@urateam/core 0.1.0

package/dist/repo/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/repo/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiC9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,OAAO,GAAG,QAAQ,GAAG,QAAmB,GACpD,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B/C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB"}

package/dist/repo/github.js

@@ -0,0 +1,164 @@
+import { Octokit } from "@octokit/rest";
+import { createAppAuth } from "@octokit/auth-app";
+/**
+ * Create an authenticated Octokit instance using GitHub App credentials.
+ */
+export async function createGitHubClient(config) {
+    const octokit = new Octokit({
+        authStrategy: createAppAuth,
+        auth: {
+            appId: config.appId,
+            privateKey: config.privateKey,
+            installationId: config.installationId,
+        },
+    });
+    return octokit;
+}
+/**
+ * Create a pull request and return the PR URL (html_url).
+ */
+export async function createPR(octokit, options) {
+    const response = await octokit.pulls.create({
+        owner: options.owner,
+        repo: options.repo,
+        head: options.branch,
+        base: options.base,
+        title: options.title,
+        body: options.body,
+        draft: options.draft ?? false,
+    });
+    return response.data.html_url;
+}
+/**
+ * Add a comment to a pull request.
+ */
+export async function addPRComment(octokit, owner, repo, prNumber, body) {
+    await octokit.issues.createComment({
+        owner,
+        repo,
+        issue_number: prNumber,
+        body,
+    });
+}
+/**
+ * Count the number of unique approving reviews on a PR.
+ * Uses the latest state per reviewer — a reviewer who approved then requested changes
+ * is not counted as approving.
+ */
+export async function getPRApprovalCount(octokit, owner, repo, prNumber) {
+    const { data: reviews } = await octokit.pulls.listReviews({
+        owner,
+        repo,
+        pull_number: prNumber,
+        per_page: 100,
+    });
+    // Keep only the latest review state per reviewer user id
+    const latestByReviewer = new Map();
+    for (const review of reviews) {
+        const userId = review.user?.id ?? 0;
+        latestByReviewer.set(userId, review.state);
+    }
+    return [...latestByReviewer.values()].filter((state) => state === "APPROVED").length;
+}
+/**
+ * Get all passing/failing check names for a commit SHA.
+ * Covers both legacy commit statuses and modern GitHub check runs.
+ * Returns a map from check name → conclusion ("success" | "failure" | "pending" | …).
+ */
+export async function getPRCheckResults(octokit, owner, repo, sha) {
+    const results = new Map();
+    // Legacy commit statuses
+    try {
+        const { data: combined } = await octokit.repos.getCombinedStatusForRef({
+            owner,
+            repo,
+            ref: sha,
+        });
+        for (const status of combined.statuses) {
+            results.set(status.context, status.state); // "success" | "failure" | "pending" | "error"
+        }
+    }
+    catch {
+        // Ignore — repo may not use legacy statuses
+    }
+    // Modern check runs
+    try {
+        const { data: checkData } = await octokit.checks.listForRef({
+            owner,
+            repo,
+            ref: sha,
+            per_page: 100,
+        });
+        for (const run of checkData.check_runs) {
+            results.set(run.name, run.conclusion ?? "pending");
+        }
+    }
+    catch {
+        // Ignore — repo may not use checks API
+    }
+    return results;
+}
+/**
+ * Merge a pull request via the GitHub API.
+ * Returns { merged: true } on success.
+ * Returns { merged: false, message } if branch protection prevents the merge or there is a conflict.
+ * Throws on unexpected errors.
+ */
+export async function mergePRViaApi(octokit, owner, repo, prNumber, mergeMethod = "squash") {
+    try {
+        const response = await octokit.pulls.merge({
+            owner,
+            repo,
+            pull_number: prNumber,
+            merge_method: mergeMethod,
+        });
+        return {
+            merged: response.data.merged,
+            message: response.data.message ?? "Merged successfully",
+        };
+    }
+    catch (err) {
+        const status = err?.status ?? 0;
+        const message = err?.message ?? String(err);
+        if (status === 405) {
+            // Branch protection rules prevented the merge
+            return { merged: false, message: `Branch protection prevented merge: ${message}` };
+        }
+        if (status === 409) {
+            // Merge conflict
+            return { merged: false, message: `Merge conflict: ${message}` };
+        }
+        if (status === 422) {
+            // Validation failed (e.g. PR already merged)
+            return { merged: false, message: `Merge validation failed: ${message}` };
+        }
+        throw err;
+    }
+}
+/**
+ * Re-request review from the current reviewers on a pull request.
+ * Fetches the list of requested reviewers from the PR and re-requests them.
+ * Returns true if review was re-requested, false if there were no reviewers to re-request.
+ */
+export async function rerequestPRReview(octokit, owner, repo, prNumber) {
+    // Get current requested reviewers
+    const { data: pr } = await octokit.pulls.get({
+        owner,
+        repo,
+        pull_number: prNumber,
+    });
+    const reviewers = pr.requested_reviewers?.map((r) => r.login) ?? [];
+    const teamReviewers = pr.requested_teams?.map((t) => t.slug) ?? [];
+    if (reviewers.length === 0 && teamReviewers.length === 0) {
+        return false;
+    }
+    await octokit.pulls.requestReviewers({
+        owner,
+        repo,
+        pull_number: prNumber,
+        reviewers,
+        team_reviewers: teamReviewers,
+    });
+    return true;
+}
+//# sourceMappingURL=github.js.map

