no JSON output flag),
+  // and `milestone list` fetches a single page — so listing goes through
+  // the API paged to the end, and a create is verified by re-listing
+  // rather than by parsing what glab printed.
+  async function ensureMilestone({ title, description = '', dueOn = null } = {}) {
+    if (!title) throw new Error('ensureMilestone: title is required');
+    const findByTitle = () => apiListAll(`projects/${encodeURIComponent(repo)}/milestones`)
+      .find((m) => m.title === title);
+    const existing = findByTitle();
+    if (existing) return normalizeMilestone(existing);
+    const args = ['milestone', 'create', '--repo', repo, '--title', title];
+    if (description) args.push('--description', description);
+    if (dueOn) args.push('--due-date', dueOn);
+    glab(args);
+    const created = findByTitle();
+    if (!created) {
+      throw new Error(`milestone "${title}" was not in the milestone list after glab milestone create`);
+    }
+    return normalizeMilestone(created);
+  }
+
+  return {
+    listAssignedToMe,
+    listUnassigned,
+    getIssue,
+    claim,
+    createIssue,
+    comment,
+    closeIssue,
+    issueRef,
+    issueUrl,
+    ensureLabels,
+    ensureMilestone,
+    get identity() { return `gitlab-issues:${repo}`; },
+  };
+}
+
+function normalizeMilestone(raw) {
+  return {
+    number: raw.id,
+    title: raw.title,
+    description: raw.description || '',
+    state: raw.state === 'closed' ? 'closed' : 'open', // GitLab says "active"
+    dueOn: raw.due_date || null,
+    url: raw.web_url,
+  };
+}
+
+// Like github-issues.mjs's resolveRepo, kept local so the adapter stands
+// alone: gitlab.com plus the configured self-managed host, scp-style and
+// scheme URLs (an explicit non-default port stays in the host, so `host`
+// can carry it — gitlab.example.com:8443), nested groups at any depth,
+// optional .git suffix.
+const DEFAULT_PORTS = { https: 443, http: 80, ssh: 22, git: 9418 };
+const SCHEME_URL_RE = /^(?<scheme>https?|ssh|git):\/\/(?:[^@/]+@)?(?<host>[^:/]+)(?::(?<port>\d+))?\/(?<path>.+)$/;
+
+function resolveRepo(config, spawnFn) {
+  if (config?.repo && config.repo !== 'auto') return config.repo;
+  const result = spawnFn('git', ['remote', 'get-url', 'origin'], { encoding: 'utf-8' });
+  if (result.status !== 0) {
+    throw new Error(`git remote get-url failed: ${(result.stderr || '').trim()}`);
+  }
+  const hosts = [GITLAB_DEFAULT_HOST, ...(config?.host ? [String(config.host).toLowerCase()] : [])];
+  const s = result.stdout.trim().replace(/\/+$/, '');
+  let host = null;
+  let path = null;
+  const scp = s.match(/^[^@/]+@([^:/]+):(.+)$/); // scp-style: git@host:path
+  if (scp) {
+    host = scp[1].toLowerCase();
+    path = scp[2];
+  } else {
+    const m = s.match(SCHEME_URL_RE);
+    if (m) {
+      const { scheme, host: h, port } = m.groups;
+      // A non-default port stays part of the host so it can match a
+      // configured host that carries one; a default port drops, so
+      // github.com:443-style URLs still resolve.
+      host = (port && Number(port) !== DEFAULT_PORTS[scheme] ? `${h}:${port}` : h).toLowerCase();
+      path = m.groups.path;
+    }
+  }
+  if (host && path && hosts.includes(host)) {
+    const segments = path.replace(/\.git$/, '').split('/').filter(Boolean);
+    if (segments.length >= 2) return segments.join('/');
+  }
+  throw new Error(`Cannot parse GitLab remote: ${result.stdout.trim()}`);
+}

package/template/_claude/scripts/trackers/interface.mjs

@@ -11,6 +11,7 @@
 
 import '../../lib/require-node.mjs';
 import { createGithubAdapter } from './github-issues.mjs';
+import { createGitlabAdapter } from './gitlab-issues.mjs';
 
 export class AlreadyAssignedError extends Error {
   constructor(issueId, assignees) {
@@ -28,6 +29,8 @@ export function createTracker(config, options = {}) {
   switch (config.type) {
     case 'github-issues':
       return createGithubAdapter(config, options);
+    case 'gitlab-issues':
+      return createGitlabAdapter(config, options);
     default:
       throw new Error(`Unknown tracker type: ${config.type}`);
   }