@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/platform/gitlab/schemas.js

@@ -0,0 +1,251 @@
+import { z } from "zod";
+// ---- Webhook payloads -------------------------------------------------------
+const projectSchema = z.object({
+    id: z.number().int(),
+    path_with_namespace: z.string(),
+    git_http_url: z.string().url().refine((u) => /^https?:\/\//i.test(u), "must be http(s)"),
+    default_branch: z.string().nullable(),
+    web_url: z.string(),
+});
+const userSchema = z.object({
+    id: z.number().int(),
+    username: z.string(),
+    name: z.string(),
+});
+// Work item reference embedded in Note Hook payloads. The JSON key is `issue`
+// (GitLab's wire name — Note Hook only fires for issue-type work items among
+// the work item family; non-issue work item comments do not arrive via Note
+// Hook). We keep the field name `issue` to match the wire; the TS type is
+// named WorkItemRef.
+export const workItemRefSchema = z.object({
+    id: z.number().int(),
+    iid: z.number().int(),
+    title: z.string(),
+    // GitLab sends `null` (not "") for a work item created without a
+    // description — the REST API does the same. Typed nullable here and
+    // normalized to "" by the ingress, matching the GitHub/Gitea adapters.
+    description: z.string().nullish(),
+    url: z.string().url(),
+});
+// Note Hook: comment on a work item. GitLab's noteable_type is "Issue" for
+// issue-type work items (the only work item type that triggers Note Hook).
+// ponytail: noteable_type literal "Issue" is GitLab's wire value, not our
+//   concept. Note Hook does not fire for non-issue work item types (task,
+//   epic, etc.); their comments would arrive through different event shapes
+//   GitLab does not currently emit. Revisit when GitLab extends Note Hook.
+export const NoteHookPayloadSchema = z.object({
+    object_kind: z.literal("note"),
+    event_type: z.literal("note"),
+    user: userSchema,
+    project: projectSchema,
+    object_attributes: z.object({
+        id: z.number().int(),
+        note: z.string(),
+        noteable_type: z.literal("Issue"),
+        author_id: z.number().int(),
+        action: z.enum(["create", "update"]),
+        url: z.string(),
+    }),
+    issue: workItemRefSchema,
+});
+// Work Item Hook: work item created/opened. object_kind is "issue" for issues,
+// "work_item" for all other work item types (task, test_case, epic, ...).
+// object_attributes.type carries the work item type ("Issue", "Task", ...).
+export const WorkItemHookPayloadSchema = z.object({
+    object_kind: z.literal("issue").or(z.literal("work_item")),
+    event_type: z.literal("issue").or(z.literal("work_item")),
+    user: userSchema,
+    project: projectSchema,
+    object_attributes: z.object({
+        id: z.number().int(),
+        iid: z.number().int(),
+        title: z.string(),
+        // Same wire quirk as workItemRefSchema: `null` for an empty description.
+        description: z.string().nullish(),
+        action: z.enum(["open", "close", "reopen", "update"]),
+        url: z.string().url(),
+        type: z.string().optional(),
+    }),
+});
+// Pipeline Hook: a CI pipeline changes status. Only a terminal `failed` status
+// is interesting to DevBot. `merge_request` is present when the pipeline ran
+// for an MR (not every pipeline does); its source_branch lets the handler match
+// the DevBot-created MR registry without a branch-name convention.
+export const PipelineHookPayloadSchema = z.object({
+    object_kind: z.literal("pipeline"),
+    user: userSchema.optional(),
+    project: projectSchema,
+    object_attributes: z.object({
+        id: z.number().int(),
+        status: z.string(),
+        ref: z.string(),
+        sha: z.string().optional(),
+    }),
+    merge_request: z
+        .object({
+        iid: z.number().int(),
+        source_branch: z.string(),
+    })
+        .optional(),
+});
+// ---- GitLab REST API responses ---------------------------------------------
+export const NoteSchema = z.object({
+    id: z.number().int(),
+    body: z.string(),
+});
+// Issue note as returned by GET /projects/:id/issues/:iid/notes. Richer than