package/dist/repo/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/repo/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAkBlD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;KACF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAgB,EAChB,OAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;KAC9B,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,IAAY;IAEZ,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QACjC,KAAK;QACL,IAAI;QACJ,YAAY,EAAE,QAAQ;QACtB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACxD,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IACH,yDAAyD;IACzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACpC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,yBAAyB;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC;YACrE,KAAK;YACL,IAAI;YACJ,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,8CAA8C;QAC3F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAO,OAAe,CAAC,MAAM,CAAC,UAAU,CAAC;YACnE,KAAK;YACL,IAAI;YACJ,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,GAAG;SACd,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,UAAgE,EAAE,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,cAA6C,QAAQ;IAErD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YACzC,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC5B,OAAO,EAAG,QAAQ,CAAC,IAAY,CAAC,OAAO,IAAI,qBAAqB;SACjE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,8CAA8C;YAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,OAAO,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,iBAAiB;YACjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,6CAA6C;YAC7C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,OAAO,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,QAAgB;IAEhB,kCAAkC;IAClC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3C,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,EAAE,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAErF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACnC,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/repo/gitlab.d.ts

@@ -0,0 +1,47 @@
+/**
+ * GitLab repo provider.
+ *
+ * Supports:
+ *  - Clone via GitLab deploy tokens (embed credentials in the remote URL).
+ *  - Merge request creation via the GitLab REST API.
+ *  - Self-hosted GitLab instances via the optional `host` field.
+ */
+export interface GitLabConfig {
+    /** Personal access token, project access token, or deploy token with api scope. */
+    token: string;
+    /**
+     * GitLab host (no trailing slash). Defaults to "https://gitlab.com".
+     * Override for self-hosted instances, e.g. "https://gitlab.example.com".
+     */
+    host?: string;
+}
+export interface CreateMROptions {
+    /** GitLab namespace+project path, e.g. "myorg/myrepo". */
+    projectPath: string;
+    /** Source branch to merge from. */
+    sourceBranch: string;
+    /** Target branch to merge into. */
+    targetBranch: string;
+    title: string;
+    description: string;
+}
+/**
+ * Inject deploy-token credentials into a GitLab HTTPS clone URL so that
+ * `git clone` / `git push` works without interactive prompts.
+ *
+ * Input:  https://gitlab.com/myorg/myrepo.git
+ * Output: https://<tokenUser>:<token>@gitlab.com/myorg/myrepo.git
+ *
+ * If the URL already contains credentials this is a no-op.
+ */
+export declare function buildAuthenticatedUrl(repoUrl: string, config: GitLabConfig, tokenUser?: string): string;
+/**
+ * Create a merge request via the GitLab REST API.
+ * Returns the MR web URL on success.
+ */
+export declare function createMR(config: GitLabConfig, options: CreateMROptions): Promise<string>;
+/**
+ * Add a comment (note) to an existing merge request.
+ */
+export declare function addMRComment(config: GitLabConfig, projectPath: string, mrIid: number, body: string): Promise<void>;
+//# sourceMappingURL=gitlab.d.ts.map

