codeam-cli 2.61.31 → 2.61.33

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `codeam-cli` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.61.32] — 2026-07-24
+
+### Added
+
+- **shared:** Add GitLab as a version_control integration
+
+## [2.61.31] — 2026-07-24
+
+### Added
+
+- **shared:** Make GitHub a first-class version_control integration
+
 ## [2.61.30] — 2026-07-24
 
 ### Added

package/dist/index.js

@@ -641,6 +641,36 @@ var INTEGRATION_REGISTRY = {
     // No MCP: a deployed box already has an authenticated `gh` on PATH.
     delivery: {}
   },
+  gitlab: {
+    id: "gitlab",
+    name: "GitLab",
+    icon: "gitlab",
+    category: "version_control",
+    // LIVE — a user-owned gitlab.com application (Confidential) with BOTH env
+    // callbacks registered, so dev/prod share the client and differ only in
+    // GITLAB_OAUTH_REDIRECT_URI. The backend GitLabOAuthProvider is
+    // config-gated (503 if env unset), so this is safe mid-rollout.
+    //
+    // ⚠️ Unlike `github`, this is a NORMAL `oauth_redirect` integration: its
+    // credential is vaulted here rather than living in a ProviderToken, because
+    // nothing else in the product owns a GitLab connection (GitHub's lives on
+    // the codespaces rail, which is why it's `kind: 'connection'`).
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // GitLab has NO per-resource scopes — `api` is the only one that grants
+      // merge-request WRITE (comment / approve / merge / close), so a
+      // read-only alternative would make the whole MR surface useless.
+      // `write_repository` is the git-over-HTTPS rail for the agent's push;
+      // `api` already covers it for user tokens, but it costs nothing on a
+      // consent screen that already says "complete read/write access" and
+      // changing scopes later forces EVERY user to re-authorize.
+      scopes: ["api", "write_repository"]
+    },
+    // No MCP: the box's `git` is authenticated for push, and the MR surface is
+    // served backend-side by the VCS provider — same shape as `github`.
+    delivery: {}
+  },
   github_issues: {
     id: "github_issues",
     name: "GitHub Issues",
@@ -6325,7 +6355,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.61.31" : "0.0.0-dev",
+    cliVersion: true ? "2.61.33" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6506,7 +6536,7 @@ var os4 = __toESM(require("os"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.61.31",
+  version: "2.61.33",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -7677,7 +7707,7 @@ var CommandRelayService = class _CommandRelayService {
       // fresh + clear the "CLI update available" banner after a self-update
       // (a codespace that reinstalls @latest reconnects via heartbeat, not
       // pair/reconnect). Older backends ignore the extra field.
-      ..."2.61.31" ? { ideVersion: "2.61.31" } : {}
+      ..."2.61.33" ? { ideVersion: "2.61.33" } : {}
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   /**
@@ -17294,8 +17324,24 @@ function githubOwnerRepo(repoRef) {
   if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
   return null;
 }
-function repoCloneUrl(repoRef, cloneToken) {
+function gitlabProjectPath(repoRef) {
   const trimmed = repoRef.trim();
+  const https9 = /^https?:\/\/gitlab\.com\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
+  if (https9) return https9[1];
+  if (!/^https?:\/\//.test(trimmed) && !trimmed.startsWith("git@") && trimmed.includes("/")) {
+    return trimmed.replace(/\.git$/, "");
+  }
+  return null;
+}
+function repoCloneUrl(repoRef, cloneToken, provider = "github") {
+  const trimmed = repoRef.trim();
+  if (provider === "gitlab") {
+    const glPath = gitlabProjectPath(trimmed);
+    if (glPath) {
+      return cloneToken ? `https://oauth2:${cloneToken}@gitlab.com/${glPath}.git` : `https://gitlab.com/${glPath}.git`;
+    }
+    if (/^https?:\/\//.test(trimmed) || trimmed.startsWith("git@")) return trimmed;