+// the NoteSchema above (which is the minimal shape for POST's return value):
+// the list response carries author + system + created_at. Fields optional
+// defensively — GitLab has historically omitted fields in some contexts; the
+// bot's logic needs only id, body, author.id.
+export const IssueNoteSchema = z.object({
+    id: z.number().int(),
+    body: z.string(),
+    system: z.boolean().optional(),
+    author: z
+        .object({
+        id: z.number().int(),
+        username: z.string(),
+        name: z.string(),
+    })
+        .optional(),
+    created_at: z.string().optional(),
+});
+export const MergeRequestSchema = z.object({
+    id: z.number().int(),
+    iid: z.number().int(),
+    source_branch: z.string(),
+    target_branch: z.string(),
+    state: z.string(),
+    web_url: z.string(),
+});
+// GET /projects/:id/members/all/:user_id — inherited membership (resolves
+// group-level roles). Only the fields the trigger-authorization gate needs:
+// the user's effective access_level in the project (10 Guest, 20 Reporter,
+// 30 Developer, 40 Maintainer, 50 Owner). 404 = not a member at all → deny.
+export const ProjectMemberSchema = z.object({
+    id: z.number().int(),
+    access_level: z.number().int(),
+});
+// GET /users?username=<login> — used to resolve a access rule's username
+// to its stable numeric id at add time. GitLab returns an array; an exact-match
+// entry is picked by the caller.
+export const UserLookupSchema = z.object({
+    id: z.number().int(),
+    username: z.string(),
+    name: z.string(),
+});
+// GET /projects/:id/issues/:iid/discussions — used by findNoteDiscussionId to
+// map a triggering note id → its discussion id (so a Step-0 error reply can be
+// posted in the same thread as the mention). Only the id of each note in a
+// discussion is needed for the lookup.
+const DiscussionNoteRefSchema = z.object({ id: z.number().int() });
+export const DiscussionSchema = z.object({
+    id: z.string(),
+    notes: z.array(DiscussionNoteRefSchema),
+});
+// Single issue as returned by GET /projects/:id/issues/:iid. Only the fields
+// the reset authorization check needs (author + assignees). GitLab returns
+// `assignees` as an array (multi-assignee); `assignee` singular is deprecated.
+// Not admin-only — works with the bot's project-scoped token.
+export const IssueDetailSchema = z.object({
+    id: z.number().int(),
+    iid: z.number().int(),
+    author: z.object({ id: z.number().int() }),
+    assignees: z.array(z.object({ id: z.number().int() })).optional(),
+});
+// ---- MCP tool response schemas ---------------------------------------------
+// Returned by GET /projects/:id/issues (list) and GET /projects/:id/issues/:iid
+// (single). Carry the fields an agent working on a work item needs to triage
+// and act: identity, state, content, links, labels, assignees. Fields optional
+// defensively because GitLab omits some on higher tiers / older instances; the
+// MCP tools only read what's present, never assume a field is set.
+const gitlabUserBrief = z.object({
+    id: z.number().int(),
+    username: z.string(),
+    name: z.string(),
+    web_url: z.string().optional(),
+});
+export const IssueListItemSchema = z.object({
+    id: z.number().int(),
+    iid: z.number().int(),
+    title: z.string(),
+    description: z.string().nullish(),
+    state: z.string(),
+    web_url: z.string(),
+    labels: z.array(z.string()).optional(),
+    assignees: z.array(gitlabUserBrief).optional(),
+    author: gitlabUserBrief.optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    closed_at: z.string().nullable().optional(),
+    due_date: z.string().nullable().optional(),
+    milestone: z
+        .object({ id: z.number().int(), title: z.string() })
+        .nullable()
+        .optional(),
+    references: z
+        .object({ short: z.string(), relative: z.string(), full: z.string() })
+        .optional(),
+    user_notes_count: z.number().int().optional(),
+    confidential: z.boolean().optional(),
+});
+export const MergeRequestListItemSchema = z.object({
+    id: z.number().int(),