package/dist/repo/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../src/repo/gitlab.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,EACpB,SAAS,SAAW,GACnB,MAAM,CASR;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/repo/gitlab.js

@@ -0,0 +1,91 @@
+/**
+ * GitLab repo provider.
+ *
+ * Supports:
+ *  - Clone via GitLab deploy tokens (embed credentials in the remote URL).
+ *  - Merge request creation via the GitLab REST API.
+ *  - Self-hosted GitLab instances via the optional `host` field.
+ */
+/**
+ * Inject deploy-token credentials into a GitLab HTTPS clone URL so that
+ * `git clone` / `git push` works without interactive prompts.
+ *
+ * Input:  https://gitlab.com/myorg/myrepo.git
+ * Output: https://<tokenUser>:<token>@gitlab.com/myorg/myrepo.git
+ *
+ * If the URL already contains credentials this is a no-op.
+ */
+export function buildAuthenticatedUrl(repoUrl, config, tokenUser = "oauth2") {
+    const parsed = new URL(repoUrl);
+    if (parsed.username) {
+        // Already has credentials — don't overwrite.
+        return repoUrl;
+    }
+    parsed.username = tokenUser;
+    parsed.password = config.token;
+    return parsed.toString();
+}
+/**
+ * Create a merge request via the GitLab REST API.
+ * Returns the MR web URL on success.
+ */
+export async function createMR(config, options) {
+    const host = config.host ?? "https://gitlab.com";
+    const encodedPath = encodeURIComponent(options.projectPath);
+    const apiUrl = `${host}/api/v4/projects/${encodedPath}/merge_requests`;
+    const body = JSON.stringify({
+        source_branch: options.sourceBranch,
+        target_branch: options.targetBranch,
+        title: options.title,
+        description: options.description,
+        remove_source_branch: true,
+    });
+    const response = await fetch(apiUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "PRIVATE-TOKEN": config.token,
+        },
+        body,
+    });
+    if (response.status === 409) {
+        // MR already exists for this source→target — fetch the existing one
+        const listUrl = `${host}/api/v4/projects/${encodedPath}/merge_requests?source_branch=${encodeURIComponent(options.sourceBranch)}&target_branch=${encodeURIComponent(options.targetBranch)}&state=opened`;
+        const listResp = await fetch(listUrl, {
+            headers: { "PRIVATE-TOKEN": config.token },
+        });
+        if (listResp.ok) {
+            const mrs = (await listResp.json());
+            if (mrs.length > 0)
+                return mrs[0].web_url;
+        }
+        // Couldn't find existing MR — fall through to error
+    }
+    if (!response.ok) {
+        await response.text().catch(() => { }); // drain body
+        throw new Error(`GitLab API error ${response.status} creating MR`);
+    }
+    const data = (await response.json());
+    return data.web_url;
+}
+/**
+ * Add a comment (note) to an existing merge request.
+ */
+export async function addMRComment(config, projectPath, mrIid, body) {
+    const host = config.host ?? "https://gitlab.com";
+    const encodedPath = encodeURIComponent(projectPath);
+    const apiUrl = `${host}/api/v4/projects/${encodedPath}/merge_requests/${mrIid}/notes`;
+    const response = await fetch(apiUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "PRIVATE-TOKEN": config.token,
+        },
+        body: JSON.stringify({ body }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "<no body>");
+        throw new Error(`GitLab API error ${response.status} adding MR comment: ${text}`);
+    }
+}
+//# sourceMappingURL=gitlab.js.map