+  }
   if (cloneToken) {
     const gh = githubOwnerRepo(trimmed);
     if (gh) {
@@ -17324,12 +17370,15 @@ async function fetchGithubIdentity(token) {
     return null;
   }
 }
-async function configureGitCredentials(dest, repoRef, cloneToken) {
-  const gh = githubOwnerRepo(repoRef.trim());
-  if (!gh || !cloneToken) return;
+async function configureGitCredentials(dest, repoRef, cloneToken, provider = "github") {
+  const isGitlab = provider === "gitlab";
+  if (isGitlab ? !gitlabProjectPath(repoRef.trim()) : !githubOwnerRepo(repoRef.trim())) return;
+  if (!cloneToken) return;
   const credFile = path40.join(dest, ".git", "codeam-credentials");
-  fs36.writeFileSync(credFile, `https://x-access-token:${cloneToken}@github.com
-`, { mode: 384 });
+  const credLine = isGitlab ? `https://oauth2:${cloneToken}@gitlab.com
+` : `https://x-access-token:${cloneToken}@github.com
+`;
+  fs36.writeFileSync(credFile, credLine, { mode: 384 });
   restrictToOwner(credFile);
   const env = nonInteractiveGitEnv();
   const git2 = (args2) => execFileP4("git", ["-C", dest, ...args2], { timeout: 3e4, env });
@@ -17344,20 +17393,17 @@ async function configureGitCredentials(dest, repoRef, cloneToken) {
     `store --file=${credFilePosix}`
   ]).catch(() => {
   });
-  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef)]).catch(() => {
+  await git2(["remote", "set-url", "origin", repoCloneUrl(repoRef, void 0, provider)]).catch(() => {
   });
   const hasIdentity = await git2(["config", "user.email"]).then(() => true).catch(() => false);
   if (!hasIdentity) {
-    const who = await fetchGithubIdentity(cloneToken);
-    if (who?.login) {
-      await git2(["config", "--local", "user.name", who.login]).catch(() => {
-      });
-    }
-    const email = who?.email ?? (who?.login ? `${who.login}@users.noreply.github.com` : void 0);
-    if (email) {
-      await git2(["config", "--local", "user.email", email]).catch(() => {
-      });
-    }
+    const who = isGitlab ? null : await fetchGithubIdentity(cloneToken);
+    const login = who?.login ?? "CodeAgent";
+    await git2(["config", "--local", "user.name", login]).catch(() => {
+    });
+    const email = who?.email ?? (isGitlab ? "agent@codeagent-mobile.com" : `${login}@users.noreply.github.com`);
+    await git2(["config", "--local", "user.email", email]).catch(() => {
+    });
   }
 }
 function maskToken(text, cloneToken) {
@@ -17367,7 +17413,7 @@ function maskToken(text, cloneToken) {
   }
   return masked;
 }
-async function prepareWorkspace(repoOrPath, deployId, cloneToken) {
+async function prepareWorkspace(repoOrPath, deployId, cloneToken, provider = "github") {
   if (isAbsolutePathTarget(repoOrPath)) {
     if (!fs36.existsSync(repoOrPath)) {
       throw new Error(`deploy target path does not exist: ${repoOrPath}`);
@@ -17376,11 +17422,11 @@ async function prepareWorkspace(repoOrPath, deployId, cloneToken) {
   }
   const dest = path40.join(selfHostedWorkspaceRoot(), deployId);
   if (fs36.existsSync(path40.join(dest, ".git"))) {
-    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken);
+    if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
     return dest;
   }
   fs36.mkdirSync(selfHostedWorkspaceRoot(), { recursive: true, mode: 448 });
-  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken);
+  const cloneUrl = repoCloneUrl(repoOrPath, cloneToken, provider);
   try {
     await execFileP4("git", ["clone", "--depth", "1", cloneUrl, dest], {
       timeout: 12e4,
@@ -17391,7 +17437,7 @@ async function prepareWorkspace(repoOrPath, deployId, cloneToken) {
     const reason = err instanceof Error ? err.message : String(err);
     throw new Error(`git clone failed for ${maskCloneUrl(cloneUrl)}: ${maskToken(reason, cloneToken)}`);
   }
-  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken);
+  if (cloneToken) await configureGitCredentials(dest, repoOrPath, cloneToken, provider);
   return dest;
 }
 