+    iid: z.number().int(),
+    title: z.string(),
+    description: z.string().optional(),
+    state: z.string(),
+    web_url: z.string(),
+    source_branch: z.string().optional(),
+    target_branch: z.string().optional(),
+    labels: z.array(z.string()).optional(),
+    author: gitlabUserBrief.optional(),
+    assignees: z.array(gitlabUserBrief).optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    merged_at: z.string().nullable().optional(),
+    draft: z.boolean().optional(),
+    references: z
+        .object({ short: z.string(), relative: z.string(), full: z.string() })
+        .optional(),
+    user_notes_count: z.number().int().optional(),
+});
+// GET /projects/:id/merge_requests/:iid/discussions — MR discussions include
+// diff-anchored annotations (DiffNote with position), general threads
+// (DiscussionNote), and system notes. Richer than the issue-only DiscussionSchema
+// above (which is minimal on purpose for the note→discussion lookup): this one
+// carries the fields an agent reviewing an MR needs — resolution state, diff
+// position, code suggestions, author. Fields optional defensively because
+// GitLab omits some on higher tiers / older instances (same convention as the
+// list-item schemas). Reuses gitlabUserBrief for author / resolved_by.
+const MergeRequestNoteSchema = z.object({
+    id: z.number().int(),
+    type: z.string().nullable().optional(),
+    body: z.string(),
+    system: z.boolean().optional(),
+    author: gitlabUserBrief.optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    resolvable: z.boolean().optional(),
+    resolved: z.boolean().optional(),
+    resolved_by: gitlabUserBrief.nullable().optional(),
+    resolved_at: z.string().nullable().optional(),
+    position: z.record(z.string(), z.unknown()).optional(),
+    suggestions: z.array(z.record(z.string(), z.unknown())).optional(),
+});
+export const MergeRequestDiscussionSchema = z.object({
+    id: z.string(),
+    individual_note: z.boolean().optional(),
+    notes: z.array(MergeRequestNoteSchema),
+});
+// Markdown uploads API response (POST /projects/:id/uploads). `markdown` is the
+// server-rendered reference; `full_path` is the host-absolute path.
+export const UploadSchema = z.object({
+    id: z.number().int().optional(),
+    alt: z.string().optional(),
+    url: z.string(),
+    full_path: z.string().optional(),
+    markdown: z.string(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/platform/gitlab/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/platform/gitlab/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAEhF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,qBAAqB;AACrB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,iEAAiE;IACjE,oEAAoE;IACpE,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAGH,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,aAAa;IACtB,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;KAChB,CAAC;IACF,KAAK,EAAE,iBAAiB;CACzB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,aAAa;IACtB,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,yEAAyE;QACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;CACH,CAAC,CAAC;AAGH,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,mEAAmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAClC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,aAAa;IACtB,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;IACF,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KAC1B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;SACD,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAC/B,CAAC,CAAC;AAGH,yEAAyE;AACzE,gFAAgF;AAChF,iCAAiC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,uCAAuC;AACvC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACxC,CAAC,CAAC;AAKH,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACnD,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACrE,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACrE,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,6EAA6E;AAC7E,sEAAsE;AACtE,kFAAkF;AAClF,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAGH,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC"}