package/dist/repo/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/repo/gitlab.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,MAAoB,EACpB,SAAS,GAAG,QAAQ;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,6CAA6C;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IAC/B,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAoB,EACpB,OAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAAC;IACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,GAAG,IAAI,oBAAoB,WAAW,iBAAiB,CAAC;IAEvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,oBAAoB,EAAE,IAAI;KAC3B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,MAAM,CAAC,KAAK;SAC9B;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,oEAAoE;QACpE,MAAM,OAAO,GAAG,GAAG,IAAI,oBAAoB,WAAW,iCAAiC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC;QACzM,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;YAClE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,CAAC;QACD,oDAAoD;IACtD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,aAAa;QACpD,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,MAAM,cAAc,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,WAAmB,EACnB,KAAa,EACb,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAAC;IACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,IAAI,oBAAoB,WAAW,mBAAmB,KAAK,QAAQ,CAAC;IAEtF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,MAAM,CAAC,KAAK;SAC9B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,MAAM,uBAAuB,IAAI,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/repo/index.d.ts

@@ -0,0 +1,7 @@
+export { gitExec, gitExecSafe, gitExecRaw, cloneRepo, fetchLatest, createWorktree, createWorktreeFromRemote, deleteWorktree, pushBranch, pushBranchForce, autoCommitChanges, rebaseBranch, abortRebase, createPRViaCli, mergePRViaCli, getDiffLineCount, checkDuplicateBranch, branchName, getCurrentBranch, verifyBranchMatch, installPrePushHook, cleanupWorktrees, } from "./git.js";
+export { createGitHubClient, createPR, addPRComment, } from "./github.js";
+export type { GitHubConfig, CreatePROptions } from "./github.js";
+export { buildAuthenticatedUrl, createMR, addMRComment, } from "./gitlab.js";
+export type { GitLabConfig, CreateMROptions } from "./gitlab.js";
+export { resolveRepo, parseRepoUrl, parseGitLabUrl } from "./config.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/repo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/repo/index.js

@@ -0,0 +1,5 @@
+export { gitExec, gitExecSafe, gitExecRaw, cloneRepo, fetchLatest, createWorktree, createWorktreeFromRemote, deleteWorktree, pushBranch, pushBranchForce, autoCommitChanges, rebaseBranch, abortRebase, createPRViaCli, mergePRViaCli, getDiffLineCount, checkDuplicateBranch, branchName, getCurrentBranch, verifyBranchMatch, installPrePushHook, cleanupWorktrees, } from "./git.js";
+export { createGitHubClient, createPR, addPRComment, } from "./github.js";
+export { buildAuthenticatedUrl, createMR, addMRComment, } from "./gitlab.js";
+export { resolveRepo, parseRepoUrl, parseGitLabUrl } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/repo/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,YAAY,GACb,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,YAAY,GACb,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/repo/tech-stack.d.ts

@@ -0,0 +1,13 @@
+export interface TechStackProfile {
+    languages: string[];
+    frameworks: string[];
+    buildSystems: string[];
+    hasDevcontainer: boolean;
+    devcontainerPath?: string;
+}
+/**
+ * Detect the tech stack of a project by scanning for marker files.
+ * Fast, file-existence-based detection — no AST parsing.
+ */
+export declare function detectTechStack(worktreePath: string): Promise<TechStackProfile>;
+//# sourceMappingURL=tech-stack.d.ts.map

package/dist/repo/tech-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tech-stack.d.ts","sourceRoot":"","sources":["../../src/repo/tech-stack.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4CrF"}