@@ -17692,6 +17738,92 @@ async function ensureGhAuth(runner, ghCmd, token) {
     log.warn("host-agent", `gh auth errored: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
+var FALLBACK_GLAB_VERSION = "1.54.0";
+var GLAB_RELEASE_API = "https://gitlab.com/api/v4/projects/gitlab-org%2Fcli/releases/permalink/latest";
+async function resolveLatestGlabVersion() {
+  try {
+    const res = await fetch(GLAB_RELEASE_API, { headers: { Accept: "application/json" } });
+    if (res.ok) {
+      const body = await res.json();
+      const tag = (body.tag_name ?? "").replace(/^v/, "");
+      if (/^\d+\.\d+\.\d+$/.test(tag)) return tag;
+    }
+  } catch {
+  }
+  return FALLBACK_GLAB_VERSION;
+}
+async function ensureGlabCli(runner, deps = {}) {
+  if (runner.which("glab")) return "glab";
+  const arch2 = ghArch();
+  const platform3 = process.platform;
+  if (arch2 === null || platform3 !== "linux" && platform3 !== "darwin" && platform3 !== "win32") {
+    log.warn("host-agent", `glab auto-install unsupported on ${platform3}/${process.arch} \u2014 skipping`);
+    return null;
+  }
+  const osToken = platform3 === "darwin" ? "darwin" : platform3 === "win32" ? "windows" : "linux";
+  const ext = platform3 === "win32" ? "zip" : "tar.gz";
+  const binaryName = platform3 === "win32" ? "glab.exe" : "glab";
+  const downloadFn = deps.downloadFn ?? download;
+  try {
+    const version3 = await resolveLatestGlabVersion();
+    const asset = `glab_${version3}_${osToken}_${arch2}`;
+    const url2 = `https://gitlab.com/gitlab-org/cli/-/releases/v${version3}/downloads/${asset}.${ext}`;
+    const tmpRoot = fs38.mkdtempSync(path42.join(os34.tmpdir(), "codeam-glab-"));
+    const archive = path42.join(tmpRoot, `${asset}.${ext}`);
+    if (!await downloadFn(url2, archive)) {
+      log.warn("host-agent", "glab download failed \u2014 skipping (git push/pull still work)");
+      return null;
+    }
+    const extract = await runner.run("tar", ["-xf", archive, "-C", tmpRoot], { timeoutMs: 6e4 });
+    if (extract.code !== 0) {
+      log.warn("host-agent", `glab archive extraction failed (code=${String(extract.code)}) \u2014 skipping`);
+      return null;
+    }
+    const candidates = [
+      path42.join(tmpRoot, "bin", binaryName),
+      path42.join(tmpRoot, asset, "bin", binaryName),
+      path42.join(tmpRoot, binaryName)
+    ];
+    const extractedBin = candidates.find((c2) => fs38.existsSync(c2));
+    if (!extractedBin) {
+      log.warn("host-agent", "glab binary not found in the extracted archive \u2014 skipping");
+      return null;
+    }
+    const binDir = codeamBinDir();
+    fs38.mkdirSync(binDir, { recursive: true });
+    const target = path42.join(binDir, binaryName);
+    fs38.copyFileSync(extractedBin, target);
+    fs38.chmodSync(target, 493);
+    log.info("host-agent", `glab installed to ${target} (v${version3})`);
+    return target;
+  } catch (e) {
+    log.warn("host-agent", `glab auto-install errored: ${e instanceof Error ? e.message : String(e)} \u2014 skipping`);
+    return null;
+  }
+}
+async function ensureGlabAuth(runner, glabCmd, token) {
+  if (!token) return;
+  try {
+    const status2 = await runner.run(glabCmd, ["auth", "status"], { timeoutMs: 15e3 });
+    if (status2.code === 0) {
+      log.info("host-agent", "glab already authenticated \u2014 leaving the existing login untouched");
+      return;
+    }
+    const login = await runner.run(
+      glabCmd,
+      ["auth", "login", "--hostname", "gitlab.com", "--stdin"],
+      { timeoutMs: 2e4, input: `${token}
+` }
+    );
+    if (login.code === 0) {
+      log.info("host-agent", "glab authenticated with the linked GitLab token");
+    } else {
+      log.warn("host-agent", `glab auth login failed (code=${String(login.code)}) \u2014 glab unauthenticated`);
+    }
+  } catch (e) {
+    log.warn("host-agent", `glab auth errored: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
 var defaultGitToolingRunner = {