package/dist/platform/gitlab/signature.js

@@ -0,0 +1,52 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+// ponytail: 5-minute replay guard. Standard Webhooks spec recommends a
+//   tolerance window; 300s is the spec default. Tighten if a clock-skewed
+//   GitLab instance delivers legitimately late, loosen if replay attacks
+//   matter more. Upgrade path: store seen webhook-id values for the window.
+const MAX_SKEW_SEC = 300;
+function b64decode(s) {
+    return Buffer.from(s, "base64");
+}
+export function b64encode(buf) {
+    return buf.toString("base64");
+}
+function headerString(headers, name) {
+    const v = headers[name.toLowerCase()];
+    if (Array.isArray(v))
+        return v[0];
+    return v;
+}
+export function verifyWebhookSignature(signingToken, headers, rawBody, nowMs) {
+    const sigHeader = headerString(headers, "webhook-signature");
+    const id = headerString(headers, "webhook-id");
+    const ts = headerString(headers, "webhook-timestamp");
+    if (!sigHeader || !id || !ts)
+        return false;
+    const tsNum = Number(ts);
+    if (!Number.isFinite(tsNum))
+        return false;
+    const skew = Math.abs(Math.floor(nowMs / 1000) - tsNum);
+    if (skew > MAX_SKEW_SEC)
+        return false;
+    if (!signingToken.startsWith("whsec_"))
+        return false;
+    let key;
+    try {
+        key = b64decode(signingToken.slice("whsec_".length));
+    }
+    catch {
+        return false;
+    }
+    const message = `${id}.${ts}.${rawBody.toString("utf8")}`;
+    const digest = createHmac("sha256", key).update(message).digest();
+    const expected = Buffer.from(`v1,${b64encode(digest)}`);
+    for (const part of sigHeader.split(" ")) {
+        const got = Buffer.from(part);
+        // ponytail: length-check-before-compare is accepted per Standard Webhooks
+        //   spec; the length leak is negligible (expected length is fixed per key).
+        if (got.length === expected.length && timingSafeEqual(got, expected))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=signature.js.map

package/dist/platform/gitlab/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../../src/platform/gitlab/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,OAAsD,EAAE,IAAY;IACxF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,OAAsD,EACtD,OAAe,EACf,KAAa;IAEb,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACxD,IAAI,IAAI,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IAEtC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/platform/index.js

@@ -0,0 +1,38 @@
+// Platform factory: returns the singleton driver selected by config.PLATFORM.
+// One DevBot process talks to exactly one forge instance.
+import { config } from "../config.js";
+import { gitlabPlatform } from "./gitlab/index.js";
+import { forgejoPlatform } from "./gitealike/forgejo.js";
+import { giteaPlatform } from "./gitealike/gitea.js";
+import { createGithubPlatform } from "./github/index.js";
+let cached;
+export function getPlatform() {
+    if (cached)
+        return cached;
+    switch (config.PLATFORM) {
+        case "forgejo":
+            cached = forgejoPlatform;
+            break;
+        case "gitea":
+            cached = giteaPlatform;
+            break;
+        case "github":
+            cached = createGithubPlatform();
+            break;
+        case "gitlab":
+        default:
+            cached = gitlabPlatform;
+            break;
+    }
+    return cached;
+}
+/** Test hook: reset the memoized driver. */
+export function resetPlatformForTest() {
+    cached = undefined;
+}
+/** Test hook: force a specific driver (e.g. exercise a forge's typed gap in a
+ *  suite whose PLATFORM env selects a different forge). */
+export function setPlatformForTest(platform) {
+    cached = platform;
+}
+//# sourceMappingURL=index.js.map

package/dist/platform/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/platform/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0DAA0D;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,IAAI,MAA4B,CAAC;AAEjC,MAAM,UAAU,WAAW;IACzB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,SAAS;YACZ,MAAM,GAAG,eAAe,CAAC;YACzB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,aAAa,CAAC;YACvB,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAChC,MAAM;QACR,KAAK,QAAQ,CAAC;QACd;YACE,MAAM,GAAG,cAAc,CAAC;YACxB,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,GAAG,QAAQ,CAAC;AACpB,CAAC"}