package/dist/repo/tech-stack.js

@@ -0,0 +1,112 @@
+import { access, readFile } from "node:fs/promises";
+import { join } from "node:path";
+const MARKERS = [
+    {
+        file: "package.json",
+        language: "javascript",
+        buildSystem: "npm",
+        detectFrameworks: (content) => {
+            const frameworks = [];
+            try {
+                const pkg = JSON.parse(content);
+                const allDeps = {
+                    ...pkg.dependencies,
+                    ...pkg.devDependencies,
+                };
+                if (allDeps.typescript || pkg.devDependencies?.typescript)
+                    frameworks.push("typescript");
+                if (allDeps.react)
+                    frameworks.push("react");
+                if (allDeps.next)
+                    frameworks.push("nextjs");
+                if (allDeps.vue)
+                    frameworks.push("vue");
+                if (allDeps["@angular/core"])
+                    frameworks.push("angular");
+                if (allDeps.express)
+                    frameworks.push("express");
+                if (allDeps["@nestjs/core"])
+                    frameworks.push("nestjs");
+                if (allDeps.hono)
+                    frameworks.push("hono");
+                if (allDeps.svelte)
+                    frameworks.push("svelte");
+            }
+            catch {
+                // Invalid JSON — skip framework detection
+            }
+            return frameworks;
+        },
+    },
+    { file: "tsconfig.json", language: "typescript" },
+    { file: "Cargo.toml", language: "rust", buildSystem: "cargo" },
+    { file: "go.mod", language: "go", buildSystem: "go-mod" },
+    { file: "pyproject.toml", language: "python", buildSystem: "poetry" },
+    { file: "requirements.txt", language: "python", buildSystem: "pip" },
+    { file: "Pipfile", language: "python", buildSystem: "pipenv" },
+    { file: "pom.xml", language: "java", buildSystem: "maven" },
+    { file: "build.gradle", language: "java", buildSystem: "gradle" },
+    { file: "build.gradle.kts", language: "kotlin", buildSystem: "gradle" },
+    { file: "Gemfile", language: "ruby", buildSystem: "bundler" },
+    { file: "composer.json", language: "php", buildSystem: "composer" },
+    { file: "mix.exs", language: "elixir", buildSystem: "mix" },
+    { file: "pnpm-lock.yaml", buildSystem: "pnpm" },
+    { file: "yarn.lock", buildSystem: "yarn" },
+    { file: "bun.lockb", buildSystem: "bun" },
+];
+async function fileExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detect the tech stack of a project by scanning for marker files.
+ * Fast, file-existence-based detection — no AST parsing.
+ */
+export async function detectTechStack(worktreePath) {
+    const languages = new Set();
+    const frameworks = new Set();
+    const buildSystems = new Set();
+    // Check all markers in parallel
+    const checks = MARKERS.map(async (marker) => {
+        const filePath = join(worktreePath, marker.file);
+        const exists = await fileExists(filePath);
+        if (!exists)
+            return;
+        if (marker.language)
+            languages.add(marker.language);
+        if (marker.buildSystem)
+            buildSystems.add(marker.buildSystem);
+        if (marker.detectFrameworks) {
+            try {
+                const content = await readFile(filePath, "utf-8");
+                for (const fw of marker.detectFrameworks(content)) {
+                    frameworks.add(fw);
+                }
+            }
+            catch {
+                // Can't read file — skip framework detection
+            }
+        }
+    });
+    await Promise.all(checks);
+    // Typescript detection from tsconfig upgrades javascript → typescript
+    if (languages.has("typescript") && languages.has("javascript")) {
+        languages.delete("javascript");
+    }
+    // Check for devcontainer
+    const devcontainerPath = ".devcontainer/devcontainer.json";
+    const hasDevcontainer = await fileExists(join(worktreePath, devcontainerPath));
+    return {
+        languages: [...languages],
+        frameworks: [...frameworks],
+        buildSystems: [...buildSystems],
+        hasDevcontainer,
+        devcontainerPath: hasDevcontainer ? devcontainerPath : undefined,
+    };
+}
+//# sourceMappingURL=tech-stack.js.map