   which(cmd) {
     try {
@@ -18539,7 +18671,7 @@ async function autoUpgradeBeforeCriticalCommand() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
-  const current = true ? "2.61.31" : null;
+  const current = true ? "2.61.33" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18556,7 +18688,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.61.31" : null;
+  const current = true ? "2.61.33" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;
@@ -18576,7 +18708,7 @@ var SELF_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
 var SELF_UPDATE_VIEW_TIMEOUT_MS = 3e4;
 var SELF_UPDATE_INSTALL_TIMEOUT_MS = 18e4;
 function currentCliVersion() {
-  return true ? "2.61.31" : null;
+  return true ? "2.61.33" : null;
 }
 function runCmd(cmd, args2, timeoutMs) {
   return new Promise((resolve8) => {
@@ -18785,6 +18917,9 @@ function isDeployPayload(p2) {
   if (p2.cloneToken !== void 0 && typeof p2.cloneToken !== "string") {
     return false;
   }
+  if (p2.repoProvider !== void 0 && p2.repoProvider !== "github" && p2.repoProvider !== "gitlab") {
+    return false;
+  }
   if (p2.headroomEnabled !== void 0 && typeof p2.headroomEnabled !== "boolean") {
     return false;
   }
@@ -19433,7 +19568,12 @@ var HostAgentSupervisor = class {
       if (!isAbsolutePathTarget(payload.repoOrPath)) {
         report("cloning", "cloning repository");
       }
-      const cwd = await prepareWorkspace(payload.repoOrPath, payload.deployId, payload.cloneToken);
+      const cwd = await prepareWorkspace(
+        payload.repoOrPath,
+        payload.deployId,
+        payload.cloneToken,
+        payload.repoProvider ?? "github"
+      );
       let childEnv;
       let extraArgs = [];
       if (payload.houseProxy) {
@@ -19474,15 +19614,23 @@ var HostAgentSupervisor = class {
       if (payload.cloneToken) {
         try {
           report("preparing", "configuring git tooling");
-          const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
-          if (ghCmd) {
-            childEnv.PATH = `${codeamBinDir()}${path46.delimiter}${childEnv.PATH}`;
-            await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
+          if ((payload.repoProvider ?? "github") === "gitlab") {
+            const glabCmd = await ensureGlabCli(defaultGitToolingRunner);
+            if (glabCmd) {
+              childEnv.PATH = `${codeamBinDir()}${path46.delimiter}${childEnv.PATH}`;
+              await ensureGlabAuth(defaultGitToolingRunner, glabCmd, payload.cloneToken);
+            }
+          } else {
+            const ghCmd = await ensureGhCli(defaultGitToolingRunner, payload.cloneToken);
+            if (ghCmd) {
+              childEnv.PATH = `${codeamBinDir()}${path46.delimiter}${childEnv.PATH}`;
+              await ensureGhAuth(defaultGitToolingRunner, ghCmd, payload.cloneToken);
+            }
           }
         } catch (e) {
           log.warn(
             "host-agent",
-            `gh tooling setup skipped: ${e instanceof Error ? e.message : String(e)}`
+            `git tooling setup skipped: ${e instanceof Error ? e.message : String(e)}`
           );
         }
       }
@@ -38569,7 +38717,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.61.31" : "0.0.0-dev";
+  const cliVersion = true ? "2.61.33" : "0.0.0-dev";
   const apiBase2 = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto13.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -39080,7 +39228,7 @@ async function mcpRun(args2) {
 // src/commands/version.ts
 var import_picocolors15 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.61.31" : "unknown";
+  const v = true ? "2.61.33" : "unknown";
   console.log(`${import_picocolors15.default.bold("codeam-cli")} ${import_picocolors15.default.cyan(v)}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeam-cli",
-  "version": "2.61.31",
+  "version": "2.61.33",
   "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",
   "type": "commonjs",
   "main": "dist/index.js",