package/dist/platform/port.js

@@ -0,0 +1,26 @@
+// The Platform port: one aggregate interface assembled from capability
+// sub-interfaces. Callers depend on the port (via `getPlatform()`), never on a
+// specific forge. GitLab, ForgeJo and Gitea each implement it.
+export const CAPABILITY_METHODS = {
+    ingress: ["eventName", "projectIdFromBody", "deliveryId", "verifySignature", "parseWebhook", "generateWebhookSecret"],
+    workItems: [
+        "postComment", "replyInThread", "postErrorReply", "listComments", "getWorkItem",
+        "getWorkItemStateOrNull", "getMemberPermission", "resolveUser", "searchUsers", "listWorkItems",
+        "getWorkItemSummary", "listCommentsFull", "listLabels", "listMilestones",
+    ],
+    changeRequests: ["list", "create", "update", "get", "listReviewDiscussions", "listNotes"],
+    repository: [
+        "getRepo", "branchExists", "firstExistingBranch", "listBranches", "listTree", "getFile",
+        "listCommits", "getCommit", "compare", "listTags", "listMembers", "listReleases",
+        "listWikiPages", "getWikiPage", "searchProject",
+    ],
+    ci: ["listPipelines", "getPipeline", "listPipelineJobs", "getJobLog"],
+    gitAuth: ["gitExtraHeader", "cloneUrl"],
+    attachments: ["findRefs", "download", "upload"],
+    onboarding: [
+        "authorizeUrl", "exchangeCode", "currentUser", "listProjects", "addBot", "removeBot",
+        "findOrCreateWebhook", "setWebhookSecret", "ensureCiFailureEvents", "deleteWebhook", "testWebhook",
+    ],
+    links: ["workItemUrl"],
+};
+//# sourceMappingURL=port.js.map

package/dist/platform/port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/platform/port.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,+EAA+E;AAC/E,+DAA+D;AAgT/D,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,uBAAuB,CAAC;IACrH,SAAS,EAAE;QACT,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa;QAC/E,wBAAwB,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe;QAC9F,oBAAoB,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB;KACzE;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,CAAC;IACzF,UAAU,EAAE;QACV,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS;QACvF,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc;QAChF,eAAe,EAAE,aAAa,EAAE,eAAe;KAChD;IACD,EAAE,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,CAAC;IACrE,OAAO,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;IACvC,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC/C,UAAU,EAAE;QACV,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;QACpF,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,aAAa;KACnG;IACD,KAAK,EAAE,CAAC,aAAa,CAAC;CACkB,CAAC"}