package/dist/repo/tech-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tech-stack.js","sourceRoot":"","sources":["../../src/repo/tech-stack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkBjC,MAAM,OAAO,GAAkB;IAC7B;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,YAAY;QACtB,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,CAAC,OAAe,EAAE,EAAE;YACpC,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG;oBACd,GAAG,GAAG,CAAC,YAAY;oBACnB,GAAG,GAAG,CAAC,eAAe;iBACvB,CAAC;gBACF,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,eAAe,EAAE,UAAU;oBAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACzF,IAAI,OAAO,CAAC,KAAK;oBAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,OAAO,CAAC,IAAI;oBAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,OAAO,CAAC,GAAG;oBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,OAAO,CAAC,eAAe,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,OAAO,CAAC,OAAO;oBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChD,IAAI,OAAO,CAAC,cAAc,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI;oBAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,OAAO,CAAC,MAAM;oBAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KACF;IACD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE;IACjD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;IAC9D,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE;IACzD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;IACrE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IACpE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;IAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;IAC3D,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE;IACjE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;IACvE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE;IAC7D,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE;IACnE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE;IAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE;CAC1C,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAAoB;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,MAAM,CAAC,QAAQ;YAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,WAAW;YAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE7D,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClD,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,sEAAsE;IACtE,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;IAC3D,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;QAC3B,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/B,eAAe;QACf,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,3 @@
+export { SECURITY_REVIEW_CHECKLIST, REVIEW_OUTPUT_FORMAT } from "./review-checklist.js";
+export { createSandboxConfig } from "./sandbox.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,3 @@
+export { SECURITY_REVIEW_CHECKLIST, REVIEW_OUTPUT_FORMAT } from "./review-checklist.js";
+export { createSandboxConfig } from "./sandbox.js";
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/security/review-checklist.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Security review checklist used by the review stage agent.
+ */
+export declare const SECURITY_REVIEW_CHECKLIST = "## Security Review Checklist\n\n### 1. INJECTION VULNERABILITIES\n- [ ] No SQL injection: all queries use parameterized statements or an ORM\n- [ ] No XSS: user input is escaped before rendering in HTML\n- [ ] No command injection: shell commands do not interpolate user input\n- [ ] No path traversal: file paths are validated and canonicalized\n\n### 2. AUTHENTICATION & AUTHORIZATION\n- [ ] All endpoints require authentication unless explicitly public\n- [ ] Authorization checks verify the caller owns or has access to the resource\n- [ ] Tokens and sessions have appropriate expiration\n- [ ] Sensitive operations require re-authentication or elevated permissions\n\n### 3. DATA EXPOSURE\n- [ ] No secrets or credentials in source code or logs\n- [ ] API responses do not leak internal IDs, stack traces, or PII\n- [ ] Error messages are generic and do not reveal implementation details\n- [ ] Sensitive data is encrypted at rest and in transit\n\n### 4. DEPENDENCY SAFETY\n- [ ] No known vulnerable dependencies (check advisories)\n- [ ] Dependencies are pinned to specific versions or ranges\n- [ ] No unnecessary dependencies added\n- [ ] Sub-dependencies do not introduce supply-chain risk\n";
+/**
+ * Instructions for the review agent on how to format findings as JSON.
+ */
+export declare const REVIEW_OUTPUT_FORMAT = "Output your findings as a JSON array. Each finding must have this shape:\n\n{\n  \"severity\": \"blocking\" | \"warning\" | \"suggestion\",\n  \"file\": \"path/to/file.ts\",\n  \"line\": 42,\n  \"category\": \"SQL Injection\" | \"XSS\" | \"Command Injection\" | \"Path Traversal\" | \"Auth\" | \"Data Exposure\" | \"Dependency\" | \"Other\",\n  \"description\": \"Clear explanation of the issue\",\n  \"fix\": \"Suggested remediation\"\n}\n\nIf no issues are found, return an empty array: []\n";
+//# sourceMappingURL=review-checklist.d.ts.map

package/dist/security/review-checklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-checklist.d.ts","sourceRoot":"","sources":["../../src/security/review-checklist.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,yBAAyB,srCAyBrC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,kfAYhC,CAAC"}