package/dist/platform/types.js

@@ -0,0 +1,80 @@
+// Platform-neutral domain types for the DevBot forge abstraction.
+//
+// Every driver (GitLab, ForgeJo, Gitea) speaks in these shapes. Callers
+// (webhook, runner, MCP tools) depend on these — never on a forge's wire
+// format. The property that names a project-internal work item number is
+// `number` (GitLab calls it `iid`; Gitea/ForgeJo call it `number`).
+/** Stream-side tail accumulator. Retains only the last `maxBytes` bytes seen
+ *  while counting the total, so a full-read of an over-cap log stays bounded
+ *  in memory. Used by the drivers' raw fetchers in `overflow: "tail"` mode. */
+export class TailAccumulator {
+    maxBytes;
+    chunks = [];
+    len = 0;
+    total = 0;
+    constructor(maxBytes) {
+        this.maxBytes = maxBytes;
+    }
+    push(value) {
+        this.total += value.byteLength;
+        this.chunks.push(Buffer.from(value));
+        this.len += value.byteLength;
+        // Compact once we hold ~2× the cap so the chunk list cannot grow without
+        // bound on a very large stream; keeps the retained window to the last cap.
+        if (this.len > this.maxBytes * 2) {
+            const merged = Buffer.concat(this.chunks);
+            const keep = merged.subarray(Math.max(0, merged.length - this.maxBytes));
+            this.chunks = [Buffer.from(keep)];
+            this.len = keep.length;
+        }
+    }
+    result() {
+        const merged = Buffer.concat(this.chunks);
+        const bytes = merged.subarray(Math.max(0, merged.length - this.maxBytes));
+        return { bytes, totalBytes: this.total };
+    }
+}
+/** Build a FileContent from the raw end-of-stream slice of a larger source.
+ *  Job logs keep their tail (the failure is at the end); when the source was
+ *  larger than the slice we prefix an explicit head-omitted marker so the
+ *  result is never silently empty. `totalBytes` is the size before truncation. */
+export function tailFileContent(tail, totalBytes, contentType, maxBytes) {
+    const truncated = totalBytes > maxBytes;
+    if (!truncated) {
+        return { content: tail.toString("utf8"), truncated: false, bytes: totalBytes, contentType };
+    }
+    // Callers may pass an already-sliced tail (streaming fetchers) or the whole
+    // buffer (GitHub inflates the ZIP first); slice here so both are correct.
+    const slice = tail.byteLength > maxBytes ? tail.subarray(tail.byteLength - maxBytes) : tail;
+    // The slice boundary can split a multi-byte UTF-8 char; drop the replacement
+    // character it produces so the retained tail starts on a clean boundary.
+    const text = slice.toString("utf8").replace(/^\uFFFD/, "");
+    return {
+        content: `[… ${totalBytes - slice.byteLength} bytes omitted from the start …]\n${text}`,
+        truncated: true,
+        bytes: totalBytes,
+        contentType,
+    };
+}
+// ---- Errors ----------------------------------------------------------------
+/** HTTP error from a forge, normalized. */
+export class PlatformHttpError extends Error {
+    status;
+    op;
+    body;
+    constructor(status, op, body) {
+        super(`platform ${status} on ${op}: ${body}`);
+        this.name = "PlatformHttpError";
+        this.status = status;
+        this.op = op;
+        this.body = body;
+    }
+}
+/** Operation not available on this platform (e.g. CI model differences). */
+export class UnsupportedError extends Error {
+    constructor(op) {
+        super(`operation '${op}' is not supported on this platform`);
+        this.name = "UnsupportedError";
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/platform/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/platform/types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,oEAAoE;AA+JpE;;+EAE+E;AAC/E,MAAM,OAAO,eAAe;IAKG;IAJrB,MAAM,GAAa,EAAE,CAAC;IACtB,GAAG,GAAG,CAAC,CAAC;IACR,KAAK,GAAG,CAAC,CAAC;IAElB,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,IAAI,CAAC,KAAiB;QACpB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC;QAC7B,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;CACF;AAED;;;kFAGkF;AAClF,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,UAAkB,EAClB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC9F,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,qCAAqC,IAAI,EAAE;QACvF,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,WAAW;KACZ,CAAC;AACJ,CAAC;AAqND,+EAA+E;AAE/E,2CAA2C;AAC3C,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,EAAE,CAAS;IACX,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,EAAU,EAAE,IAAY;QAClD,KAAK,CAAC,YAAY,MAAM,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,EAAU;QACpB,KAAK,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/podman.js

@@ -0,0 +1,119 @@
+import { spawn } from "node:child_process";
+import { log } from "./logger.js";
+import { killContainerByName } from "./opencode.js";
+import { appendPodmanPhase } from "./run-log-sink.js";
+const defaultClient = {
+    run(args, opts = {}) {
+        return new Promise((resolve) => {
+            const child = spawn("podman", args, { stdio: ["pipe", "pipe", "pipe"] });
+            const out = [];
+            const err = [];
+            child.stdout.on("data", (b) => out.push(b));
+            child.stderr.on("data", (b) => err.push(b));
+            // Optional stdin (used to stream large payloads into a container without
+            // hitting the argv size limit). Absent → close stdin immediately so a
+            // container reading stdin sees EOF instead of hanging. A write to a child
+            // that exits early raises EPIPE; swallow it (the exit code is the signal).
+            child.stdin.on("error", () => { });
+            if (opts.input !== undefined)
+                child.stdin.end(opts.input);
+            else
+                child.stdin.end();
+            let timer;
+            if (opts.timeoutMs) {
+                timer = setTimeout(() => {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch { /* dead */ }
+                    const i = args.indexOf("--name");
+                    const cname = i >= 0 && i + 1 < args.length ? args[i + 1] : undefined;
+                    if (cname)
+                        killContainerByName(cname);
+                }, opts.timeoutMs);
+            }
+            child.on("error", () => {
+                if (timer)
+                    clearTimeout(timer);
+                // ponytail: don't log podman args — they embed secrets via shq(authJson).
+                //   Log only the container name (non-secret, useful for debugging).
+                const nameIdx = args.indexOf("--name");
+                const containerName = nameIdx >= 0 && nameIdx + 1 < args.length ? args[nameIdx + 1] : undefined;
+                log.error("podman spawn error", { containerName });
+                resolve({ code: -1, stdout: "", stderr: "spawn failed" });
+            });
+            child.on("close", (code) => {
+                if (timer)
+                    clearTimeout(timer);
+                resolve({
+                    code: code ?? -1,
+                    stdout: Buffer.concat(out).toString("utf8"),
+                    stderr: Buffer.concat(err).toString("utf8"),
+                });
+            });
+        });
+    },
+};
+// ponytail: mutable global. ESM live bindings mean consumers read the current
+//   value at access time, so setPodmanClient(mock) before a test takes effect.
+//   Upgrade path: per-instance injection if concurrency matters.
+let client = defaultClient;
+export function setPodmanClient(c) {
+    client = c;
+}
+export function resetPodmanClient() {
+    client = defaultClient;
+}
+// OpenCode can issue parallel MCP tool calls. Helper containers reuse fixed
+// per-work-item names (attachdl/attachread/peersync/gitexclude), so a second
+// launch while the first is live fails with "container name ... already in
+// use" (exit 125). Serialize `podman run` calls that share a --name; different
+// names (and non-run commands) stay concurrent.
+const runChains = new Map();
+function namedContainer(args) {
+    const i = args.indexOf("--name");
+    return i >= 0 && i + 1 < args.length ? args[i + 1] : undefined;
+}
+// The function every caller uses — reads the live binding.
+export async function podman(args, opts) {
+    if (args[0] !== "run") {
+        const result = await client.run(args, opts);
+        captureRunOutput(args, result);
+        return result;
+    }
+    const name = namedContainer(args);
+    if (!name) {
+        const result = await client.run(args, opts);
+        captureRunOutput(args, result);
+        return result;
+    }
+    const previous = runChains.get(name) ?? Promise.resolve();
+    const current = previous.catch(() => { }).then(() => client.run(args, opts));
+    runChains.set(name, current);
+    try {
+        const result = await current;
+        captureRunOutput(args, result);
+        return result;
+    }
+    finally {
+        if (runChains.get(name) === current)
+            runChains.delete(name);
+    }
+}
+// Tee a phase container's output into the active run's log sink (work item #61).
+// Only `podman run` is captured — ps/rm/volume housekeeping is not part of a
+// run's transcript. Best-effort: a capture failure never affects the run.
+function captureRunOutput(args, result) {
+    if (args[0] !== "run")
+        return;
+    const name = namedContainer(args);
+    if (!name)
+        return;
+    try {
+        appendPodmanPhase(name, result.code, result.stdout, result.stderr);
+    }
+    catch (e) {
+        log.warn("run log capture failed", { err: e });
+    }
+}
+//# sourceMappingURL=podman.js.map

package/dist/podman.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"podman.js","sourceRoot":"","sources":["../src/podman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAYtD,MAAM,aAAa,GAAiB;IAClC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE;QACjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA8C,CAAC,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBACrD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,KAAiC,CAAC;YACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC;wBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;oBACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACtE,IAAI,KAAK;wBAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,0EAA0E;gBAC1E,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChG,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,CAAC;oBACN,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;oBAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AACjE,IAAI,MAAM,GAAiB,aAAa,CAAC;AAEzC,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,aAAa,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,gDAAgD;AAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqE,CAAC;AAE/F,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,IAAsD;IACjG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC7B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO;YAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,0EAA0E;AAC1E,SAAS,gBAAgB,CACvB,IAAc,EACd,MAAwD;IAExD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}