package/dist/security/review-checklist.js

@@ -0,0 +1,46 @@
+/**
+ * Security review checklist used by the review stage agent.
+ */
+export const SECURITY_REVIEW_CHECKLIST = `## Security Review Checklist
+
+### 1. INJECTION VULNERABILITIES
+- [ ] No SQL injection: all queries use parameterized statements or an ORM
+- [ ] No XSS: user input is escaped before rendering in HTML
+- [ ] No command injection: shell commands do not interpolate user input
+- [ ] No path traversal: file paths are validated and canonicalized
+
+### 2. AUTHENTICATION & AUTHORIZATION
+- [ ] All endpoints require authentication unless explicitly public
+- [ ] Authorization checks verify the caller owns or has access to the resource
+- [ ] Tokens and sessions have appropriate expiration
+- [ ] Sensitive operations require re-authentication or elevated permissions
+
+### 3. DATA EXPOSURE
+- [ ] No secrets or credentials in source code or logs
+- [ ] API responses do not leak internal IDs, stack traces, or PII
+- [ ] Error messages are generic and do not reveal implementation details
+- [ ] Sensitive data is encrypted at rest and in transit
+
+### 4. DEPENDENCY SAFETY
+- [ ] No known vulnerable dependencies (check advisories)
+- [ ] Dependencies are pinned to specific versions or ranges
+- [ ] No unnecessary dependencies added
+- [ ] Sub-dependencies do not introduce supply-chain risk
+`;
+/**
+ * Instructions for the review agent on how to format findings as JSON.
+ */
+export const REVIEW_OUTPUT_FORMAT = `Output your findings as a JSON array. Each finding must have this shape:
+
+{
+  "severity": "blocking" | "warning" | "suggestion",
+  "file": "path/to/file.ts",
+  "line": 42,
+  "category": "SQL Injection" | "XSS" | "Command Injection" | "Path Traversal" | "Auth" | "Data Exposure" | "Dependency" | "Other",
+  "description": "Clear explanation of the issue",
+  "fix": "Suggested remediation"
+}
+
+If no issues are found, return an empty array: []
+`;
+//# sourceMappingURL=review-checklist.js.map

package/dist/security/review-checklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-checklist.js","sourceRoot":"","sources":["../../src/security/review-checklist.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyBxC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;CAYnC,CAAC"}

package/dist/security/sandbox.d.ts

@@ -0,0 +1,7 @@
+import type { SandboxConfig } from "../types.js";
+/**
+ * Creates a sandbox configuration for an agent run.
+ * Each run gets an isolated workdir under the base directory.
+ */
+export declare function createSandboxConfig(runId: string, baseDir?: string): SandboxConfig;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/security/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwBjD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,MAAyB,GACjC,aAAa,CAOf"}

package/dist/security/sandbox.js

@@ -0,0 +1,31 @@
+const DEFAULT_BASE_DIR = "/var/agent-runs";
+const ALLOWED_DOMAINS = [
+    "github.com",
+    "api.linear.app",
+    "mcp.linear.app",
+    "registry.npmjs.org",
+    "pypi.org",
+];
+const DENY_READ = [
+    "~/.ssh/*",
+    "~/.aws/*",
+    "/etc/shadow",
+    "~/.claude/*",
+];
+const DENY_WRITE = [
+    "/etc/*",
+    "~/.claude/*",
+];
+/**
+ * Creates a sandbox configuration for an agent run.
+ * Each run gets an isolated workdir under the base directory.
+ */
+export function createSandboxConfig(runId, baseDir = DEFAULT_BASE_DIR) {
+    return {
+        workdir: `${baseDir}/${runId}/worktree`,
+        allowedDomains: [...ALLOWED_DOMAINS],
+        denyRead: [...DENY_READ],
+        denyWrite: [...DENY_WRITE],
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/security/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,UAAU;CACX,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,UAAU;IACV,UAAU;IACV,aAAa;IACb,aAAa;CACd,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,QAAQ;IACR,aAAa;CACd,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,UAAkB,gBAAgB;IAElC,OAAO;QACL,OAAO,EAAE,GAAG,OAAO,IAAI,KAAK,WAAW;QACvC,cAAc,EAAE,CAAC,GAAG,eAAe,CAAC;QACpC,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC;QACxB,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC;KAC3B,CAAC;AACJ,CAAC"}